About TellMeWhenDownBot

If you're seeing requests from TellMeWhenDownBot in your logs, that's our monitoring engine checking a site someone added to Tell Me When Down.

It identifies itself with this User-Agent:

Mozilla/5.0 (compatible; TellMeWhenDownBot/1.0; +https://tellmewhendown.com/bot)

The bot makes lightweight HTTP requests to check whether a site is up, inspects TLS certificates and response headers, and — only for sites whose owner has verified control — probes for common misconfigurations like a publicly exposed .env.

It never attempts to log in, submit forms, or modify anything. If you believe it's checking a site you own without your permission, contact us and we'll remove it.

Running bot protection or rate limiting?

If your site answers the bot with 429 or 403, your protection is blocking the checks — and we can't tell you when the site really goes down.

Keep the protection on and add a narrow exception for our checker. The usual rule matches the User-Agent above — in Vercel under Project → Firewall, in Cloudflare under Security → WAF → Custom rules, or in your own middleware.

Be clear about what that buys you, though. We publish that string on this page so you can write the rule, which means anyone else can send it too. A User-Agent match is a way to stop blocking us. It is not a way to prove it's us.

Two things make it much safer, and both take a minute:

• Scope the rule to the URL you asked us to monitor, rather than your whole site. Someone copying our User-Agent then gets past your firewall on that one path instead of everywhere.
• Keep a rate limit on the exception. We check roughly nine times an hour across all three regions, so a cap of 30 an hour leaves us plenty of room and an impersonator almost none.

One trade-off worth knowing: if you scope the rule to a single URL and you've verified ownership with us, our deeper security probes hit other paths and will still be blocked. That costs you some findings — it never causes a false downtime alert.

Want a real secret instead of a public string? Get in touch — we can send a header that only you and we know, which makes the rule impossible to copy.

Checks recover on their own within a minute of the block lifting.

Don't want your site scanned?

Anyone can run a free passive scan of a public URL from our /report page.

If you'd rather we never scan yours, enter the domain below and we'll refuse it from now on. (This blocks the free public scan — it doesn't affect monitoring you've set up yourself.)