Synthetic monitoring

Our probes knock politely.
Here is who is knocking.

Wakora checks sites and multi-step transactions from the outside, the way a visitor would. If you run a WAF or a rate limiter, this page has everything you need: the user agents we send, the fixed addresses we probe from, and the manners we keep.

Honest UA
Every probe names itself and links back to this page. We never impersonate a browser.
Fixed IPs
Probes leave from published addresses only. Allow-list them once, done.
Paced
One request at a time per origin, seconds apart. A probe run never looks like a burst.
5 min
Site checks and transaction flows run on a five-minute cadence from each vantage point.

User agents

Two agents touch your servers from our side. Both identify themselves in every request:

Wakora-Synthetic/1.0 (+https://www.wakora.io/synthetics)
Outside-in probes from our vantage points: availability checks and synthetic transaction flows. This is the only traffic you will see from the addresses below.
Wakora-Monitor
The local agent probing its own sites over loopback. It never leaves the machine, so it never crosses a WAF; you will only meet it in local access logs, always from 127.0.0.1.

Vantage point addresses

All synthetic traffic originates from these addresses. A machine-readable copy lives at wakora.io/synthetics/ips.txt; the list grows as regions launch, and we announce every addition in the changelog before it starts probing.

Vantage pointRegionIPv4
eu-1EU80.232.242.204
eu-2EU80.232.242.204

A ban on these addresses does not read as your site being down. An unreachable-from-PoP verdict needs every vantage point to fail its every probe, and a blocked probe shows up as blocked, so a WAF rule never turns into a false outage page.

Probe manners

  • GET requests with a redirect cap; transaction flows run up to ten steps with a shared cookie jar and a 30-second budget for the whole journey.
  • Per-origin concurrency of one, with pacing between flows. Your server never sees a probe burst.
  • Real TLS verification, the visitor's view. An expired certificate fails the probe the way it fails a browser.
  • Transaction credentials are test accounts your team provides on purpose; we recommend dedicated ones and we mask them everywhere in the product.
  • No crawling. We request exactly the URLs you configured and the ones your redirects point at, nothing else.

Allow-listing us

The clean setup is one WAF rule: allow the addresses above, or allow the Wakora-Synthetic user agent from those addresses. Rate limiters should exempt them too, otherwise a strict limit adds noise to your latency numbers around busy hours.

Watch a whole journey, not just a page.

Login, search, checkout: a transaction flow tells you the step that broke, from the outside, before a customer does.

Start free Read the docs