Monitor a staging site behind a password or firewall

A staging site that asks for a password can still be watched, so you hear about a broken build before a client opens the link. OctoPing can sign in for each check with HTTP Basic Authentication, or send a secret header that your firewall lets through. This guide sets up both and shows how to confirm they work.

What you need

• A staging site that answers on the public internet. OctoPing checks from outside your network and refuses private and internal addresses, so a site that only opens on a VPN or on localhost can't be monitored.
• A role of Member, Admin or Owner to add or edit a site.
• For the first method, the username and password the site asks for. For the second, access to the firewall or web server rule that blocks outside requests.

Method 1: HTTP Basic Authentication

Use this when the browser shows its own sign-in box before the page loads. That box is Basic Authentication.

1. 1. Open the advanced settings

   Choose Add Website, enter the staging address in Website URL and open Advanced request settings at the bottom of the form. To change a site you already monitor, open it, choose Edit and use the same section.

2. 2. Enter the credentials

   Under HTTP Basic Authentication, fill in Username and Password. On an existing site the password field is empty on purpose, because OctoPing never shows a stored password. Type the password again every time you save the site. A blank field replaces the stored password with nothing, and the next check fails.

3. 3. Save and read the first result

   Choose Add Website, or Save Changes on an existing site. OctoPing runs the first check straight away. The site should show Online.

Without credentials, a protected site answers every check with HTTP 401. Any status outside 200 to 399 counts as a failure, so OctoPing would report the site as down and send a down alert, and the cause reads Unauthorized (HTTP 401). That's the first thing to check when a staging site you just added shows as down.

Method 2: a secret header for your firewall

Use this when a firewall or web server rule blocks outside traffic and you'd rather allow a header than a list of addresses. A header travels with every check, so the rule works no matter where the check comes from.

1. 1. Make up the secret

   Pick a header name that nothing else uses, such as X-Monitor-Token, and a long random value. This command prints one.

   openssl rand -hex 16

2. 2. Add the rule on your side

   In your firewall, CDN or web server, allow a request when that header carries your value. How you write the rule depends on the product, so use its own documentation. Match on the header and nothing else.

3. 3. Test the rule before you add it to OctoPing

   Send one request without the header and one with it. The first should be refused and the second should come back with the page.

   curl -i https://staging.example.com/
   curl -i -H "X-Monitor-Token: YOUR_VALUE" https://staging.example.com/

4. 4. Add the header to the site

   In Advanced request settings, under Custom HTTP Headers, choose + Add Header. Type the name in Header name and the secret in Header value. Save the site.

OctoPing sends custom headers and Basic Authentication credentials with every uptime and content check, from the primary checker and from the probe regions. The checks reference lists what each check sends.

Verify it works

• The site shows Online and the Last Checked time moves forward.
• To prove the protection is on and that OctoPing gets through because of what you entered, remove the custom header, or change the password to a wrong value, and save. The next check should fail with Unauthorized (HTTP 401) or Forbidden (HTTP 403). Do this on a site with no client contacts on its status page, or pause its notifications first, because after the retry threshold a failing site sends real down alerts to your channels and to client contacts. Put the right value back afterwards, including the password, and save again.
• If OctoPing refuses to add the site and says the address isn't allowed, the site isn't reachable from the internet. Use a public hostname.