StaygreenBot

Last updated 22 October 2026

StaygreenBot is the checker of Staygreen, a monitoring service for apps people build. It visits the addresses a Staygreen user added to a monitor, to tell them whether their app is up and working. When a user adds an app, it also reads the app’s address, a few common health routes on its site and some of what its page links to, to suggest checks (below). If it reached you, someone added your address, or an app whose page links to it. It doesn’t crawl and doesn’t read robots.txt.

Its requests carry the user agent StaygreenBot/1.0 (+https://staygreen.io/bot), unless the user who added the address set a User-Agent header of their own, which replaces it.

Where it comes from

Scheduled checks come from servers in Toronto (Canada) and San Francisco (US). Each check runs from one of them in turn. An HTTP or TCP check that fails, or a certificate that can’t be reached, is made again at once from another of them, or about 20 seconds later from the same server when no other is running, and only a second failure counts. A certificate that is invalid counts at once, and a DNS record counts once 2 checks in a row fail, since the resolvers answer the same from anywhere. The servers’ IP addresses aren’t published; the user agent is how to recognise a check.

Scheduled checks haven’t started for new workspaces yet.

A Staygreen user can also test a monitor before saving it, or have Staygreen suggest checks for an app’s address. Those requests are sent when the user acts: a test once, and a suggestion each time the user adds the app, changes its address or opens its suggested checks, together at most 20 times in 10 minutes for one user and 100 an hour for a workspace. They come from our hosting provider’s servers, with the same user agent.

What a check sends

• HTTP: one request to the address the user gave, with the method they chose (GET, HEAD and POST), Accept: */*, and the headers they stored, such as a key for their own app, which go only to the site they were added for. A stored header replaces StaygreenBot’s own of the same name, its user agent included. It follows at most 5 redirects, reads at most the first 64 KB of a response, and opens a new connection every time. It adds no cookie of its own and keeps none it is sent: a cookie reaches you only if the user stored a Cookie header.
• TCP: a connection to the host and port the user gave, with a TLS handshake if they asked for one, and nothing sent over it.
• Certificates: a TLS handshake on port 443, to read the certificate’s expiry, issuer and names. No HTTP request.
• DNS: nothing sent to you directly. Staygreen asks Cloudflare’s (1.1.1.1) and Google’s (8.8.8.8) public resolvers for the record, and they may ask your name servers.
• Suggesting an app’s checks requests, once each: the address, following at most 5 redirects and reading at most 256 KB; /health, /healthz, /api/health, /api/healthz, /status, /up, /readyz, /livez and /actuator/health on its site, without following redirects, reading at most 8 KB of each; its certificate; the web app manifest its page names (at most 32 KB), at most 2 of its stylesheets on the same site (256 KB each) and at most 4 of its scripts on the same origin (512 KB each), read for its brand colour and whether it uses Supabase; if the app has no logo yet, at most 4 of the icons its page or manifest names (or /favicon.ico), which may be on another host, reading at most 512 KB of each; and, when the page names a Supabase project, that project’s Auth and Storage health on Supabase. At most 4 of these are open to the app’s site at a time. The same limit covers all hosts and DNS reads. It also checks up to 6 sign-in frontends named by the page (4 s and 512 KB each), the app domain’s nameservers and first-party sign-in CNAMEs. Provider detection reads the page already fetched; it makes no extra discovery request.

Staygreen refuses addresses on private networks, and checks again after every DNS answer and at every redirect.

How often

For each monitor: HTTP and TCP every 3 minutes on the Free plan and every minute on Builder, certificates every 6 hours, and DNS records every 10 minutes. A failed HTTP or TCP check, or a certificate that couldn’t be reached, adds one more. A Free workspace can add at most 5 monitors on one host, besides the certificate check Staygreen adds with the first HTTPS one.

If you didn’t ask for this

If StaygreenBot is checking an address of yours and you don’t want it to, write to contact@staygreen.io with the address, and the checks against it are stopped.

What Staygreen keeps from a check is in our privacy policy.