Skip to main content
mySites.guru
Free Audit
CriticalA PHP security release fixes two CVSS 9.2 flaws, and PHP 8.1 and older get no patchWhat it means for your site

mySites.guru service traffic

mySites.guru monitors, audits, updates and backs up WordPress, Joomla and PHP sites for the people who run them. It is operated by Blue Flame Digital Solutions Limited, United Kingdom.

It only contacts sites whose owner added them to mySites.guru. It does not crawl, follow links, index pages or collect content for AI training.

User-Agents and addresses

Connector calls and uptime checks each come from one address, and each address has matching forward and reverse DNS.

TrafficUser-AgentIP addressReverse DNS
Connector callsUser-Agent
mySites/5.4 (+https://mysites.guru/bot/)
IP address
178.62.5.35
Reverse DNSmain-workers.mysites.guru
Uptime checksUser-Agent
Mozilla/5.0+(compatible; mySites/1.0; https://mysites.guru/bot/)
IP address
165.227.239.229
Reverse DNSmonitor-engine.mysites.guru

On OVH hosts the connector sends the bare mySites/5.4, because OVH rejects a User-Agent with brackets in it. Connector calls and uptime checks also send the header X-Questions: Please email phil@phil-taylor.com. The same addresses are published as plain text at manage.mysites.guru/ips.

What we request

Uptime check
A HEAD request for the site's home URL every 5 minutes, with a 45 second timeout. A 2xx response ends the check. Only if it fails do we try again: a second HEAD 10 seconds later, then a GET 10 seconds after that. Redirects are followed. Nothing else on the site is requested.
Connector call
A POST to the connector the site owner installed: /plugins/system/bfnetwork/ on Joomla, /wp-content/plugins/mywpguru/ on WordPress, /bfnetwork/ on other PHP sites. A snapshot runs about every 12 hours per site. Audits, backups and updates run only when the owner starts or schedules them. Only one audit runs at a time per server, and with the update queue on, only one update at a time per account and server.
robots.txt and sitemaps
With each snapshot, a GET for /robots.txt, then for up to three sitemaps it declares and /sitemap.xml, /sitemap_index.xml and /wp-sitemap.xml. We read at most 600 bytes of each.
Header check
With each snapshot, one GET for /X-mySites-guru-Header-Check-For-Snapshot-Should-Be-A-404, a URL that should not exist, to read the security headers the server sends. Redirects are not followed.
Admin URL
With each snapshot, one GET for /administrator/ on Joomla or /wp-admin/ on WordPress, without following redirects, to see whether the admin area is restricted.
Certificate check
A TLS handshake to read the SSL certificate, at most twice a day per site.
Favicon (audits only)
During an audit, a GET for the home page and its favicon, to see whether the site still uses the default Joomla icon. This request sends no User-Agent today.

robots.txt

We read robots.txt to tell the site owner what it says, for example that it blocks search engines by mistake. We are not a crawler, so we do not apply its rules to our own requests: each one goes to a site its owner registered with us.

Is it really us?

Look up the reverse DNS for the address in your log, then look up the name it returns. If the second answer is the address you started with, the request came from us. A request with our User-Agent from any other address did not come from us.

178.62.5.35

dig +short -x 178.62.5.35
dig +short main-workers.mysites.guru

165.227.239.229

dig +short -x 165.227.239.229
dig +short monitor-engine.mysites.guru

Let it through Cloudflare

If your site is behind Cloudflare and our checks are being challenged, add a WAF custom rule with this expression and the Skip action:

Expression

(http.user_agent contains "mySites/" and ip.src in {178.62.5.35 165.227.239.229})

Have it skip Super Bot Fight Mode and the managed rules, plus any custom rules of your own that challenge automated traffic. The rule matches the User-Agent and the address together, so a stranger copying our User-Agent from another address is still challenged. Bot Fight Mode, the free plan's version, cannot be skipped by a rule; if it blocks us, turning it off is the only fix.

How to stop it

The site owner can stop both kinds of traffic. Deleting the site's uptime monitor in mySites.guru stops the uptime checks. Removing the site from mySites.guru and uninstalling the connector stops everything else, because without the connector there is nothing for us to call. If you run the server rather than the site, email us and we will contact the owner.

Contact

Email phil@phil-taylor.com, the address in the X-Questions header. A person reads it.

Changes

  • Page published. Both User-Agents now point here. Before this the connector sent mySites/5.4 (+https://manage.mySites.guru) and the uptime checks sent Mozilla/5.0+(compatible; mySites/1.0; https://monitor.mysites.guru/).

Last reviewed . This page is maintained by hand and updated whenever our traffic changes.