The ShieldMarc uptime monitoring bot

ShieldMarc checks websites that our customers have asked us to watch, so their dashboard shows quickly when a site stops responding and when it comes back. If you have found our requests in your logs, this page explains what they are, how to recognise them, and how to reach us.

What it does

The bot requests only the addresses a customer has added as a monitor, and a customer can add an address only on a domain they have verified with ShieldMarc. Verifying a domain means publishing a record in its DNS, which only someone who controls the domain can do. The bot does not crawl, follow links, index content or fetch anything it was not asked to check. Each monitored address is requested about once a minute from each checking location, and a failed request may be retried once a moment later. When every Cloudflare location fails at once, our own server checks again straight away, so that we can confirm a real outage before anyone is alerted. It follows a small number of redirects, because a monitored homepage often redirects, but only within the monitored site and other domains the same customer has verified: a redirect anywhere else is not followed. It reads only as much of the page as it needs to confirm the site is working.

Where it checks from

Checks run from Cloudflare's network and from ShieldMarc's own servers in Germany. Because Cloudflare addresses are shared with many other services, we do not rely on a list of addresses to identify ourselves. Use the signature or the header described below instead.

How to recognise it

• Request signature. Requests are signed with HTTP Message Signatures (RFC 9421) under the Web Bot Auth scheme. They carry Signature, Signature-Input and Signature-Agent: "https://shieldmarc.com" headers. Our public key is published at https://shieldmarc.com/.well-known/http-message-signatures-directory. A valid signature is the only reliable proof a request came from us.
• Marker header. Every request carries X-Shieldmarc-Probe: 1. It is a fixed value, so anyone can copy it; treat it as a convenient filter rather than as proof.
• User agent. Every check sends a user agent beginning ShieldMarc-Uptime-Probe/1.0, followed by where it was sent from and a link to this website. We do not disguise our checks as a web browser.

Allowing it through a firewall

"Checks blocked" means your firewall, bot protection or sign-in page is refusing our checks. It does not prove the website is down. A location that keeps blocking us for 30 minutes automatically mutes new outage emails for that monitor. Checks continue about every minute. Emails resume once all four scheduled checking locations have returned clean answers for 24 hours. Another block, failed check or gap longer than three minutes restarts that clean period. Your own Alerts switch stays as you set it; automatic restoration cannot turn it on for you.

1. Find the check in your firewall logs. Look for the monitored address, ShieldMarc-Uptime-Probe/1.0 and X-Shieldmarc-Probe: 1. The monitor's badge names the affected checking locations. A 401, 403, 429 or bot challenge can explain a block; a timeout or server error is treated as outage evidence instead. If you chose to count a 401 or 403 as down in the monitor's status rules, that answer remains an outage failure.
2. On Cloudflare, check verified-bot handling and custom rules. ShieldMarc is listed as "Shieldmarc Uptime" in Monitoring & Analytics. Set verified bots to Allow where that setting is available, then check for a custom rule that blocks or challenges the monitored address before that setting runs. Cloudflare's bot custom-rules guidance explains the order. Free Bot Fight Mode cannot be skipped with a custom WAF rule; see Bot Fight Mode limitations.
3. For the check from our own server, allow its source address. Our server in Germany sends from 78.46.100.252 (verified 23 October 2026). Ask your hosting provider to permit its HTTP checks to the monitored hostname and path, including any redirects. This is particularly useful for hosting protection such as StackProtect. Cloudflare checking locations use Cloudflare's network; this single address covers our own server.
4. Keep the exception narrow, then watch the monitor. Use a verified request signature or a trusted source address to identify us. The marker header and user agent can be copied, so neither is proof on its own. Permit checks of the monitored address while retaining your authentication and other security rules. The dashboard shows when clean checks begin and when outage emails are expected to resume. A recovery email can still close an outage we already emailed you about.

Did not ask to be monitored?

Every check starts at an address on a domain that someone verified with ShieldMarc by publishing a record in the domain's DNS, and follows redirects only within domains that same customer has verified. If you do not want your site checked, for example because a domain has changed hands, tell us which address and we will look into it and stop the checks where appropriate. Contact ShieldMarc support.