SaaSMaestro checks your websites directly from its own servers. If a firewall, security plugin or bot protection blocks those servers, the checks fail and you get false alarms. Allowlisting our IP addresses prevents that.
What to allowlist
| Item | Value |
|---|---|
| IP address | 35.214.110.192 |
| User agent contains | SaaSMaestroMonitor/1.0 |
| Ports | 443 (HTTPS) and 80 (HTTP) |
Allowlist by IP address where you can. A user agent can be copied by anyone, so treat it as a way to recognise our requests in your logs rather than as proof of who sent them.
Regional uptime probes are small servers in other regions that load your home page only when our main server can’t, to confirm an outage before it’s declared. If they’re blocked too, a problem between our main server and your website can’t be told apart from real downtime.
Why SaaSMaestro scans your websites
Google Analytics and Search Console only report what they record. They can’t tell you that a website is down, that the tracking tag has been removed, or that a change has told Google to stop indexing your pages. By the time those problems show up in Google’s numbers, days of traffic or data are already lost. Checking each website directly catches them within minutes or hours.
The scan is used for:
- Uptime: confirming the website responds, so you’re alerted when it goes down.
- Google tag: confirming the home page still carries the right GA4 tag, so a missing or wrong tag is caught before data is lost.
- robots.txt and sitemap: spotting changes that block search engines or drop pages from your sitemap.
- Search tags on key pages: noticing when a title, meta description, canonical address or noindex setting changes on your home page or busiest landing pages, and adding it to your timeline.
- SSL certificate: warning you before the certificate expires and visitors see a security error, and checking that HTTPS works.
- Security headers: grading the headers your home page sends and finding files it loads over plain HTTP.
- Key page checks: loading the pages you choose, such as pricing or signup, and checking they contain the right text.
- Website icon: fetching the icon shown next to each website in SaaSMaestro.
See Website health monitoring for details of each check.
What the scan does, and doesn’t, do
- It requests the home page every 15 minutes, and once a day robots.txt, the sitemap and up to five of your busiest landing pages. Once a week it reads the certificate, loads the home page to check its security headers and follows up to 40 internal links.
- Key pages you add are requested as often as you choose, every 5, 15 or 60 minutes.
- It only reads public pages, the same way a visitor’s browser would. It never logs in, submits forms, follows every link or crawls the whole website.
- The traffic is tiny: around a hundred requests a day per website, far less than a single search engine crawler.
- Scans don’t appear in Google Analytics, because they don’t run the tracking tag.
Some services don’t visit your website at all, so they need no allowlisting: domain expiry is looked up in the public registration database (RDAP or WHOIS), DNS records through public DNS-over-HTTPS, and blacklists with Google Web Risk and URLhaus. Lab performance tests are run by Google’s PageSpeed Insights from Google’s own servers, so they need Google let through rather than us. Heartbeats work the other way round: your jobs send requests to SaaSMaestro. Your Google data comes from Google’s APIs.
Signs that the scan is being blocked
- “Website is down” alerts for a website that loads fine in your browser. This happens when a firewall silently drops our requests.
- “No Google tag found in the home page’s HTML” even though GA4 is recording visits. This happens when a challenge or block page is returned instead of your home page.
- Key page checks failing because the expected text is missing, when a challenge page is served instead of the page.
- Missing or wrong page titles, a sitemap that seems to have disappeared, or a letter tile instead of the website’s icon.
How to allowlist the addresses
The exact steps depend on what protects your website. Allowlist the addresses everywhere requests could be blocked:
| Protection | What to do |
|---|---|
| Cloudflare | Add an IP Access Rule with the action “Allow” for the address, or a WAF custom rule that skips bot protection and rate limiting for it. |
| WordPress security plugins | In Wordfence, Sucuri, iThemes or similar, add the address to the allowlisted or trusted IP addresses. |
| Hosting firewall | Add the address to the allow list in your hosting control panel, or ask your host to do it. |
| Server firewall | Allow incoming connections from the address on ports 80 and 443, for example in iptables, ufw or your cloud provider’s security groups. |
| Rate limiting and geo-blocking | Exempt the address from rate limits and country blocks. |
You don’t need to do anything in SaaSMaestro afterwards. Uptime is checked again within 15 minutes, daily checks within a day and weekly ones within a week, and any false alarms clear by themselves.
If you’d rather not be scanned
Owners and admins can switch off any Website health service in its dialog under Settings → your workspace → Data connections, or leave a website out of it. Your Google Analytics and Search Console data is unaffected, but that service’s checks, alerts and automatic notes stop.