WPMonitorBot
Last updated: Sep 24, 2026
WPMonitorBot is the crawler of WP Monitor, a security and health scanner for WordPress sites. If you found it in your server logs, this page explains why it visited, what it requests and how to control it.
Why it visited your site
WPMonitorBot does not crawl the web, follow links or look for new sites. It visits a site when someone asks for it:
- a visitor entered the site address in the scanner on https://wp-monitor.com;
- an account holder monitors the site and ran a new scan of it.
The only exception: once a week it loads the homepage of about 30 sites featured in the WordPress.org Showcase, to pick the example sites shown under our scan box.
A scan looks only at what any visitor can see: WordPress, plugin and theme versions, signs of malware and spam, blocklists, defacement, speed and caching, and common security settings.
How to recognize it
Requests identify themselves with this user agent:
Mozilla/5.0 (compatible; WPMonitorBot/1.0; +https://wp-monitor.com/bot)All requests come from this IP address:
85.9.27.160Requests with a browser or Googlebot user agent
Hacked WordPress sites often show spam or a redirect only to search engines or to visitors coming from Google, and a normal page to everyone else, including the site owner. To detect this, a scan also loads your homepage, robots.txt and sitemap as a regular Chrome browser, as Googlebot, and with a Google search referrer, and compares the results.
These requests come from the same IP address as above. They are not from Google and do not pass Google's reverse DNS check. The screenshot is taken the same way, with a headless Chrome browser that loads the homepage with its images, styles and scripts.
What a scan requests
Besides the homepage, a scan may request:
- /robots.txt and your sitemap (the one robots.txt names, or /sitemap_index.xml, /wp-sitemap.xml, /sitemap.xml), plus a few of the sitemaps it lists;
- /wp-json/ and /readme.html, to confirm the site runs WordPress;
- /wp-login.php, /wp-admin/upgrade.php and /xmlrpc.php, which may show the WordPress version;
- /wp-json/wp/v2/users, /wp-content/uploads/ and /wp-content/debug.log, to warn you if they expose usernames, a file listing or a debug log;
- one of your site's own CSS or JavaScript files, to check its browser cache headers;
- a HEAD request to /wp-includes/, to identify the web server.
A scan is a few dozen HTTPS requests over less than a minute. Each one reads only a limited number of bytes and gives up after 10 seconds. WPMonitorBot never logs in, never submits forms, never tries passwords and never sends attack payloads: it only reads public pages.
robots.txt and blocking
Because every scan is started by a person, like a visit to your site, WPMonitorBot does not use robots.txt to decide whether to scan. It reads robots.txt only to find your sitemap.
If you do not want your site scanned, block the IP address 85.9.27.160 in your firewall or security plugin. Blocking only the WPMonitorBot user agent will not stop the browser and Googlebot requests described above.
If our bot causes a problem on your site, or you think it is being used against you, write to [email protected] and we will look into it.