What "this target is blocked by platform admission rules" means
#Why it appears
WebCheck resolves your URL to an IP before deciding — internal addresses, reserved ranges (including the cloud metadata IP 169.254.169.254), and domains on the platform blocklist all get refused. Users can submit arbitrary URLs that our servers then visit; without this gate the Monitoring feature would be an internal-network probing tool.
#What you'll see on a hit
- The form shows the concrete reason for the block — not a vague "forbidden";
- The page shows a hit count — how many times it fired is your clue to a false positive.
#I really do need to monitor an internal network
The guard is on by default; a self-hosted single-tenant deployment can have the platform switch off block_private_targets (the runtime safety net goes off with it). Multi-tenant SaaS generally can't disable it — instead attach your own node to the internal site (see Vantage points) so probes originate from your own network.
Pointing a domain at an internal IP to get around the block won't work — the domain's DNS is resolved before judging, and any record landing in an internal range is refused.
Related: Vantage points & proxies