Troubleshooting

    Whitelist Lemwatch monitoring IPs

    Allow Lemwatch checks through your firewall, WAF, or rate limiter using our published IP ranges and User-Agent.

    Updated 2026-07-09
    2 min read
    whitelist
    firewall
    ip

    Quick answer#

    Copy the Lemwatch probe IP ranges and User-Agent from Settings → Monitoring → Probe IPs and add them to your firewall, WAF, and rate limiter allow-lists. This stops false "down" alerts caused by your own security tools.

    What it fixes#

  1. 403/429/503 responses to Lemwatch only
  2. Sites that show "down" in Lemwatch but load fine in your browser
  3. Intermittent alerts that clear seconds later
  4. Bot-challenge pages returning HTML 200s instead of your real site

    5. Where to find it in Lemwatch#

    Settings → Monitoring → Probe IPs. Copy the CIDR ranges and the Lemwatch/1.0 User-Agent string.

    How to whitelist#

  5. Open Settings → Monitoring → Probe IPs and copy the ranges.
  6. Add the IPs to your firewall or WAF allow-list (Cloudflare, AWS WAF, Sucuri, Wordfence, etc.).
  7. Add the Lemwatch/1.0 User-Agent to any bot-management or rate-limiter rule.
  8. If you use Fail2Ban or similar, add the IPs to ignoreip.
  9. Run Check now on the affected site — the alert should clear within 60 seconds.

    10. FAQ#

    Do the IPs change?#

    Rarely — we publish 7-day advance notice via the Changelog and email when they do.

    Can I identify Lemwatch by User-Agent alone?#

    Yes, but IP + UA is safer since UA strings are trivially spoofed.

    Related#

  10. Cloudflare blocking Lemwatch
  11. Fixing 5xx errors from firewalls
  12. Site shows down but is actually up
    13. Was this article helpful?

    Previous

    Why am I getting false alerts?

    Next

    Cloudflare is blocking Lemwatch checks

    Related Articles

    Cloudflare is blocking Lemwatch checks

    Fix Cloudflare "Challenge", "Managed Challenge", or 1020 errors that make Lemwatch see your site as down.

    Fixing 5xx errors caused by your firewall

    Diagnose 502, 503, and 520 responses that only appear in Lemwatch — usually WAF rate limits or origin timeouts.

    My Site Shows as Down But It's Working

    Why LemWatch might report downtime when your site is actually accessible.

    Why did my SSL grade drop?

    SSL grade drops when a cipher, protocol, or certificate chain changes — here is how to identify the exact cause and fix it.

    Back to Help Center