Website monitoring, with nothing installed: what you get
You add a domain and that is it. The site is checked from outside the network, like any visitor would, from a server unrelated to yours. It is the only host type included in the Free plan too.
- nothing installed
- 11 checks from outside
What you get
What you install
Nothing. You type the domain and, optionally, a text the page must contain.
What it sees inside
Nothing from the inside: no processes, no files, no logs. If the site runs on a server you also monitor here, the Traffic tab shows what that server sees.
What it sees from outside
Eleven checks: availability and response time, DNS, TLS certificate, scripts and defacement, headers, blocklists, SPF/DMARC/DKIM, exposed files, TLS quality, 16 ports and domain expiry.
What alerts you
A site down or slow, an A or NS change, a certificate close to expiry or changed, defacement, a listed IP, exposed .git or .env, a database open to the internet, a domain close to expiry or a changed registrar.
What it can fix
None: without an agent there is nothing to run on the server. You get what needs fixing, with the reason.
What it cannot see
Nothing from the inside: no processes, no files, no logs. In exchange it is the only angle that sees exactly what your customer sees.
What you see in the dashboard
The host page has the Overview, Availability, Traffic, Checks and Activity tabs: uptime by day, the result of every check and the history.
How it counts against your plan
One host from your plan. On Free, a single external site, with the HTTP probe running less often than on paid plans.
The full list, row by row
Each row says how often it looks, what it compares and what it does: alerts you, shows only on the host page, or is a remediation you approve.
availability
- HTTP code and response time (every 1 min) [alerts you]: Thresholds on response time, not just on the code: a site that answers in five seconds is down for the visitor, even when it returns 200. A failure is confirmed by a second probe 15 seconds later, before alerting. Optionally, the page must contain a text you choose: that also catches a suspended-account page or a defaced site, which still answer 200.
- DNS records, alerting on change (every 15 min) [alerts you]: A change of A or NS is a critical incident and points you at the registrar: that is what a domain hijack looks like before anyone notices. An MX-only change is a warning.
certificate and content
- TLS certificate, days left (every hour) [alerts you]: Issuer, full chain and name match, wildcards included. Warning at 21 days, critical at 7. A change of certificate authority is reported separately.
- Third-party scripts, cookies and defacement (every hour) [alerts you]: External origins the page loads, unprotected cookies and structural changes against the last read show on the host page; signs of defacement open a critical incident.
- Security headers (every hour) [on the host page]: What is missing and what is set too permissively (HSTS, X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy). It shows on the host page and in the score, with the exact list; it sends no alert.
posture
- Blocklists for your addresses (every 6 h) [alerts you]: Spamhaus ZEN, SpamCop and Barracuda, for up to four addresses of the domain. A listed IP is a critical incident.
- Exposed sensitive files: .git, .env, backups (every 12 h) [alerts you]: Paths checked directly, as from the internet, with a control against sites that return the home page for any missing path.
- Ports exposed to the internet (every 12 h) [alerts you]: We try 16 ports on the domain’s address. A database reachable from the internet is a critical incident; CDN ranges are skipped, because they are not yours.
- Domain registration expiry (every 12 h) [alerts you]: Through RDAP, with whois as a fallback. Warning at 30 days, critical at 7. For .ro the registry publishes no date, so we watch the domain status: on hold or expired is critical. A changed registrar is a critical incident too.
- SPF, DMARC, DKIM, CAA, DNSSEC (every 6 h) [on the host page]: Syntax, duplicates and over-permissive policies. Without DMARC, anyone can send mail in your domain’s name. It shows on the host page, without an alert; DNSSEC switched off on a signed zone and a new CAA issuer open an incident.
- TLS quality: protocols, ciphers, keys (every 12 h) [on the host page]: A real handshake per protocol version. TLS 1.0 and 1.1 still accepted are a warning on the host page, not a footnote.
on one real site: two SPF records where the standard allows exactly one, three unprotected cookies, and TLS 1.0 still accepted
How to start
- In the dashboard pick “Add a host”, type “External site”.
- Type the domain and, optionally, a text the page must contain: that also catches a suspended-account page or a defaced site, which still answer 200.
- The HTTP probe starts within the first minute. The rarer checks (every 6 or 12 hours) make their first run staggered, within their own interval.
Questions about this host type
Do I really install nothing?
Nothing. Everything is measured from outside, with ordinary requests: HTTP, DNS, a TLS handshake, one connection attempt per port. We send no attack payloads and try no passwords.
How often is it checked?
The HTTP probe every minute on paid plans and less often on Free; the other checks between 15 minutes and 12 hours, the same on every plan. A failure is confirmed by a second probe 15 seconds later, before alerting.
What do “alerts you” and “on the host page” mean?
“Alerts you” opens an incident and sends the alert to your channels. “On the host page” is hygiene (headers, SPF/DMARC, TLS quality): true and worth fixing, visible on the host page and in the score, but without waking you at night.
Can I monitor a site that is not mine?
The checks are the ones any visitor makes, but add only sites you run or have permission for. Vulnerability assessments, which send test payloads, require proof of ownership.