CoreDash Bot: User Agent, Request Header and IP Addresses
Seen CoreDash/1.0 in your logs? A CoreDash customer is checking a URL they added. What the bot requests, and how to let it through.
Trusted by market leaders · Client results
What the CoreDash bot requests
CoreDash is a real user monitoring tool for Core Web Vitals. Two of its tools request pages themselves, and only URLs that a CoreDash customer added:
- Audit. Loads one page in Chrome when a customer starts a cRUM audit, and records a trace of LCP, INP and CLS. It runs when someone clicks, never on a schedule.
- Uptime. One GET request per monitored URL every 10 minutes. It reads at most 256 KB of the HTML and loads no images, scripts or CSS.
The bot follows no links and indexes nothing. What it measures goes to the customer who asked for it.
User agent
CoreDash/1.0 (audit; +https://www.coredash.app/bot) CoreDash/1.0 (uptime; +https://www.coredash.app/bot)
The word in brackets is the tool that sent the request. Every CoreDash tool starts with CoreDash/, so a firewall rule on CoreDash/ lets all of them through, including tools added later. Let CoreDash through your firewall has the rule for Cloudflare and AWS WAF.
A secret request header
A user agent is public. Anyone who copies CoreDash/1.0 gets past a rule that only checks it. So every CoreDash project has its own secret value, and every audit and uptime check for that project sends it:
X-CoreDash-Bot: your-project-value
CoreDash sends it only to your own site, with or without www. Scripts, fonts and other hosts the page loads never get it. The value, and a Cloudflare rule with it, are in CoreDash under Project settings > CoreDash bot.
IP addresses
Allow by user agent or header, not by IP. CoreDash adds and moves servers, and the addresses change with them. A rule on an old address blocks the bot again, and nothing tells you.
One case needs an address: the uptime origin check on a server that only accepts Cloudflare's IP ranges. That server refuses the connection before it reads a user agent or a header. The uptime checker sends from these addresses today:
51.195.222.219 51.195.222.220
Check this page again when the origin check starts failing with a connect timeout.
Why your site got a request
A CoreDash customer added the URL: their own site, a client's site, or a page they test. If you don't know who, contact us with the URL and the time from your log. We pass it on to the customer, or stop the checks.