Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11To whitelist screenshot API traffic, allow the screenshot provider’s documented outbound (egress) IP addresses or CIDR ranges at the system that is rejecting the request. Restrict the rule to the required destination, normally TCP 443, keep API-key or bearer authentication enabled, run a real capture, and verify the source in your firewall logs. Treat provider ranges as changeable configuration, not permanent facts.
First identify which traffic you are allowing
There are two different connections in a screenshot workflow, and they require different allowlists.
The renderer fetching your website
A hosted screenshot service loads your page from its own browser workers. Your origin firewall, WAF, reverse proxy, or application sees the renderer’s egress IP as the source. This is the address range that must be allowed on your website.
Your application calling the screenshot API
Your server, CI runner, or worker calls the provider’s API. The provider sees your application’s egress IP. If the provider has an inbound IP allowlist, add your application’s stable NAT address there. Allowing the renderer’s IPs on your API client’s firewall does not solve this second problem.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Webhook delivery
A completed-job webhook is a third flow: inbound traffic from the provider to your application. Give it its own authentication, signature verification, replay protection, and network rule. Do not assume that an allowlist for page rendering also protects webhook endpoints.
Find an authoritative IP range list
Use the provider’s current infrastructure or IP-ranges documentation, not an address found in a forum post or a DNS lookup performed once. Ranges can change when a provider moves cloud regions, replaces workers, or changes its renderer.
ScreenshotOne’s documentation, for example, identifies Google Cloud east-4 ranges, a Hetzner GPU renderer at 95.216.67.59 when that renderer applies, and a New York DigitalOcean range for customer firewall or proxy rules. Those values are specific to ScreenshotOne and its documented deployment; they are not universal screenshot-service addresses.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Record the provider, region, CIDR or host address, date reviewed, rule owner, and rollback method in change control. Subscribe to the provider’s change notices where available. Avoid treating a broad cloud-provider allocation as equivalent to a renderer’s published range.
Build a least-privilege allow rule
- Choose the exact destination. Put the rule on the origin firewall, WAF, gateway, or API perimeter that is returning the block.
- Add only documented sources. Enter the provider’s exact IP addresses or CIDR blocks. Do not allow an entire cloud provider unless the provider explicitly requires it.
- Limit the protocol and port. For a website capture, allow TCP 443 to the required hostname or virtual host. Do not open unrelated ports.
- Limit the resource. If your WAF supports host, path, or resource-pattern conditions, scope the exception to the pages the renderer must fetch. Cloudflare’s screenshot controls support an
allowRequestPattern-style restriction; its reject rules are evaluated first, so an earlier deny can still win. - Keep authentication. IP filtering supplements, rather than replaces, API keys, bearer tokens, signed URLs, origin authorization, and normal application access controls.
- Place the rule deliberately. Check rule order, IPv4 versus IPv6 coverage, geo or ASN conditions, rate limits, bot rules, and managed challenges. A correct CIDR can still be blocked by a higher-priority rule.
Example policy shape
A typical origin rule is: source equals the provider’s published renderer CIDRs; destination equals your capture hostname; protocol TCP; destination port 443; action allow; logging enabled. Keep the rest of the site’s protections unchanged. If you need to expose only a rendering endpoint, use a dedicated hostname or path rather than weakening rules for the whole application.
Authenticate the request as well as the source
Continue sending the provider’s API key or bearer token. An address can be shared, reassigned, or misconfigured, and an API key can be stolen; requiring both controls reduces the impact of either failure. Rotate keys, keep them out of browser code and public repositories, and use separate credentials for production and testing.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
For webhook endpoints, validate the provider’s signature and timestamp, reject replays, enforce an expected job or tenant, and restrict accepted methods and content types. A network allowlist alone does not prove that a callback is genuine.
Test the rule end to end
- Deploy the allowlist in monitor or report-only mode if your platform supports it.
- Start one real screenshot request and note its request ID, URL, and UTC timestamp.
- Inspect origin, WAF, load-balancer, and provider logs. Confirm the observed source IP belongs to the expected published range.
- Confirm the response reaches the renderer and that the page assets, API calls, and fonts are not separately blocked.
- Test a request from an unauthorized source to verify that the exception is narrow.
- Save the successful request ID and resulting policy change with your change record.
Some systems cache policy changes. OpenAI’s documented IP-allowlisting behavior, for example, reports a blocked request as HTTP 401 with ip_not_authorized and notes that changes can take up to 15 minutes to propagate. Apply the same operational caution to other providers: wait for propagation before declaring a rule ineffective, while checking logs immediately for syntax or ordering errors.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Diagnose the common failures
The site still returns 403, 401, or a WAF challenge
- Wrong direction: you allowed your application’s IP at the origin, but the origin sees the renderer’s IP. Add the renderer range at the destination being protected.
- Wrong range or region: the provider used a different documented worker pool. Compare the source in logs with the provider’s current list.
- Rule order: a reject, bot rule, country rule, or managed challenge runs before the allow exception. Move or narrow rules according to your platform’s evaluation order.
- IPv6 mismatch: the renderer used IPv6 while only IPv4 was allowed, or the reverse. Confirm the address family in logs.
- Propagation delay: wait the documented interval, then retry with a fresh request ID.
The API call is rejected before rendering
Inspect the API provider’s view of your caller IP. Your laptop, CI runner, NAT gateway, and production worker may all have different egress addresses. Pin production traffic to a known NAT address where possible, then allow that address at the provider. Check the API key, bearer header, hostname, TLS inspection, and outbound proxy separately.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
The screenshot is blank or incomplete
An allowlist can permit the initial document while blocking scripts, images, fonts, analytics dependencies, or internal API calls. Review browser and origin logs for every blocked subrequest. Permit only the required hosts and resource types. Also check authentication, cookie requirements, JavaScript challenges, lazy loading, and timeout settings.
A webhook never arrives
Verify that callbacks are enabled for your deployment; one screenshot API guide currently notes that webhook delivery may be unavailable in some deployments, with synchronous rendering as the fallback. Check DNS, TLS, inbound port 443, signature validation, response status, and provider delivery logs. Do not reuse a page-renderer allowlist as webhook authentication.
Security and operational guardrails
- Never use a screenshot service to bypass CAPTCHAs, bot detection, IP bans, or rate limits.
- Authorize only URLs and tenants your application is permitted to capture.
- Rate-limit capture endpoints and alert on sudden source-range or volume changes.
- Log source IP, provider, request ID, target host, decision, and rule version without logging secrets.
- Review ranges after provider infrastructure notices and on a scheduled basis.
- Keep a tested rollback that removes only the screenshot exception.
How to choose an implementation
When comparing providers or internal controls, check whether they publish updateable egress ranges, support CIDR plus host/path/resource restrictions, offer API-key or bearer authentication, document webhook verification and availability, provide regional routing, expose request IDs and useful logs, enforce clear rate limits, and announce infrastructure changes.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
| Control | What to verify | Why it matters |
|---|---|---|
| Renderer ranges | Current IP/CIDR list and update process | Prevents outages caused by stale entries |
| Scope | Port, host, path, and resource-pattern support | Limits exposure |
| Authentication | API keys or bearer tokens plus rotation | Stops address-only trust |
| Webhooks | Signatures, replay controls, delivery status, availability | Protects asynchronous callbacks |
| Observability | Request IDs, source logging, change notices | Shortens diagnosis time |
Or skip the browser setup
ScreenshotNeo is a website screenshot API and MCP server for developers. It accepts a URL and returns PNG, JPEG, WebP, or PDF; its pre-capture cleanup accepts cookie or consent banners and removes more than 60 known consent platforms, newsletter popups, and chat widgets. Bot checks, CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed, and response headers identify the page verdict and billing status. Its MCP tools—take_screenshot, get_page_info, and capture_pdf—let Claude, Cursor, or another MCP client capture pages.
Use the same network principles: allow your application’s egress to reach the API, keep the access key secret, and allow the renderer’s documented traffic only where your own origin requires it.
One request is enough:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the complete parameter reference and options in the ScreenshotNeo documentation. The service supports full-page captures with lazy images loaded, CSS-selector element capture, dark mode, 12 device presets plus custom viewports, retina scale, PDF paper and page controls, custom CSS and JavaScript, clicks, hidden selectors, waits, request and resource blocking, custom headers, cookies, user agents, Authorization, timezone, geolocation, transparent backgrounds, resizing, selectable cache TTLs, signed image links, asynchronous signed webhooks, bulk capture for up to 100 URLs per call, usage data, and an OpenAPI specification. Common screenshot-API parameter names are also accepted to ease migration.
Python:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' }); const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);Plans include 1,000 screenshots a month free with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesFAQ
Should I whitelist a hostname instead of an IP?
Use the provider’s documented IP or CIDR controls when the firewall supports them. DNS answers can change and are not automatically a trustworthy security boundary unless the provider explicitly guarantees that model.
Can an allowlist replace a CAPTCHA or bot policy?
No. It identifies an expected network source; it does not authorize a user, URL, tenant, or webhook payload. Keep application and abuse controls in place.
What should I do when a provider has no published ranges?
Ask for a supported, updateable egress mechanism or use a fixed intermediary you control. Do not guess ranges from unrelated cloud documentation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
