About the Pingdomain bot

Pingdomain is an uptime monitoring service. If you are seeing our requests in your logs, it is because someone asked us to check that your site is up — usually you, or someone who runs it.

We request one URL at a time, at the interval that person chose. We do not crawl, we do not follow links, and we never fetch anything the monitor was not pointed at.

Pingdomain/2.0 (+https://www.pingdomain.io; monitoring)

This string is stable. If you want to allow our checks, matching on Pingdomain/ is safe — but the signature below is a stronger test, because a user agent can be claimed by anyone.

Blocking the user agent works, and we will not work around it. A 403 or 429 is a clear answer and we treat it as one — the monitor simply reports the site as failing to whoever set it up, which is usually enough for them to stop.

If the checks are unwanted and you cannot reach the person who created them, write to abuse@pingdomain.io with the URL and we will disable the monitor.

Every check we send is signed with Web Bot Auth, which builds on RFC 9421 HTTP Message Signatures. Three headers come with each request:

The public key is published as a JWKS at https://www.pingdomain.io/.well-known/http-message-signatures-directory.

Our current key is identified by this thumbprint:

What gets signed

The signature covers the @authority of the request — your host — and the Signature-Agent header. Rebuild the signature base exactly like this, with a newline after each of the first two lines and none after the last:

"@authority": example.com
"signature-agent": "https://www.pingdomain.io"
"@signature-params": ("@authority" "signature-agent");created=1758300000;expires=1758300300;keyid="…";alg="ed25519";tag="web-bot-auth"

Then verify the base64 signature bytes against our Ed25519 public key. Because @authority is covered, a signature captured from one site cannot be replayed against another, and expires keeps the window short.

Our key directory is registered with Cloudflare's bot verification programme, so if your site is behind Cloudflare you can allow verified bots rather than maintaining a rule of your own.