WP Foreman’s bot

When a website owner connects their WordPress site to WP Foreman, WP Foreman visits that site to look after it: backups, updates, uptime checks and the other jobs they ask for. This page describes those visits so hosts, firewalls and site owners can recognize them.

What it visits

Only websites whose owner connected them to WP Foreman with the WP Foreman plugin. It doesn’t crawl the web, follow links to other sites, or index pages for search or AI training. Nothing it reads is sold or shared; backups belong to the site’s owner.

What it does

• Site management (backups, restores, plugin, theme and WordPress updates, inventory): signed requests to the WP Foreman plugin’s endpoint, /wp-json/wpforeman/v1/command (or /?rest_route=/wpforeman/v1/command). Backups run once a day by default, plus any the owner starts.
• Uptime checks: one request for the site’s home page (or a page the owner picked) every minute, and a second look from another region only when a check fails.
• Connecting a site: a few requests to the plugin while the owner pairs or approves it.

How to recognize it

Every request carries an HTTP Message Signature (Web Bot Auth) with Signature-Agent: "https://app.wpforeman.com". The public key is published at app.wpforeman.com/.well-known/http-message-signatures-directory, so anyone can check a request really came from WP Foreman. Separately, everything sent to the plugin is signed with a key unique to that website, and the plugin refuses anything else (see How WP Foreman connects to your site).

robots.txt

WP Foreman isn’t a crawler, so it doesn’t read robots.txt: it only visits websites whose owner asked it to, and only the pages above. To stop the visits, the owner disconnects the site in WP Foreman or deactivates the WP Foreman plugin, and they stop at once.

If it’s being blocked

See Connection troubleshooting for allowlisting 134.209.78.176 in common firewalls and hosts.

Contact

Questions or a problem with these visits: help@wpforeman.com.