For IT & Network Admins

Allow PayrollFerry auto-updates

PayrollFerry keeps itself current by downloading its own signed updates. For those updates to reach your users, one domain needs to be reachable from your network. This page gives your IT team the exact, no-guesswork steps.

Last updated July 2026

Back to PayrollFerry

If your firewall, web proxy, or DNS filter is blocking software updates, PayrollFerry may stop updating and eventually fall behind. The fix is simple: allow one domain over standard HTTPS. No inbound access is needed, no ports need to be opened to the internet, and no payroll data is ever involved.

Allow this one domain

updates.payrollferry.com
HTTPS (TCP 443) Outbound only - no inbound No authentication Resolves to Cloudflare

That is the whole requirement. If your network already allows normal outbound web browsing to unclassified business sites, PayrollFerry updates will usually work with no change. The sections below are for locked-down networks that block by default.

What PayrollFerry requests

All update traffic goes to that single domain. Allowing the domain covers every file below.

Each update package is cryptographically signed. PayrollFerry verifies that signature on the machine before it installs anything, so a tampered or corrupted download is rejected automatically.

Allow the domain, not an IP address

updates.payrollferry.com is served from Cloudflare's global network, which uses many rotating anycast IP addresses (for example in the 104.x and 172.66.x ranges). Those addresses change without notice, so please create your rule against the domain name, not a fixed IP. An IP-based rule will silently break the next time Cloudflare rebalances.

Steps for common setups

Find the one that matches your environment. You only need the ones you actually run.

Firewall / gateway

SonicWall, Fortinet, Palo Alto, pfSense, Meraki

  • Add an outbound allow rule for destination updates.payrollferry.com on TCP 443 (HTTPS).
  • Use an FQDN / domain object if your firewall supports one, so it tracks Cloudflare's changing IPs for you.
  • No inbound rule is required. Nothing listens or connects into your network.

Web proxy / secure gateway

Zscaler, Netskope, Cisco Umbrella SWG, Blue Coat

  • Add updates.payrollferry.com to your URL allowlist (or the destination for PayrollFerry's traffic).
  • If the proxy categorizes sites, allow it under Software / Technology and remove any block by category.
  • Allow the full path as well as the host if your rule is path-specific.

SSL / TLS inspection

Any product that decrypts HTTPS

  • Add updates.payrollferry.com to your do-not-decrypt / TLS-inspection bypass list.
  • PayrollFerry validates the update's own signature, so a decrypt-and-re-sign proxy can interrupt an update. Bypassing inspection for this one domain avoids that.
  • The domain uses a standard publicly-trusted certificate, so bypassing it is low risk.

DNS filtering

Cisco Umbrella, DNSFilter, Cloudflare Gateway

  • Add updates.payrollferry.com (and payrollferry.com) to your allow / permit list.
  • If you filter by category, make sure it is not caught by a Software-download or Newly-seen-domain block.

Confirm it works

From any machine on the network, once your rule is in place, one of these should return the update manifest.

In a browser: open https://updates.payrollferry.com/exactpay-update.json - you should see a short block of JSON, not a block page or error.

PowerShell (Windows):

Invoke-RestMethod https://updates.payrollferry.com/exactpay-update.json

Terminal (Mac / Linux):

curl -sSf https://updates.payrollferry.com/exactpay-update.json

Success looks like a small JSON response beginning with { "version": .... If you instead get a timeout, a proxy block page, or a certificate error, the domain is still being filtered - re-check the matching section above.

What this traffic is - and isn't

This domain serves only PayrollFerry's own application updates: a small manifest file and signed update packages. It carries no payroll data, no employee information, and no client files - PayrollFerry runs locally and none of that ever leaves the machine. Allowing this domain lets the app stay current and secure; it does not open any path into your data.

Stuck, or your security team needs more detail?

support@payrollferry.com

A real person will help you get the rule right.