🤖 Overview

jspyda is a web crawler developed and operated by Automattic, the company behind WordPress.com and the Jetpack plugin, and it powers the Jetpack Monitor uptime monitoring service. Introduced around 2012, its sole purpose is to periodically check the availability and response time of sites that have Jetpack installed, feeding real-time status data into the Jetpack dashboard for site administrators. This bot is entirely legitimate and non‑malicious, focusing exclusively on health checks rather than content indexing or AI training.

🌐 Technical Behavior

The jspyda crawler sends simple HTTP GET requests to a website’s root URL and common WordPress endpoints (e.g., /wp-admin/admin-ajax.php) from a distributed pool of servers within Automattic’s cloud infrastructure. Its IP addresses come from publicly documented netblocks such as 192.0.74.0/24, 198.181.116.0/24, and 198.181.117.0/24, and it also uses IPv6 ranges (e.g., 2605:6000::/32). By default, the bot checks each site approximately every 5 minutes, but it dynamically reduces frequency if the target returns errors or high latency. It does not execute JavaScript, download images, or parse CSS; only the HTTP status code, response headers, and the first few kilobytes of body content are retrieved. The requests use persistent connections and a Connection: keep-alive header, and the bot supports both HTTP/1.1 and HTTP/2 depending on the server.

📋 robots.txt Compliance

According to official Jetpack documentation, jspyda fully respects robots.txt directives and will not crawl paths that are disallowed under a Disallow rule. However, because it is a status‑checker rather than a content crawler, it deliberately ignores Crawl-delay directives, as its polling interval is already bound by the service’s internal throttle. Site owners can block jspyda entirely by adding a User-agent: jspyda line with a Disallow: / rule in their robots.txt file.

🔍 Detection Indicators

The primary detection indicator is the User-Agent string, which appears as jspyda/1.0 or jspyda/2.0 depending on the bot version. Additionally, the requests lack a Referer header and often include a custom X-Jetpack-Monitor: 1 header for easy identification. IP addresses originate from Automattic’s published netblocks, and reverse DNS lookups typically return hostnames like monitor-*.wordpress.com or *.automattic.com. The bot’s Accept header is set to */*, and it does not send cookies or other session identifiers.

📊 Data Usage

The data collected by jspyda is used exclusively for uptime monitoring and performance analytics within the Jetpack Monitor service. It records HTTP status codes, response times, and timeout events, which are then displayed in the WordPress admin dashboard as a simple “up/down” indicator along with a latency chart. No page content is stored, indexed, or fed into machine‑learning models; the bot is purely a health‑check agent intended to notify site administrators of outages.

⚙️ Rate Limiting Policy

Website administrators commonly rate‑limit jspyda due to its frequent requests—every 5 minutes per monitored site—which can inflate server logs and trigger application‑level alerts. While the bot is legitimate and essential for downtime notifications, a threshold‑based rate limit (e.g., blocking IPs that exceed 50 requests per minute) provides a safety net against unintended aggressive behavior without completely disabling the monitoring service.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.