SiteGround's Captcha Is Blocking mySites.guru - again
mySites.guru connects to every site you add and runs security audits, backups, extension updates, and uptime checks against it. To do that, it has to reach your site over the internet the same way a browser does. On SiteGround-hosted sites, every so often, it can’t. SiteGround’s Anti-Bot AI decides our server looks like a bot and hands it a captcha challenge instead of your actual site.
When that happens, an audit stalls, a backup won’t start, or an uptime check reports your site as unreachable, while the site loads perfectly in your own browser. Nothing is wrong with your site, and nothing has changed on our side. Our worker connects from the same published IP address it has used for over a decade. SiteGround has simply decided, for a while, to block it. That is a SiteGround decision, made on SiteGround’s servers, and only SiteGround can undo it.
This is not new, and it is not unique to us. It happens to every management and monitoring platform that talks to SiteGround-hosted sites. Here is what the block looks like, why an automated service can’t just click through the captcha, and the exact support request that clears it.
What SiteGround’s Captcha Actually Does
SG-Captcha is part of SiteGround’s Anti-Bot AI, a system that sits in front of every hosted site and tries to separate human visitors from automated ones. When it flags a request as a bot, it does not serve the page. It serves a captcha challenge instead, on the theory that the traffic might be a brute-force or denial-of-service attempt.
For a person in a browser, this is nearly invisible. The browser receives the challenge, runs the JavaScript, follows the redirect, and loads the real page a moment later. For anything that is not a full browser, an uptime monitor, a security scanner, an API client, or a management platform like mySites.guru, the challenge is a dead end. The client asks for your page and gets a redirect to a captcha it has no way to solve.
The Anti-Bot AI itself is not new. What changed is how aggressively it escalates to a full captcha challenge against automated clients, which is when legitimate tools started getting caught in it.
mySites.guru Is Not the Threat Here
mySites.guru is exactly the kind of automated client the Anti-Bot AI should never be challenging:
mySites.guru is a reputable, long-standing service, connecting from the same IP address to hundreds of thousands of sites. We are not new, malicious, or scary.
We have run from the same published IP address for over a decade. We are not the kind of attack traffic the Anti-Bot AI exists to stop. We are simply automated, and automation is all the AI sees before it puts up the wall.
Because that one address connects to so many sites, the damage is never limited to a single domain. When SG-Captcha decides it does not like mySites.guru, thousands of customer sites are blocked at the same moment. Every owner sees a failed check at once, and a wave of support tickets arrives here, for a block we did not cause and cannot lift.
How Do You Know SiteGround Is Blocking mySites.guru?
The signature is an HTTP 202 response with an sg-captcha: challenge header, where you would normally expect a 200 and your page. A quick curl against the affected site shows it plainly:
HTTP/2 202
server: nginx
content-type: text/html
content-length: 166
sg-captcha: challenge
x-robots-tag: noindex
set-cookie: nevercache-b39818=Y;Max-Age=-1
cache-control: no-store,no-cache,max-age=0The body is a tiny HTML page that redirects to the challenge:
<html>
<head>
<link rel="icon" href="data:;">
<meta http-equiv="refresh"
content="0;/.well-known/sgcaptcha/?r=%2F&y=ipr:178.62.5.35:...">
</meta>
</head>
</html>Two things give it away. The sg-captcha: challenge header is SiteGround telling you exactly which system is intercepting the request. And the redirect target, /.well-known/sgcaptcha/, carries ipr:178.62.5.35, the IP address being challenged. That is our main worker’s address. So this is not a general site fault. SiteGround is specifically holding a captcha in front of the address mySites.guru connects from.
The x-robots-tag: noindex on that response matters too, and we come back to it below.
Why Can’t mySites.guru Just Solve the Captcha?
Because it is a service, not a browser. mySites.guru connects to your site as a headless client to fetch files, read versions, and check that the site is up. There is no browser window, no user, and no JavaScript engine sitting there to run a proof-of-work challenge and click through a redirect loop. It asks for your page over HTTPS and expects your page back.
Even if it could solve the challenge once, that would not fix the problem. Solving SiteGround’s captcha issues a short-lived session cookie to the browser that solved it. Requests carrying that cookie get through; requests from the same IP without it are challenged again. Our worker does not carry a browser session from one request to the next, so it would be challenged over and over. The only durable fix is to stop challenging our IP address in the first place.
Only SiteGround Can Fix This
Before the how-to, here is the single most important point, because it saves you contacting the wrong people:
This is not a mySites.guru issue to solve. This is a SiteGround issue, and only they can solve it.
The block is made by SiteGround’s Anti-Bot AI, on SiteGround’s servers. mySites.guru cannot switch it off, allowlist itself, or change anything on our side to stop it, and neither can our support team. The exemption can only be added inside SiteGround’s own infrastructure, so the request has to go to SiteGround.
How Do You Get the Block Removed?
The fix is a support ticket to SiteGround, asking them to whitelist the mySites.guru IP addresses in their Anti-Bot AI. There is no self-service toggle for this. SiteGround’s own captcha article explains what the challenge is, but it does not give you a way to exempt a service you trust, so the exemption has to come from their support team.
These are the two addresses to give them. Both are published at manage.mysites.guru/ips and have not changed in over ten years:
IP addresses to whitelist:
178.62.5.35- audits, backups, updates, and the connector165.227.239.229- uptime monitoring
The manage.mysites.guru/ips page above is a public, static URL, so it is safe to paste into a support ticket for your host to read. If you are signed in to mySites.guru, the IP addresses help page in your account has more detail on connection issues and what to send your host.
Copy this straight into the ticket and fill in your domain:
Subject: Please whitelist two IPs in your Anti-Bot AI / SG-Captcha
Hello,
I use mySites.guru, a third-party service, to manage and monitor my
website hosted with you. Its servers are currently being served a 202
SG-Captcha challenge instead of my site, which stops the service from
reaching it.
Please permanently whitelist these two IP addresses so requests from
them are never challenged by your Anti-Bot AI / SG-Captcha:
178.62.5.35
165.227.239.229
These are the fixed, published outgoing IPs for mySites.guru and have
not changed in over a decade. You can verify them here:
https://manage.mysites.guru/ips
Please confirm both addresses are exempt from the Anti-Bot AI itself,
not only added to the Blocked Traffic list in Site Tools.
Affected domain: <add your domain>
Thank you.That last line about the Blocked Traffic list matters. That list in Site Tools is a separate feature for your own manual IP blocks, and it does not control which clients the Anti-Bot AI decides to challenge, so adding our IPs there alone will not stop the captcha.
Warning: the block can hurt your Google ranking
The captcha challenge is served with a noindex tag. If SiteGround challenges Googlebot the same way it challenges us, Google receives a noindex page instead of your content and can drop those URLs from its index until the block is lifted. Site owners have watched pages drop out of Google for exactly this reason, so it is worth fixing even if you do not use a monitoring service.
You Are Not the Only Service Being Blocked
This matters, because when a check fails the natural assumption is that something is wrong with mySites.guru. It isn’t. SiteGround’s Anti-Bot AI blocks third-party platforms by design, and the same 202 captcha challenge has been reported by:
- MainWP, a rival WordPress management dashboard, whose users get the identical HTTP 202 on connection and whose documented fix is, word for word, to ask SiteGround support to whitelist the dashboard’s IP.
- Googlebot, which has been served the noindex challenge and de-indexed pages as a result.
- Uptime monitors and security scanners generally, which look like repeated automated hits and get challenged the same way.
It is not even unique to SiteGround. Cloudflare’s Bot Fight Mode has blocked Sucuri’s malware scans, and every serious anti-bot system, Cloudflare and DataDome included, ships a verified-bot allowlist precisely because blunt bot-blocking catches legitimate services. The difference is whether the allowlist is something you can manage yourself or something you have to request one ticket at a time. On SiteGround, for now, it is the ticket.
Fifteen Years With SiteGround
There is some history here I should be honest about. To their credit, SiteGround has stayed independently owned since 2004, while much of the hosting market was rolled up under a handful of conglomerates. In mySites.guru’s early years, SiteGround’s own founders were paying subscribers of the service, for many years, and gave us genuine hands-on help getting it running well on their shared hosting. That relationship mattered, and it is part of why the tool performs the way it does on shared hosts today.
What has faded is the direct line. As a host grows, first-line support gets further from the engineers, and the practical result for anyone integrating with the platform is that there is no proactive way to keep a known-good service allowlisted. The Anti-Bot AI does its job, occasionally decides a decade-old, published, fixed IP is a threat, and the only route back is a per-customer support request. We have tried over the years to set up a standing allowlist so our customers never see this, without success, which is why the workaround still falls to you rather than to us.
None of that is a reason to leave SiteGround. It is a good host. But if you run sites there and use any external tool to manage or monitor them, this is a periodic tax you should know how to pay quickly. mySites.guru works with any site it can reach, across hundreds of sites from one dashboard, and a two-minute support ticket is usually all it takes to get us reaching yours again.
Further Reading
- SiteGround: I am seeing a CAPTCHA page on my website - SiteGround’s own explainer for the Anti-Bot AI captcha.
- MainWP community: SiteGround captcha causing connectivity issues (HTTP 202) - the same block hitting another management platform, with the whitelist fix.
- Phantom noindex tag from SiteGround’s captcha - a first-hand account of the de-indexing side effect.
- Cloudflare: verified bots and false positives - how a major anti-bot system handles the same problem with an allowlist.
