Home / Allow TideStat
For site owners and hosts
Let TideStat through your host’s bot protection
Some hosts show automated visitors a “please wait” page instead of the website. TideStat then can’t check the site, and says so on its Fix list. Allow TideStat with one rule, by header, address or browser name, and the checks start again.
How to recognise TideStat
Use whichever your host or firewall supports. The header is the most reliable: it stays the same if TideStat moves servers.
- Header
X-TideStat-KeyEvery check sends this header with a value unique to your site. Find it in TideStat under Edit site → Connections → Bot protection pass. - Address
74.208.184.212All of TideStat’s checks come from this server address, including screenshots and the cookie scan. - Browser name containing
TideStatFor exampleTideStat-Monitor/1.0(uptime),TideStat-SEO/1.0,TideStat-A11y/1.0,TideStatBot/1.0. Easy to copy, so pair it with the header or address where you can.
Steps for common hosts and firewalls
- CloudflareSecurity → WAF → Custom rules → Create rule. Match “Request Header”
x-tidestat-keyequals your value, and choose Skip for the bot and WAF features. On the Free plan, Bot Fight Mode can’t be skipped by a rule: add the address under Security → WAF → Tools as an Allow rule, or turn Bot Fight Mode off. - HostingerThe “One moment, please…” page is Hostinger’s own protection. Ask Hostinger support (live chat in hPanel) to allow requests with the header above or from 74.208.184.212 for your domain.
- SiteGroundSiteGround’s anti-bot system shows a check page. Ask SiteGround support to allow requests with the header or from 74.208.184.212 for your site.
- Sucuri firewallIn the Sucuri dashboard, open Access Control and allow TideStat’s address, 74.208.184.212.
- Imunify360 (many cPanel hosts)If your cPanel has Imunify360, add the address to its allow list; otherwise ask your host to.
- Wordfence (WordPress)Wordfence → Firewall → All Firewall Options → Allowlisted IP addresses: add the address. If the block comes from the host rather than Wordfence, use the host’s steps above.
Then run the checks again in TideStat (“Run checks now” on the site page). The “blocked” item clears once a check sees the real site.
Questions
Is it safe to let TideStat through?
TideStat only reads public pages, the same ones any visitor sees. It never logs in, fills in forms or changes anything. The header value works only for your site and only lets TideStat’s checks past the bot check.
Who else gets the header value?
Nobody. TideStat sends it only to your site’s own address, never to other websites, even when your site redirects somewhere else.
The value has leaked or a developer has left. What now?
In TideStat, open Edit site → Connections, create a new value with the key button and save. The old value stops working straight away; update the rule at your host.
Why not just get past the bot check?
Bot protection is there to keep automated visitors out. Disguising TideStat as a person would undo your host’s security, so TideStat asks to be let in instead, like other monitoring services.
How often does TideStat visit?
Uptime every 1 to 60 minutes depending on the plan, and the page checks (search, accessibility, structured data, speed) daily or weekly, plus any check you start yourself.