“We have monitoring” usually means something requests the home page periodically and alerts if it fails.
That is useful and only catches the crudest kind of failure. The common problems leave a site loading normally, looking correct, with one part quietly not working.
What they share is raising no error, so they only surface by being looked for. Five things worth watching, in order.
1. SSL certificate expiry
The only item here that takes the entire site down at a scheduled moment.
Free certificates typically last 90 days and depend on automatic renewal. But the renewal breaks: the service stops, a configuration change invalidates the script, the validation method changes, the scheduled task is removed.
Nothing announces it. At expiry, every visitor receives a red security warning instead of your website, and most of them close it immediately.
To monitor: free services email you 30 days before expiry. Five minutes, once. The highest-return monitoring available, without close competition.
2. Forms and contact routes
The most overlooked and the most directly costly.
A broken form shows “submitted successfully” while the email is never sent, or lands in a spam folder. You receive no enquiries and conclude nobody is asking.
Causes are many: a mail provider changing rules, an expired authentication record on the sending domain, a server IP added to a blocklist, a plugin update losing its configuration. None of them stop the site loading.
To monitor: the simplest reliable method is submitting a test yourself monthly and confirming it arrives. Put it in a calendar.
Better still, have the form also send to a second address such as a personal one. Nothing at either means the form broke; nothing at one means that mailbox has a problem.
3. Search indexing
Becoming invisible to search engines is a silent failure — the site is fine, and new pages are not indexed or existing ones drop out.
Usual causes: a change carrying a noindex tag, an edited robots file, a broken sitemap, or a page starting to return an error that nobody visits and therefore nobody notices.
To monitor: Google Search Console, free. It emails when it detects crawl problems, indexing drops or security issues. It is useful even unread, because it contacts you.
Worth checking occasionally: the not-indexed count in the Pages report. A sudden rise usually means something broke.
4. Speed over time
Not whether it is fast now, but whether it has become slower.
Sites slow gradually: more images uploaded, more plugins installed, a larger database. Each step costs a little, a year later it takes twice as long, and you adapted along the way without noticing.
To monitor: Search Console’s page experience report records real users’ loading times over time. More trustworthy than any testing tool, because it comes from actual visitors.
Simpler: measure your home page’s time to first byte once a quarter and write it down. One curl command, but it has to be recorded, or there is no trend to see.
5. Whether the content is still there
This sounds odd and it does happen.
The page exists and loads, and a section is empty — images missing, a case list blank, an embedded map failing, a dynamic block not loading.
Causes: images deleted by accident, an external service shutting down, an expired API key, a code change causing a module to fail silently.
To monitor: the practical approach is checking automatically after publishing that key pages contain what they should, rather than only that they return 200.
Our own deployment does this: after installing, request a set of key pages and confirm each returns 200; after generating static pages, confirm the files for key pages exist. A missing page raises no error and merely becomes quietly slow — that class of problem can hide for months.
Without automation, do it by hand: click through the main pages quarterly, particularly the ones you never visit yourself, such as an individual service page.
Not worth the investment
Second-by-second availability checks. For a business website, checking every minute and every ten seconds are equivalent — you are not getting up at three in the morning either way. Every five minutes is ample.
Elaborate dashboards. A dashboard nobody opens is the same as no dashboard. Monitoring that emails you is worth far more than monitoring you must go and look at.
Too many alerts. Three false alarms a week and within two months you ignore them, including the one that matters. An alert is worth exactly as much as your continued willingness to take it seriously.
A minimum viable setup
Starting from nothing, in this order, all free, under half an hour total:
1. Register and verify Google Search Console. It covers indexing, security and speed trends, and it contacts you.
2. Set a certificate expiry alert. The only defence against a morning where the whole site is a warning page.
3. Set basic availability monitoring. Every five minutes, email on failure. Free services are plentiful.
4. Put a monthly reminder in your calendar to submit a test through your own form. Thirty seconds, guarding against the most expensive failure of the lot.
Those four cover almost everything that causes real loss. The rest can wait until there is a reason.
If someone maintains your site
Three questions worth asking:
Does the certificate renew automatically, and is there an expiry alert?
When something breaks, do you find out first or do I? The answer reveals whether monitoring exists at all.
When did you last find and fix something I never heard about? An answer means somebody is genuinely watching.
On the projects we host, certificate expiry, availability and post-deployment content checks are automatic. Not paid extras — they guard against the category where a client loses something without knowing, and that loss still ends up attributed to us.