Insight
Website uptime and certificate monitoring: catching outages, expiring certificates and broken checkouts first
Many companies learn their website is down from a customer. Basic monitoring is cheap, but checking only whether the homepage loads misses the failures that cost the most: broken checkouts and forms, expired certificates and domains, and DNS changes. With certificate lifetimes shortening, automation and monitoring matter more every year.
Why homepage checks are not enough
A simple uptime monitor requests the homepage every minute or so and alerts if it does not respond. It is useful, but many serious failures leave the homepage working: a payment integration breaks, a form stops sending leads to the CRM, a login fails after an update, or a cached homepage hides an application error behind it.
Effective monitoring checks the things the business depends on, from several locations, and sends alerts to people who can act at any time the site matters to customers.
What to monitor
A practical monitoring setup for a business website or web application covers several layers, from infrastructure to business transactions.
- Availability
- Key pages and API endpoints from multiple regions, with content checks so an error page returning a success status is detected.
- Transactions
- Synthetic scripts that complete critical journeys such as search, add to basket, checkout with a test payment, login and form submission.
- Certificates
- TLS certificate expiry dates and chain validity for every domain and subdomain in use.
- Domains
- Domain registration expiry and changes to nameservers or registrar locks.
- DNS
- Resolution of important records, including MX and email authentication records, and unexpected changes.
- Integrations
- Background jobs, webhooks and data syncs, with alerts on failures and missing activity.
- Performance
- Response times and real user monitoring to catch slowdowns before they become outages.
Certificates are getting shorter
Browsers only trust TLS certificates within a maximum validity period set through the CA/Browser Forum, the industry body of certificate authorities and browser makers. In 2025 the Forum approved a phased reduction of maximum certificate lifetimes: to 200 days from 15 March 2026, to 100 days from 15 March 2027, and to 47 days from 15 March 2029.
The direction is clear: certificates will need to be renewed several times a year, and manual renewal by calendar reminder will not scale. Certificates should be issued and renewed automatically, for example using the ACME protocol supported by many certificate authorities and hosting platforms.
Automation fails too, for instance when DNS changes break validation or a server stops accepting renewed certificates. Monitoring certificate expiry independently of the renewal system catches those failures while there is still time to fix them.
Alerting that works
Alerts are only useful if they reach someone who can act. Define who is responsible for which systems, during which hours, and how alerts escalate if not acknowledged. Route critical alerts to channels people notice, such as phone notifications, rather than a shared inbox.
Avoid alert fatigue. Require failures from more than one monitoring location before alerting, set thresholds that reflect real impact, and separate warnings, such as a certificate expiring in 20 days, from incidents such as checkout failing now.
Keep monitoring independent of the infrastructure it watches. A monitoring service hosted on the same server as the website will go down with it.
Status communication
For customer portals, SaaS products and services customers depend on, a status page explains incidents without flooding support. It should be hosted separately from the main service, updated by people during incidents rather than only automatically, and offer subscriptions to updates.
After an incident, a short review of what happened, how it was detected, how long recovery took and what will change improves the system and customer trust. Monitoring data provides the timeline.
Getting started
List the pages, journeys, domains, certificates and integrations the business depends on. Choose a monitoring service that checks from multiple locations and supports transaction scripts. Start with availability, certificates and domains, then add synthetic transactions for revenue-critical journeys and alerts for integration failures. Review alerts after the first weeks and tune them so every alert means action.
Questions
Is a homepage uptime check enough?
No. Checkouts, forms, logins and integrations can fail while the homepage still loads.
What are synthetic transactions?
Automated scripts that regularly complete key user journeys, such as checkout or login, to detect failures.
How long can TLS certificates be valid?
Under the CA/Browser Forum schedule, maximum validity falls to 200 days from 15 March 2026, 100 days from 15 March 2027 and 47 days from 15 March 2029.
Should certificate renewal be automated?
Yes. With shorter lifetimes, automated issuance and renewal, for example using ACME, is essential, alongside independent expiry monitoring.
Why monitor from multiple locations?
To confirm outages are real rather than local network issues, and to detect regional problems.
Should monitoring run on our own server?
No. Monitoring should be independent of the infrastructure it checks.
Do we need a status page?
For services customers rely on, a separately hosted status page reduces support load and builds trust during incidents.
Where this sits in what we do
This article covers one decision inside a wider engagement. The solution page sets out how that engagement runs, what it includes and what it costs to find out.
- Custom Business Platform — A platform built around how your business actually runs — customer portal, internal tooling, database and the automation between them.
- Quote to cash without re-keying: where the handoffs break
- Product data is the e-commerce growth lever nobody budgets for
- WhatsApp Business Platform pricing per message: how the July 2025 change affects customer service and marketing
- WhatsApp customer care: consent, records and the handover nobody designs
- All insight articles
Finding out about outages from customers?
We set up monitoring for journeys, certificates, domains and integrations, automate certificate renewal and route alerts to people who can act.
Get in touch