# Allowlisting StatusTick

> How to let StatusTick checks through your firewall, WAF or bot protection, so blocked checks do not hide the real status of your site.

If your site uses a firewall, a WAF or bot protection (for example Cloudflare), it may block or challenge StatusTick's checks. StatusTick then shows the monitor as **Blocked** instead of guessing that the site is down. To see the real status, let StatusTick through.

## Option 1: allow our IP addresses

StatusTick publishes the IPv4 and IPv6 addresses its checks come from, as a machine-readable list at a stable URL shown in your dashboard. This option covers every check type. Changes to the list are announced 7 days ahead.

## Option 2: a custom header or User-Agent

StatusTick's HTTP checks send this `User-Agent`:

```
StatusTick/2.0 (+https://statustick.com/docs/checks)
```

Add a rule in your firewall that allows requests with that value. Anyone can send the same `User-Agent`, so for a stricter rule set your own: on each HTTP monitor you can set a custom `User-Agent` or an extra request header, for example a secret token. Then allow requests with that header.

Use a long random value and treat it like a password.

Browser checks load the page in Chromium and arrive with Chromium's default `User-Agent`, like a normal visit. For them, use option 1.

## What Blocked means

A check is Blocked when the answer looks like a firewall or a bot challenge, for example a `403` or `429` with WAF headers, or a challenge page. It does not mean your site is down. Blocked monitors:

- send one notice with these steps, at most once a day,
- do not open incidents unless you turn that on,
- show as operational on public status pages, because the real status is unknown.