The HelloWP Report bot

What do we fetch?

The public homepage, a few standard files (robots.txt, sitemap, favicon) and some well-known paths that are a risk when left public by accident (such as .env, debug.log). For those we only check whether they are reachable; we do not store their content. That is at most 30 light requests (the background run first fetches robots.txt as well). Then a headless Chrome loads the homepage once, like a mobile visitor.

We do not crawl (we never follow links from page to page), never submit a form, never log in anywhere, and we do not get around your firewall: if the site turns us away, that is what the report says.

How often?

One measurement takes about 20 seconds. The background run measures at most two sites at a time, sends only one measurement to a server at a time, and waits at least 10 seconds between two measurements on the same server. It measures the same site at most once every 30 days. When someone requests a measurement on the site, a domain is measured at most once every 15 minutes.

Where do we come from?

The bot sends its requests from these IP addresses:

• 162.55.50.244
• 2a01:4f8:1c1e:5d45::1

The file for the owner check is not fetched by the bot but by our website, from a different address. The DNS check sends no request to your site.

Want to let it through your firewall?

If your firewall blocks the bot, your report will be incomplete. Prove on the owner page that the site is yours, and we show you how to let only our bot through.