A website that worked perfectly on launch day can quietly degrade. A plugin update adds two seconds to load time, someone edits DNS and deletes the DKIM record, a certificate renewal fails, or a developer pushes a noindex tag to production. Uptime checks won't catch any of these, because the site is still "up." This guide explains what to monitor after launch, how often, and which kind of tool is right for each job.
Key takeaways
- Uptime checks alone are not enough, because slow pages, missing DNS records and stray noindex tags happen while the site is still up.
- Use an uptime service every 1-5 minutes, plus daily or weekly scheduled audits for certificates, DNS, email records and SEO tags.
- Alert 14 days and again 7 days before certificate expiry, as Let's Encrypt stopped sending expiration reminder emails in June 2025.
- Review DMARC aggregate reports weekly, as they are the only place you will see a sender failing authentication or spoofing your domain.
Two kinds of monitoring
It helps to separate monitoring into two categories, because they need different tools:
| Availability monitoring | Configuration and health monitoring | |
|---|---|---|
| Question | Is the site responding right now? | Is the site still set up correctly? |
| Frequency | Every 1-5 minutes | Daily or weekly |
| Catches | Server down, 500 errors, timeouts | Slow pages, expiring certificates, missing DNS/email records, SEO mistakes, security regressions |
| Tool type | Uptime monitoring service | Scheduled website audits, Search Console, DMARC reports |
Most small businesses set up the first and forget the second, yet configuration problems are the ones that go unnoticed for weeks.
1. Availability (uptime)
You need a dedicated uptime monitor that requests your site every minute or few minutes from several locations and alerts you by email, SMS or chat when it fails. Many services offer a free tier for a handful of checks.
What to set up:
- The homepage, plus one or two critical pages (checkout, booking, login).
- A keyword check, not just a status code. A page that returns
200 OKwith "Error establishing a database connection" is down for your customers. - Alerts to more than one person, with a sensible confirmation delay so one failed check from one location doesn't wake anyone up.
- A public or private status page if customers depend on your service.
MakeItFlow doesn't do uptime pings; use a dedicated uptime service for this layer, alongside the scheduled audits described below.
2. Performance regressions
Performance rarely collapses overnight. It erodes: a new tracking script, an unoptimized hero image, a theme update that loads three more fonts. Watch two things:
Lab scores over time
Run the same Lighthouse-based test on your key templates on a schedule and track the trend. A single score varies from run to run, so look for sustained drops, not one bad result. When the score falls, compare the report with the last good one to find what changed.
Real-user Core Web Vitals
Field data from the Chrome User Experience Report is what Google uses, and it's what PageSpeed Insights and Search Console show. The targets, per web.dev, are LCP 2.5 seconds or less, INP 200 ms or less and CLS 0.1 or less, at the 75th percentile.
Two things to keep in mind:
- Field data lags. PageSpeed Insights reports the previous 28 days, so a regression you ship today takes weeks to show fully, and so does a fix. Lab tests catch problems faster.
- Search Console groups similar URLs and can email you when it detects new issues. When you fix an issue, its "validate fix" process runs a 28-day monitoring period.
For fixes, see improve Largest Contentful Paint and fix Interaction to Next Paint.
3. TLS certificates
Certificate monitoring is getting more important, not less:
- Under CA/Browser Forum ballot SC-081, the maximum lifetime of public TLS certificates fell to 200 days on March 15, 2026, and is scheduled to drop to 100 days in March 2027 and 47 days in March 2029.
- Let's Encrypt says it will cut its maximum certificate lifetime to 45 days by February 2028.
- Let's Encrypt stopped sending expiration reminder emails on June 4, 2025, so if you relied on those emails as your safety net, it's gone.
Shorter lifetimes mean more renewals, and each renewal is a chance for something to fail: a changed DNS record breaking validation, a CAA record that no longer allows the CA, a firewall blocking the challenge, a server that renewed the certificate but never reloaded.
What to monitor:
- Days until expiry for every hostname, including
www, subdomains and mail servers. Alert at 14 days and again at 7. - Hostname coverage: the certificate actually includes the name being served.
- Chain validity: intermediates served correctly.
# Quick manual check of expiry and names
echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null \
| openssl x509 -noout -enddate -subject -ext subjectAltName
See SSL certificate lifetime changes and SSL certificate errors for detail.
4. DNS and email records
DNS and email records change more often than people expect: a new marketing tool needs a TXT record, IT migrates DNS providers, someone "cleans up" records they don't recognize. The damage is silent. Mail fails authentication and drifts into spam, and nobody gets an error.
Monitor for changes to:
- A/AAAA and CNAME for your site: unexpected changes may mean a hijack or a mistake.
- NS records: who controls your DNS.
- MX records: where your mail goes.
- SPF: still one record, still within the 10 DNS lookup limit from RFC 7208, still includes all your senders. See SPF too many DNS lookups.
- DKIM selectors for each sending service.
- DMARC: still present, policy as intended.
- CAA and DNSSEC: a missing DS update or an overly strict CAA record will break things at the worst moment.
Also read your DMARC aggregate reports. They're the only place you'll see a sender failing authentication, or someone spoofing your domain. Our guide to reading DMARC reports explains how.
Don't forget domain registration itself. Turn on auto-renew at your registrar, keep the payment card current and make sure the registrar's notification emails go to an address someone reads.
5. SEO signals
SEO problems from deployments are common and expensive:
- Indexing blocks: a
noindextag orX-Robots-Tagheader, orDisallow: /inrobots.txt, pushed from staging. - Title and meta description changes: a template bug that gives every page the same title.
- Canonical tags pointing to the wrong URL, or to staging.
- Sitemap missing, empty, or listing redirected and 404 URLs.
- Broken internal links after content changes or URL restructuring. See broken links and redirect chains.
Search Console is essential here: its Pages report shows indexing changes and it emails you about significant new issues. But it reports after Google has crawled the damage. A scheduled audit catches a stray noindex the next day, often before Google has acted on it.
6. Security configuration
- Security headers still present after server or CDN changes (they're often lost in migrations).
- Exposed files such as
.env,.git/and backups, which can appear after a careless deploy. - Software versions on your CMS and plugins, through your CMS's update notifications.
Malware scanning and file integrity monitoring are separate jobs; use a dedicated security service or your host's tools for those. See signs your website was hacked.
A practical monitoring schedule
| What | Tool type | Frequency |
|---|---|---|
| Uptime and key pages | Uptime monitoring service | Every 1-5 minutes |
| Certificates, DNS, email records, SEO tags, headers, lab performance | Scheduled website audit | Daily for business-critical sites, weekly otherwise |
| Core Web Vitals (field) and indexing | Search Console | Email alerts, plus a monthly review |
| Email authentication results | DMARC aggregate reports | Weekly review |
| Domain renewal | Registrar auto-renew | Check payment details yearly |
On MakeItFlow, paid plans can re-scan your site daily or weekly and email you the results, covering performance, SEO, DNS, email authentication, security headers, certificates and exposed files in one report, with history to compare against. Run a free audit first to get your baseline, then see pricing for scheduled monitoring.
Frequently asked questions
Isn't uptime monitoring enough?
No. Uptime monitoring tells you whether the server responds. Most damaging problems, like a missing DKIM record, a noindex tag, slow pages or an expiring certificate, happen while the site is technically up. You need both kinds of monitoring.
How early should I be alerted about certificate expiry?
Fourteen days gives you time to diagnose a failed automatic renewal without panic, with a second alert at seven days. As lifetimes shrink toward 47 days, rely on automated renewal and treat alerts as a sign that automation has failed.
How often should I check Core Web Vitals?
Let Search Console email you about changes and review it monthly. Field data covers a rolling 28-day window, so checking daily won't show much. Use scheduled lab tests to catch regressions sooner.
What should I do when a monitoring alert fires?
First confirm it from a second source, such as a manual check or another location. Then look at what changed recently: deployments, plugin updates, DNS edits or provider changes. Comparing the current audit with the last good one usually points straight to the cause.
What to do next
Set up an uptime monitor for your homepage and one critical page today. Then run a full audit to record your baseline, turn on scheduled re-scans, confirm auto-renew at your registrar, and make sure DMARC reports go to a mailbox someone actually reads. For the launch side of things, see the website launch checklist.
Related reading
- Automated Website Reports by Email: How to Set Them Up: How to get automated website reports by email: scheduled audits, Search Console summaries and uptime alerts, what each should contain and how often to send.
Sources
More guides for your industry
Free checklist (PDF)
Free logistics & haulage website checklist
29 practical checks for logistics & haulage: website speed and mobile, Google Business Profile and reviews, email security, booking and enquiry handling, and AI search visibility. Each one says why it matters, and many link to a free tool that checks it.
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 27 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
