Security plugins and firewalls keep bad bots out. Sometimes they mistake WP Moo's checker for one. Your visitors still get in, but we get a block page instead of your site, so we can't tell how it's doing.
How you can tell
Which tool blocks us
How to let us in
For your developer
Every request is a plain GET, never a POST, with this user agent:
WPMooBot/1.0 (+https://wp-moo.com/bot)
Our addresses as plain text, one address or range per line, IPv4 first, to keep an allowlist current:
curl -fsS https://wp-moo.com/bot/ips.txt
To verify a request by reverse DNS instead, use the two lookups under For your developer on Our checker.
A response is a block when it carries cf-mitigated: challenge or SG-Captcha: challenge (whatever its status), or when a 4xx or 5xx body matches a known block page (for Cloudflare also a cf-error-code of 1005 to 1012, 1015, 1020 or 1106). A 401 or 403 with bot-check words in the body, or any 429, is a block too, unless the same answer has an Urgent finding: then it counts as a failure.
Something unclear on this page? Email [email protected]