Our bot and IP address

If you've found this page from your logs: requests with the User-Agent below come from MXora Email Send Check. Someone with access to the site has installed our WordPress plugin so we can check the site's emails are working. We only ever call the plugin, and it won't do anything for a request we haven't signed.

How to recognise our requests

We'll update this page before our IP address changes. Webhook alerts we send to our customers' own systems come from the same address, with the same User-Agent.

What the requests do

• Connect the site to an EmailSendCheck.com account, once, while the plugin's connection window is open.
• Run a test: ask the site to send one short, plain-text email through its normal mail setup, to a unique address at our test inbox. This happens on the schedule the site's owner chose, from every 4 hours to once a week, plus any manual tests. The plugin limits itself to a few tests an hour, whatever we ask.

We don't crawl pages, follow links, log in, or read anything else on the site. Every request is signed, and the plugin rejects any request we didn't sign, so allowlisting our address doesn't let anyone else in.

Allowlisting us in a firewall

Firewalls and security plugins sometimes block our requests, because they come from a server rather than a browser. When that happens, the site shows Firewall blocked or REST API blocked in the dashboard, and no tests can run. To fix it:

1. Allow our IP address in the firewall's allowlist. In Cloudflare, that's an IP Access Rule with the action Allow, or a custom rule that skips security checks for our address. In Wordfence, add it to the allowlisted IP addresses in the firewall options. Sucuri, Solid Security and most hosts' firewalls have a similar setting, or ask the host to add it.
2. If the firewall can't allowlist by IP, allow the EmailSendCheck User-Agent instead.
3. If a security plugin limits the WordPress REST API, allow access to /mxora-email-send-check/v1/webhook. The plugin needs the REST API, but only for this one route, and it doesn't need anyone to be logged in.
4. In your Email Send Check dashboard, click Retry connection on the site.

Test emails

Test emails go to addresses at inbox.emailsendcheck.com or inbox.emailsendcheck.co.uk. The plugin can only send to these domains, so it can't be used to send email anywhere else. If the site's mail plugin or email service only allows certain recipients, add our inbox domains.

Questions or problems

If our requests are causing a problem, or you didn't expect the plugin to be on a site you look after, deactivate the plugin to stop them straight away, and get in touch.