A site connected to HeraPress with the Hera Site Monitor plugin is checked from outside by the HeraPress monitor: whether it is up, and screenshots of its pages on desktop and mobile. When a firewall or a bot check answers instead of the site, HeraPress cannot see the site. The Site Monitor screen then says HeraPress could not see the site: a bot check or a firewall answered instead. and the screenshot shows Blocked by a bot check. HeraPress keeps one screenshot of the block and compares nothing, so the look you approved stays as it was. After 2 hours in which every check got a bot check or a firewall page instead of the site, HeraPress sends you one alert to say so.

Who checks

The HeraPress monitor checks your site from these addresses:

  • IPv4: 2.31.50.253
  • IPv6 range: 2a01:4f8:1c16:3226::/64

This page lists the current addresses, and is updated when they change.

Each request names itself with one of three user agents. The uptime check:

Mozilla/5.0 (compatible; HeraSiteMonitor/0.1; +https://herapress.com/allowlist/)

Desktop screenshots, taken in headless Chromium:

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/<version> Safari/537.36 HeraSiteMonitor/0.1 (+https://herapress.com/allowlist/)

Phone screenshots:

Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/<version> Mobile Safari/537.36 HeraSiteMonitor/0.1 (+https://herapress.com/allowlist/)

The <version> part changes with each update of the browser. The part to match is HeraSiteMonitor.

What a block looks like to HeraPress

A bot check or a challenge page means that HeraPress could not see the site, and it does not count as down. An answer of HTTP 429 (too many requests) also means that HeraPress could not see the site, not that it is down. A firewall that limits how often one address may ask often answers this way.

A firewall that answers with a plain error and no challenge page, for example HTTP 403 without a page asking the visitor to prove they are human, looks to HeraPress like a site that is down.

So when HeraPress says your site is down, or that it could not see it, while visitors see it normally, check your firewall first.

Cloudflare: Bot Fight Mode

Bot Fight Mode is part of the free Cloudflare plan, under Security > Settings with the filter Bot traffic. We tested it on 2 November 2026. With Bot Fight Mode on, the HeraPress screenshots were blocked by the Cloudflare bot check. With two IP Access rules allowing the HeraPress addresses, the screenshots came through, with Bot Fight Mode still on. To add the rules:

  1. The new Cloudflare dashboard shows IP access rules under Create rule only once the domain has one. For the first one, open the domain in the dashboard, then change the end of the address in the address bar of your browser so that it reads: 
    https://dash.cloudflare.com/<account id>/<your domain>/security/security-rules/ip-access-rules
  2. Create a rule: IP 2.31.50.253, action Allow, for This website, with the note HeraPress.
  3. Create a second rule the same way for 2a01:4f8:1c16:3226::/64.

The Cloudflare documentation explains why this works: custom rules and Page Rules cannot skip Bot Fight Mode, but Bot Fight Mode does not trigger when an IP Access rule matches the request first (Bot Fight Mode). By design, requests that an IP Access rule allows do not show up in Security Events (IP Access rules), so to see that the rules work, look at the Site Monitor screen or at the next screenshot.

On paid Cloudflare plans, Super Bot Fight Mode supports Skip rules, according to the same Bot Fight Mode page. We have not tested it.

Cloudflare: Under Attack mode

Under Attack mode is on the Overview page of the domain, under Quick Actions, and under Security > Settings with the filter DDoS attacks, as Security Level. While it is on, Cloudflare shows every visitor a challenge, and it advises turning it on only when a site is under attack (Under Attack mode). A site under attack may see the HeraPress checks challenged too.

Hera Site Monitor also runs its own page checks, which your site makes against its own pages, and those pass through Cloudflare too. With Under Attack mode on, they report Security challenge for every page, with the note A security check answered instead of the page. Not a problem with the page. To let them through, add an IP Access rule that allows the address of the server your site runs on. That is usually the address in the A record of your domain, on the DNS page in Cloudflare. A server with IPv6 may send its own requests from its IPv6 address, the one in the AAAA record, so allow that address too. Your host can confirm both. The same rule helps when a page check reports Refused because a firewall blocked the request your site made to itself.

Wordfence

Our test site ran the Wordfence firewall, set to Enabled and Protecting, the whole time. Once Cloudflare let HeraPress through, the screenshots came through Wordfence as well: Wordfence did not block HeraPress there. We have not tested every Wordfence setting.

A new Wordfence firewall spends its first week in Learning Mode, which adds to its allowlist the requests it would otherwise block, so a test made during that week shows nothing (Firewall Learning Mode).

Other firewalls and security plugins

Allow the addresses above, the way your firewall or security plugin allows a trusted service. A rule on the user agent alone lets through anyone who sends that name, so use one only where your tool cannot allow an address, and match HeraSiteMonitor. On Cloudflare such a rule would be a custom rule, which cannot skip Bot Fight Mode.