Most people start with one question: "is my website up?" That is the right first check, but a site can be "up" and still be broken, expired, slow or infected. Here is a practical set of checks, and how often to run them.
1. Availability
The basic check requests a page and confirms that it answers. Two details make it far more useful:
- Check the content, not only the status. A page can return a "200 OK" while showing an error message or a blank template. Checking that an expected word appears on the page catches this.
- Confirm a failure before alerting. One failed request can be a network blip. Checking again a few seconds later, and alerting only if it fails twice, removes most false alarms.
For a business website, every minute is a good interval. For a personal site, every five minutes is usually enough.
2. Response time
A site that answers in eight seconds is effectively down for many visitors. Track response time and look at the trend, because a slowly growing average often warns you about a database or hosting problem days before it becomes an outage.
3. Your most important pages, not just the homepage
The homepage is often cached and keeps working while the login, the checkout or the contact form fails. Add checks for the pages that make you money or that customers depend on.
4. SSL certificate
An expired certificate shows visitors a warning page. Check the expiry date, and that the certificate matches the hostname and the chain is complete. Daily is plenty, with warnings starting a few weeks before expiry.
5. Domain registration
If the domain expires, everything goes: site, email and sometimes the name itself. Monitor the expiry date and the registry status. This check is cheap and rarely needed, but the one time it saves you, it saves everything.
6. Security
Hacks are quiet at first. Useful checks look for:
- Listings on known malware and phishing lists.
- Injected content: unknown scripts, hidden links, spam keywords.
- Cloaking, where visitors and search engines see different pages.
- For WordPress: outdated core, themes and plugins, known vulnerable plugins and exposed files.
Running these daily is a good start. Sites that handle sensitive data may want them more often.
7. Alerts that reach you
A check that nobody sees is useless. Send alerts to at least two channels, for example email plus Telegram or Slack. Use quiet hours so you can sleep, but let critical problems through, and make sure alerts do not flood you during a long outage.
A sensible starting setup
| Check | How often |
|---|---|
| Homepage availability with a keyword | every 1 to 5 minutes |
| Login or checkout page | every 5 minutes |
| SSL certificate | daily |
| Domain expiry | daily |
| Malware and content scan | daily |
ServerMonitor sets up most of these for you when you add a site: uptime, SSL, domain, blocklists and content integrity, plus WordPress checks when WordPress is detected. You choose where the alerts go, and the free plan covers three sites.