Uptime monitors and performance testing tools can occasionally be affected by MODX Cloud's Web Application Firewall (WAF). This guide explains how to set these tools up so they work reliably without triggering false positives.
Why monitoring tools can be affected
Uptime and performance monitors make automated, repeated requests to your site—sometimes from many locations at once. While this is entirely legitimate, the WAF may not distinguish this traffic from automated attack traffic without some configuration.
The most common scenario is a monitoring service making requests from IP addresses that aren't yet recognised by our systems. This can result in false "downtime" alerts even when your site is working normally.
Services we've already configured
Many popular monitoring services publish their probe IP addresses or provide an IP list endpoint we can poll at intervals. We've already configured access for a number of these. If you're using a well-known hosted monitoring service and experiencing issues, contact support—there's a good chance we can resolve it quickly.
Setting up a new monitoring service
To avoid false downtime alerts from the start, contact us before setting up monitoring on your site. We'll need:
- The name of the monitoring service
- The URL being monitored
- The service's probe IP addresses or a link to their published IP list, if available
Most monitoring services document their probe IP ranges in their help centre. A quick search for "[service name] probe IP addresses" usually finds it.
Performance testing tools
Tools like GTmetrix, WebPageTest, and similar performance testers typically make one-off requests from known IP ranges. These generally work without issue, but if you're running repeated tests in a short period and seeing blocks, contact support.
Already seeing false downtime alerts?
If your monitoring service is reporting downtime but your site is accessible to regular visitors, the monitor's probe requests are likely being blocked by the WAF. Email support@modxcloud.com with:
- The monitoring service name
- The URL being monitored
- The probe IP address(es) triggering the block, if you can find them in the service's settings or documentation
We can resolve this and configure ongoing access at the same time.
A note on check frequency
Very frequent checks—for example, every 30 seconds from multiple locations simultaneously—can sometimes resemble attack patterns. If you're using aggressive monitoring settings and experiencing issues, try reducing check frequency as a first step, then contact support if the problem continues.
Related: