Scanner IP address
The IP address the CentralCSP scanner connects from, and how to allowlist it when a firewall, WAF, or bot filter blocks a scan.
Last update:
The CentralCSP scanner requests your pages from a fixed address. The CSP scanner, the security headers scanner, and the Reporting API checker all connect from it.
If a firewall, a bot filter, a rate limiter, or a WAF blocks that address, a scan fails or returns partial results. Allowlisting the address lets scans through.
Current scanner IP address
The scanner connects from 37.187.139.96. Allowlist it for inbound HTTP and HTTPS requests to the pages you want scanned.
Some firewalls call this an allowlist, a whitelist, or an IP allow rule. The three names mean the same thing here.
When the scanner IP address changes
The address changes from time to time. Treat the value above as current rather than permanent, and re-check this page if scans start failing after a period of working.
The API returns the current list from GET /v1/workspaces/{workspaceId}/scans/ips, so an allowlist you maintain automatically can read it rather than being edited by hand. The call is authenticated and needs a workspace member token or an API key.
Signs of a blocked scanner
A blocked scanner does not always look like an error. Watch for these instead:
- A scan finishes but reports no headers on a site you know sends them.
- A scan times out on a site that loads normally in a browser.
- Your own access logs show requests from the address above with a 403 or 429 status.
- Results differ between a scan and what you see in browser developer tools.
Check your firewall and bot filter before reporting a scan as wrong. A challenge page returns a valid response, so the scanner reads the challenge rather than your site.
What the allowlist does not cover
Allowlisting the scanner address affects inbound scan traffic only.
It has no bearing on browser reports. Those arrive from your visitors' own browsers, from many addresses, and are delivered to your reporting endpoint rather than fetched by CentralCSP. Blocking the scanner does not stop report collection, and allowlisting it does not start it.
Next steps
- Platform security
- Connect your site
- Tools, where the scanners live