The ShieldMarc uptime monitoring bot

ShieldMarc checks websites that our customers have asked us to watch, so we can tell them quickly when a site stops responding and when it comes back. If you have found our requests in your logs, this page explains what they are, how to recognise them, and how to reach us.

What it does

The bot requests only the addresses a customer has added as a monitor, and a customer can add an address only on a domain they have verified with ShieldMarc. Verifying a domain means publishing a record in its DNS, which only someone who controls the domain can do. The bot does not crawl, follow links, index content or fetch anything it was not asked to check. Each monitored address is requested about once a minute from each checking location, and a failed request may be retried once a moment later. When every Cloudflare location fails at once, our own server checks again straight away, so that we can confirm a real outage before anyone is alerted. It follows a small number of redirects, because a monitored homepage often redirects, but only within the monitored site and other domains the same customer has verified: a redirect anywhere else is not followed. It reads only as much of the page as it needs to confirm the site is working.

Where it checks from

Checks run from Cloudflare's network and from ShieldMarc's own servers in Germany. Because Cloudflare addresses are shared with many other services, we do not rely on a list of addresses to identify ourselves. Use the signature or the header described below instead.

How to recognise it

• Request signature. Requests are signed with HTTP Message Signatures (RFC 9421) under the Web Bot Auth scheme. They carry Signature, Signature-Input and Signature-Agent: "https://shieldmarc.com" headers. Our public key is published at https://shieldmarc.com/.well-known/http-message-signatures-directory. A valid signature is the only reliable proof a request came from us.
• Marker header. Every request carries X-Shieldmarc-Probe: 1. It is a fixed value, so anyone can copy it; treat it as a convenient filter rather than as proof.
• User agent. Every check sends a user agent beginning ShieldMarc-Uptime-Probe/1.0, followed by where it was sent from and a link to this website. We do not disguise our checks as a web browser.

Allowing it through a firewall

If your firewall or bot protection is blocking our checks, the owner of the monitor will see the site reported as unreachable from some locations. The simplest fix is a rule that skips challenges for requests carrying the header X-Shieldmarc-Probe: 1. Where your firewall can verify HTTP Message Signatures, verifying ours against the key above is stronger, because it cannot be imitated.

Did not ask to be monitored?

Every check starts at an address on a domain that someone verified with ShieldMarc by publishing a record in the domain's DNS, and follows redirects only within domains that same customer has verified. If you do not want your site checked, for example because a domain has changed hands, tell us which address and we will look into it and stop the checks where appropriate. Contact ShieldMarc support.