The WarmupRocks bot

If you found this page in your server logs: hello! WarmupRocks is a cache-warming service. A site owner (most likely the operator of the site you saw us on) asked us to periodically request their public pages so that CDN edge caches stay warm and real visitors get fast responses.

User agent

For sites that cache separate mobile variants, an optional second pass uses:

Sitemap discovery requests add sitemap discovery to the string. All user agents contain the WarmupRocks token.

Cryptographic identification (Web Bot Auth)

Every warming request is signed with an Ed25519 key following Web Bot Auth (RFC 9421 HTTP Message Signatures): requests carry Signature, Signature-Input and Signature-Agent: "https://warmup.rocks" headers. Our public key directory is served at /.well-known/http-message-signatures-directory. This proves a request really comes from WarmupRocks, independent of IP address, and cannot be spoofed by copying our user agent.

What the bot does and doesn't do

• Requests only URLs listed in the site's public sitemap (plus URLs the site owner added manually).
• Does not execute JavaScript, does not follow links, does not fill forms.
• Is paced and rate-limited; a typical warming pass touches each URL once per region.
• Sends requests from multiple geographic locations, so IP addresses vary.

Identifying and filtering

Match on the WarmupRocks token in the user agent:

• Analytics: server-side analytics can exclude the UA; client-side analytics never sees us, since no JavaScript runs.
• WAF / bot protection: site owners can additionally configure a custom secret header (e.g. x-warm-secret) for their warming requests and write an allow rule for it.

Don't want us on your site?

We only warm sites after the project owner has proven domain ownership, either via a DNS TXT record (_warmup-rocks.example.com) or a response header (x-warmup-verify). Unverified projects are never crawled on a schedule. If your site is still being requested by WarmupRocks and you didn't ask for it, block the user agent or write to abuse@warmup.rocks and we'll remove the project.

Full details in the docs: Bot & user agent · Analytics & WAF filtering