What it requests
Every request is a plain GET. WPMooBot never sends POST requests, never fills in forms, never logs in and never calls xmlrpc.php.
- The pages the site owner added, as often as every 30 seconds for the most important sites and every few minutes for the rest.
- A few WordPress addresses, hourly to daily: the home page, the login page, /wp-json/, /wp-content/debug.log and /readme.html. They show whether WordPress works. Once a day it also asks whether files that should stay private can be read: copies of wp-config.php, .env, .git/HEAD, PHP error logs and the uploads folder. Some of these requests ask only for the first bytes.
- The http, https and www versions of the site's address and of the other domains the owner added, to follow their redirects, and its SSL certificate.
- When a site is added, once: /robots.txt, the usual sitemap and login addresses and the WooCommerce Store API.
DNS and domain lookups go to public resolvers and registries, not to the site's server.
How to recognise it
Every request carries the user agent below and comes from Falkenstein and Nuremberg, from these addresses:
- User agent
- WPMooBot/1.0 (+https://wp-moo.com/bot)
- IPv4
- 2.31.200.107 116.203.70.13
- IPv6
- 2a01:4f8:c016:1710::/64 2a01:4f8:1c1c:fff::/64
The same list as plain text, one address or range per line: wp-moo.com/bot/ips.txt. It changes when we add a checking location, so a tool that reads it stays up to date.
Verify a request
A firewall or developer that checks hostnames can verify that a request is ours by reverse DNS. The reverse lookup of the IP address it came from ends in .bot.wp-moo.com, and a forward lookup of that name includes the same IP address. The commands are under For your developer.
How to let it in
Allow our IP addresses in the tool that blocks us. A rule on the user agent works too, but anyone can send a user agent, while the addresses can't be faked.
Wordfence
- In WordPress, open Wordfence › Firewall › All Firewall Options.
- Under Advanced Firewall Options, add our IP addresses to "Allowlisted IP addresses that bypass all rules", one per line.
- Save the changes.
Imunify360
- In your hosting panel (cPanel, Plesk or DirectAdmin), open Imunify360 › Firewall.
- On the White list tab, add each of our IP addresses.
- No access to Imunify360? Ask your host to whitelist our IP addresses.
fail2ban
- Add our IP addresses to
ignoreipin the[DEFAULT]section of/etc/fail2ban/jail.local, after the addresses already there. - Reload fail2ban with
fail2ban-client reload.
Cloudflare
- In the Cloudflare dashboard, open the domain and go to Security › WAF › Custom rules.
- Create a rule where the field IP Source Address is in our IP addresses.
- Pick the Skip action and tick every rule type it offers, then deploy the rule.
Using WP Moo? Press "Check again" on the site when you're done.
For your developer
The address list is plain text, IPv4 first. Fetch it to keep a firewall allowlist current:
curl -fsS https://wp-moo.com/bot/ips.txtThe fail2ban line, with our addresses:
ignoreip = 127.0.0.1/8 ::1 2.31.200.107 116.203.70.13 2a01:4f8:c016:1710::/64 2a01:4f8:1c1c:fff::/64The Cloudflare rule as an expression:
(ip.src in { 2.31.200.107 116.203.70.13 2a01:4f8:c016:1710::/64 2a01:4f8:1c1c:fff::/64 })To verify a request by reverse DNS, look up the IP address it came from, then the name that returns. The name must end in .bot.wp-moo.com, and its addresses must include that IP address:
host <ip address>
host <name from the first lookup>Is WPMooBot doing something it shouldn't, or should it stop visiting your site? Email [email protected] with the site's address.