Monitoring

Cloudflare, WAFs and firewalls

Allow-list Tenium checks in Cloudflare WAF, Wordfence, Sucuri and server firewalls without opening the site to everyone.

Tenium identifies itself on every request:

User-Agent: Tenium-Monitor/1.0 (+https://tenium.app/bots)

On Pro and above you can add a custom header per monitor. We recommend x-tenium-secret: <random>. Use both together in allow rules.

Cloudflare WAF custom rule

Security → WAF → Custom rules → Create rule, expression editor:

(http.user_agent contains "Tenium-Monitor/1.0") and (http.request.headers["x-tenium-secret"][0] eq "YOUR_SECRET")

Action Skip, components: All managed rules, Rate limiting rules, Bot Fight Mode. If you have Super Bot Fight Mode, set “Definitely automated” to Allow or checks may still be challenged.

Optionally add an IP condition using the list at /checker-ips:

and (ip.src in {164.92.217.216})

Cloudflare rate limiting

Each live region at 30 seconds is 2 requests a minute per URL; a monitor that uses all 2 live regions sends about 4 a minute. If you rate-limit below that, add the skip rule above or raise the limit for the monitored path.

Wordfence

Firewall → Allowlisted URLs does not cover User-Agents. Instead use Rate limiting → Allowlisted IPs and paste the checker IPs. Also set “If a crawler’s page views exceed” to a value above 12 per minute or set it to “throttle” instead of “block”.

Sucuri

Firewall → Access control → Allow IP addresses, paste checker IPs. Alternatively allow the User-Agent under Security → Allow user agents.

nginx / Apache / fail2ban

Allow the checker IPs before any rate-limit or geo-block rule. nginx example:

geo $tenium { default 0; 164.92.217.216 1; }
map $tenium $limit_key { 0 $binary_remote_addr; 1 ""; }
limit_req_zone $limit_key zone=site:10m rate=10r/s;

For fail2ban add the IPs to ignoreip in jail.local.

Verifying

Open the monitor, press Check now, and confirm every region shows the expected status. In Cloudflare, Security → Events filtered by your rule shows skips arriving from the checker IPs.