October 24-25 DDoS Attack

On October 20th, Pushover's website began receiving a Distributed Denial of Service (DDoS) attack from thousands of different IP addresses. The rate of attack was not substantial and was easily identifiable, so it did not cause much of a service disruption. This attack was limited to our website (dashboard) and did not impact our API or message sending.

Once the IP addresses were automatically blocked throughout the 20th and 21st, the attackers moved on to more substantial attacks on Pushover's API servers beginning on October 24th. The rate of these attacks were substantial enough that Pushover's network infrastructure provider began automatically blocking much of the traffic which unfortunately impacted legitimate access to our API.

Throughout the 24th and 25th, our API and website were sporadically unavailable due to these attacks, at one point causing one our servers to become unresponsive. Upon restarting the server, its replicated database became out of sync, causing a very small number of users, devices, and applications registered during a small window on the 24th to be lost as it was re-synchronized.

In the afternoon of the 25th, we moved our services behind a DDoS mitigation company to reduce the impact on our infrastructure and restore reliable connectivity to our users. During this move, our e-mail gateway services for @api.pushover.net and @pomail.net services were temporarily unreachable for around two hours. As these e-mails were likely queued up on remote e-mail servers, once our services were restored, these messages flowed into our e-mail gateways and notifications were processed as quickly as possible.

At no point during these attacks were our servers compromised or breached. These attacks were packet floods and DNS amplification attacks aimed at our servers with the intent to make them unreachable and/or cause monetary loss.

Technical note: A side-affect of moving behind the DDoS mitigation service is that TLS (SSL) negotiation against api.pushover.net is now being handled by the mitigation company so we are not currently able to support legacy TLS/SSL ciphers which may be needed by older servers, which we had been able to accommodate before.

We are continuing to monitor these attacks and will make necessary mitigations as needed.

Update 10/26 05:45 CDT: After a quiet period of service stability, the DDoS attacks resumed early this morning and Pushover's network provider completely disabled (null routed) access to api.pushover.net's IP addresses, making our API unreachable for about 2 hours. Service has been restored at 05:20 CDT.

Verizon Wireless Issue (Resolved)

On October 10th, we became aware of an issue with our iOS and Android apps reporting errors reaching our API, only affecting users on Verizon Wireless.

This issue does not affect receiving push notifications through Pushover, as those are related through Apple and Google servers, though downloading of notification image attachments and app icons is done through our API, which cannot be reached on Verizon. This would also affect reaching our website through the app or a web browser while using Verizon wireless for connectivity.

Upon gathering more reports, the issue appears to be DNS related, and Verizon is actively blocking the entire pushover.net domain for reasons unknown. Attempts to contact Verizon’s technical support and security team have been unhelpful.

We are encouraging Verizon customers to contact Verizon and report the problem so they are made aware of it.

Update 10/13: After receiving some DNS troubleshooting data from a helpful Pushover user on Verizon, it appears Verizon is using a 3rd party DNS filtering system which has erroneously flagged the pushover.net domain as having to due with malware (possibly due to the nature of how our API and callback mechanisms work). After contacting the company that is providing this DNS information, we are awaiting their delisting of our domain.

Update 10/13 17:00 CDT: We have released a new version of our Android app with a temporary workaround that tries a fallback domain if the pushover.net domain cannot be resolved. We are working on releasing a similar workaround for iOS.

Update 10/14 16:10 CDT: We have been notified by the 3rd party DNS filtering company that they have investigated our domain and found that it never had any malware, and have removed our domain from their blacklist. We are working to confirm that Verizon customers can now reach our domain.

Update 10/14 20:32 CDT: We have confirmed that Verizon Wireless customers are now able to reach our pushover.net domain.

Outage report for August 31st, 2019

On the morning of August 31st, we were notified by our network monitoring systems that all Pushover services became unavailable at 7:22 CDT. This included our API, website, desktop client, and dispatch of any queued messages. A message announcing the outage was posted to our Twitter account @PushoverApp.

We were notified soon after by our server/network provider that there was a datacenter-wide power outage affecting all customers of the datacenter. Unfortunately an ETA was not available from the provider during this outage.

At 9:29 CDT, power was restored to the datacenter, but the abrupt shutdown of our servers left their database replication in a failed state. This was resolved and all Pushover services were made available by 9:59 CDT.

While Pushover's infrastructure is largely redundant and can usually survive a partial outage without affecting users, this large-scale outage affected all of our servers at once. We will be looking into what measures can be taken to further enhance our redundancy to avoid future outages of this type.

For more updates, we encourage users to follow our Twitter account.

Animated GIFs and monospace text

Pushover 3.4 has been released today for iPhone and iPad, Android, and Desktop, and brings full support for animated GIFs and monospace text support.

Many Pushover users rely on our e-mail gateway to receive Pushover notifications from e-mails sent out by devices that don't directly support Pushover, such as security cameras. After adding image support, we received a number of requests from users to support animated GIFs that are sent out from these security cameras, showing a few seconds of activity instead of just a static snapshot.


Animated GIFs can be sent directly to our API as well, as detailed in our API documentation.

In addition to animated GIFs, version 3.4 brings support for monospace text in messages (but not notifications at this time, due to limitations on mobile platforms). This text is shown in a monospace font that preserves spaces and tabs, which can be useful for sending a formatted message with columns. These messages can be sent to our API with the monospace parameter set to 1.

Pushover 3.4 is available now for iPhone and iPad, Android, and Desktops/Browsers.

GitHub webhook support

Pushover has been available as a GitHub Service since 2002, making it easy to get Pushover notifications each time commits were pushed to your repositories.

GitHub has recently announced that they are replacing GitHub Services with webhooks, which means the Pushover support in GitHub will be going away in January 2019.  Any repositories that you are receiving Pushover notifications from will need to be updated to use Pushover’s new GitHub webhook.

To replace a GitHub Pushover service with a webhook, or to add a new Pushover webhook to your repository, start by clicking the Settings button on your repo page:

Then click Webhooks in the menu along the left side:

Click “Add webhook”

And finally, enter the following URL for the webhook:


Replace “YOUR_USER_KEY” with your actual Pushover user key, which you can find on your Pushover Dashboard.  The rest of the fields can be left at their defaults, which will send Pushover notifications for “push” actions just as the old GitHub Service did.

Note: Our webhook currently supports the “push” event.  If you need custom notifications for other types of events, please contact us.

Pushover 3.2 adds dark theme and 2FA

Today we’re happy to announce the release of version 3.2 of our Pushover apps for Android and iOS which feature two-factor authentication and an optional dark theme.

Two-Factor Authentication

Our website and apps now support Two-Factor Authentication (commonly referred to as 2FA or Multi-factor Authentication/MFA) for increased account security. We currently support TOTP-based 2FA through mobile applications such as Google Authenticator and Authenticator for iOS. Once your account is configured for 2FA, you’ll be required to enter a 6-digit code from one of these apps which changes every 30 seconds, in addition to your account password.

Logging into our mobile applications with Two-Factor Authentication requires the new version 3.2 of our apps. You can activate 2FA on the settings page of our website.

Dark Theme

A common feature request we’ve received is for a dark theme in our mobile apps. Pushover users often have to use the app late at night when working on call, or just prefer using darker-themed apps.

Our iOS and Android apps support toggling a dark theme which applies to all of the screens in the apps:


You can download version 3.2 of our apps today in Apple App Store and Google Play.

Pushing Images with Pushover 3.0

Version 3.0 of our Android, iPhone/iPad, and Desktop apps are available today which include support for receiving push notifications with image attachments!

A popular use case of our E-mail Gateway has been to receive instant notifications from internet-connected security cameras when they detect motion. Many of these cameras attach a snapshot image of the motion to the e-mail which, up until now, has been discarded and passed through as just a text notification. Starting today, these e-mails will also pass through the attached image which will be displayed in the Pushover notification and in the app.

Currently, image attachments are limited to 2.5 megabytes.  Once an image attachment has been fully downloaded by your devices, it is stored offline on your device and then deleted from our servers for increased privacy.

For software accessing our API directly, we have new documentation with all of the details for how to upload image attachments.

If you use curl to send notifications, it’s as easy as:

curl -s \
--form-string "token=APP_TOKEN" \
--form-string "user=USER_KEY" \
--form-string "message=here is an image attachment" \
-F "attachment=@/path/to/your/image.jpg" \

We hope you enjoy this new functionality and find great new uses for sending images with Pushover.

Download Pushover for iOS and iPad, Pushover for Android, or get started with Pushover for Desktop.

Overriding the Mute Switch and Do-Not-Disturb with Pushover for Teams

Pushover is used in many organizations for sending network monitoring alerts to Ops teams and even in many volunteer firefighter departments to send out secondary alerts.

A popular feature Pushover has had for years is our Emergency-priority alerts, which repeat at a given interval until the recipient acknowledges it by tapping a button on the notification. Combined with per-alert sounds, this can be enough to get a user’s attention when they’re busy (or wake that unfortunate on-call person from their slumber).

A key feature of our new Pushover for Teams service is the ability for team members to configure SMS fallback, which will retry emergency-priority alerts over SMS in cases where the user is out of range of reliable Internet service, or to do custom alerting not possible with our mobile apps due to OS restrictions.

Here we’ll walk through setting up SMS fallback and configuring an iPhone running iOS 11 to bypass the hardware mute switch and Do Not Disturb mode, both of which may be turned on when a user is sleeping and interfere with receiving emergency alerts.

Setting up SMS Fallback

To get started, login to your Pushover Dashboard and click on Configure SMS.  If you do not see this option, you’ll need to signup for Pushover for Teams first.

Next, select your country and enter your phone number.  Note: SMS fallback is currently only supported for US, Canada, and UK mobile numbers.

You should receive a confirmation code on your mobile phone within a few seconds.

Enter that confirmation code on the Pushover website and click Verify Number:

Your SMS number is now setup and configured with some default settings.  Change them if you want and click Save Changes, otherwise you’re all done.

Configuring Mute-Switch Override

For iPhone users, you can configure Pushover’s SMS messages to bypass the hardware mute switch, as well as Do Not Disturb mode (emergency-priority messages already bypass your configured Pushover Quiet Hours).

Note: Pushover messages delivered outside the US and Canada are sent from a different, country-specific number, and will differ from the 312-757-PUSH number shown here.

Open the Messages app and tap on the notification from Pushover that included your confirmation code.  Then tap on the icon at the top.

Next, tap on Create New Contact.

Assign a name in the Company field if you want, and then tap on Text Tone (not Ringtone).

Enable the Emergency Bypass option, and optionally chose a distinct vibration pattern and alert tone.

Repeating Notifications

By default, iOS will only play the text message sound and vibration once.  To enable automatically repeating the alert until you dismiss it, open the main Settings app, then Notifications, then Messages.  Tap on the Repeat Alerts option and choose the amount of repeats.

You’re all set!

Now when receiving an emergency-priority notification through Pushover that is not acknowledged before it’s set to retry (and according to your SMS retry setting entered on the dashboard), you’ll get the next retry as a text message which will now bypass your device’s mute switch and Do Not Disturb.  To acknowledge the SMS message, just text back 1.

If you’re new to Pushover, try it out for free on iPhone/iPad, Android, or Desktop.  For more advanced features like SMS fallback demonstrated here, check out Pushover for Teams.

Pushover for Teams

We’re very excited to announce Pushover for Teams: a monthly service option ideal for companies and organizations deploying Pushover to multiple users.

Pushover for Teams includes a number of extra features on top of our current Pushover notification service such as:

  • Centralized user, group, and application management
  • Simplified licensing - all users get access to our iOS, Android, and Desktop platforms with no additional licensing fees
  • Higher free message limit - one team application can send up to 25,000 messages per month for free
  • SMS fallback delivery - for priority 2 messages requiring acknowledgement, users can configure Pushover to deliver retries as SMS messages and acknowledge them just by texting back replies
  • Automatic group updating
  • Priority message delivery - puts team messages at the front of our delivery queue for lower latency
  • Priority support

For more information on Pushover for Teams or to signup, check out our Teams page.