How Pingtier checks

How Pingtier checks your sites from multiple locations

Pingtier opens as a free beta soon. Sign-up is not open yet.

This page is for the people who run the sites Pingtier watches. It says what a check does, where it comes from, how often it arrives and how to let it through bot protection.

What a check is

Each monitor runs one or more of these checks against a hostname:

  • HTTP(S) status: the response status must be in the expected set.
  • Keyword: the response body must contain a word or phrase you choose.
  • Response time: Pingtier records it and shows it in charts. It does not raise alerts on slow responses.
  • TLS certificate: Pingtier checks the expiry date, the chain and the hostname match. Read more about SSL certificate expiry monitoring.

Each check is one HTTP request, plus up to 5 redirects, with these limits:

  • Pingtier resolves A records only and connects over IPv4. It refuses IPv6-only targets.
  • It follows up to 5 redirects.
  • It reads the response body only for a keyword check, up to 256 KB after decompression.
  • Timeouts: DNS 2 s, connect 3 s, TLS 3 s, first byte 10 s, and 18 s for the whole check.
  • Each check opens a new connection.
  • Probes do not connect to private, loopback or link-local addresses.

Where checks run

Pingtier runs 8 probes on 4 providers: 4 in Europe, 2 in the US and 2 in Asia.

The probe IP addresses are published on this page before sign-up opens. Each new address appears here at least 24 hours before that probe votes.

Each monitor checks from the regions its owner selects: EU, US and Asia. All three are on by default. Each region has probes on at least 2 providers, so a monitor that uses one region can still confirm an outage.

The User-Agent

Every probe request carries this header:

User-Agent: Pingtier-Probe/1 (+https://pingtier.com/probes)

All probes run the same program, so they present the same TLS fingerprint. Pingtier does not imitate a browser.

Request rate per hostname

Pingtier keeps the load on monitored sites low.

  • Normal checks. Each monitor sends one request per check interval, from one probe. The next check comes from a different probe. On the free plan the shortest interval is 3 minutes, so one monitor sends at most 20 requests an hour, plus redirects. After the beta, paid clients can check as often as every 30 seconds, which is 2 requests a minute per monitor.
  • Confirmation. When a check fails or meets a bot challenge, up to 3 other probes check again. Within one confirmation round, the requests start 2 seconds apart.
  • While Down. Pingtier runs one recovery round per interval until the site recovers.
  • Several monitors. If a hostname has more than one monitor, the rates add up.
  • Rate limits. If your site answers HTTP 429, Pingtier counts the site as up and adds a note. It does not retry faster.

How to allow the probes

If bot protection challenges the probes, Pingtier shows the monitor as Blocked. It sends you one email with the probe IP addresses and the User-Agent. To restore checks, allow the probe addresses in your protection.

Cloudflare. Create a WAF custom rule that matches the probe IP addresses, for example ip.src in {<probe addresses>}. Set the action to Skip and select the bot and managed rules that challenge the probes. Place the rule above your challenge and block rules. You can also add the addresses as IP Access rules with the Allow action, but those bypass all custom rules, rate limiting and managed rules for those addresses. A WAF Skip rule cannot skip Cloudflare's free Bot Fight Mode. An IP Access rule with the Allow action that matches the probe addresses stops Bot Fight Mode from triggering. You can also use Super Bot Fight Mode, which supports Skip rules. See Cloudflare's Skip action docs.

AWS WAF and other firewalls. Add the probe IP addresses to an allow rule or an IP set that runs before your challenge rules.

Match on the IP addresses, not only on the User-Agent. Anyone can send a User-Agent header.

New probes

Pingtier adds or replaces a probe in steps. The new address appears on this page first. The probe then runs in a shadow state for at least 24 hours. During that time it sends shadow copies of real checks, so your logs may show it, but its results never count and it never votes. Pingtier activates the probe only after its address has been on this page for those 24 hours.

What Blocked means

Blocked means a bot challenge answered the probes. It is not Down, and it does not open an incident. Read how Pingtier confirms outages and handles bot challenges.

Monitor your client sites

Pingtier is built for web agencies and MSPs. Free during beta. Then EUR 4 per client a month, excl. VAT.

Start free beta

FAQ

Why are the probe IP addresses not listed yet? The probes are not in production yet. Pingtier publishes the real addresses on this page before sign-up opens, and every new address appears here at least 24 hours before that probe votes.

Can I allow the probes by User-Agent only? You can, but it is weaker. Any client can send the same User-Agent header. Match the probe IP addresses.

Do probes check IPv6? No. Probes connect over IPv4 only, and Pingtier refuses hostnames that have only IPv6 addresses.

Will a check run a full browser on my site? No. A check is one HTTP request, plus up to 5 redirects. It does not run JavaScript or load page assets.