The fastest website in the world is useless down — and most outages are discovered by customers first. Classic case: TLS certificate expires Sunday 3 AM, browser shows a red warning, you find out via WhatsApp on Monday. All preventable with basic free monitoring configured in twenty minutes.
The three levels of watchman
1. Uptime monitoring (does it respond?): an external service hits your URL every X minutes from multiple regions. After N consecutive failures, it alerts (email, Telegram, Slack). The minimum non-negotiable safety net.
Solid free services: UptimeRobot (50 monitors, 5-min intervals), Better Stack free tier, StatusCake. Configuration keys:
- Monitor the RIGHT URL: not the homepage if what's critical is API or checkout.
- 1-5 min interval: every 30 min means up to half an hour of outage unnoticed.
- Multiple regions: a single checkpoint generates false positives (its network hiccups, you get alarmed). Confirm failures from 2-3 locations.
- Sensible threshold: alarm after 2-3 consecutive failures; one lost probe isn't an outage.
2. Health checks (does it work?): responding 200 doesn't mean healthy. Your own /health can verify connected database, working cache, available disk:
// /api/health — verify real dependencies
const checks = await Promise.allSettled([
db.query("SELECT 1"),
redis.ping(),
statFs("/")
]);
const ok = checks.every(c => c.status === "fulfilled");
return Response.json({ status: ok ? "ok" : "degraded" }, { status: ok ? 200 : 503 });
Point the external monitor here and catch the "alive but broken" web — the worst possible state: looks fine while losing data or functionality. This same endpoint feeds your deploys' readiness probes.
3. Scheduled watchers (do YOU remember?): certificates and domains expire on known dates — yet remain top outage causes. Let's Encrypt renews automatically IF the cron works; domains renew if the card is valid and the whois email gets read. Independent alerts:
- SSL expiry at 30/14/7 days (UptimeRobot includes it; dedicated services too).
- Domain expiry with months of margin — and verify the registrant email is one you read.
To check current certificate state without waiting for alerts, our SSL checker shows validity, issuer and chain instantly.
What to watch besides the homepage
Minimum URL checklist for a real site:
- Homepage (general representativeness).
- Critical business endpoint (checkout, main API).
- Composite
/health(dependencies). - One cached static asset (detects CDN/config breakage).
And if you run your own server: disk space and memory are the classic slow deaths — growing silently for days until everything dies at once. A cron with threshold + Telegram webhook costs ten lines.
The alert someone actually reads
Monitoring without designing notification is half the job:
- Channel you actually watch: for most, Telegram/Discord/Slack beat email (which buries alarms among newsletters).
- Escalation: first failure → normal notification; 10 minutes down → more insistent repeat. Basic anti-fatigue.
- Conscious night silence: decide WHAT deserves waking you. Full outage: yes. 20% latency degradation: tomorrow.
And the piece almost nobody has: public status page (Better Stack and similar include it free). During incidents, turns dozens of "are you down?" emails into one link. Visible professionalism at zero cost.
Test the whole path
An untested monitor is theory like an unrestored backup. Monthly ten-minute drill: deliberately kill your app (stop the service), confirm alert arrives within expected time, restart, confirm recovery notice. If the flow fails, better to learn in testing than on the real day.
FAQ
How often should it check? 1-5 minutes for serious production. 60-second intervals multiply network false positives unless multi-region; below that you're doing involuntary stress testing.
Can the monitor pollute my analytics? Yes: each check is a visit. Exclude monitor's user-agent or IP from analytics or inflate metrics forever.
Self-monitoring from the same server? Useless as sole watchman: when the server dies, it dies with it. External uptime monitoring's whole value is being outside.
Check your domain's TLS state now with our SSL Checker, free and no sign-up.