Uptime monitoring that knows whose site it is

Every site is checked every five minutes, on both the www and the non-www address. One failed request is not an incident. It takes two consecutive failures before Kockpit escalates, and even then it sends a real browser to look at the page the way a visitor would before anyone is woken.

That last step matters more than it sounds. A firewall that blocks a bot is not an outage, and an agency that cries wolf to a client loses the exact credibility the monitoring was supposed to buy. When Kockpit does declare an incident, it captures a screenshot of what the visitor actually saw, so the message to the client starts with evidence instead of an apology.

Certificate expiry is read from the certificate itself, and domain expiry and registrar come from the registry. Not from a cached lookup, and not from whatever the hosting panel claims.

The point is the calendar. A domain lapsing in six weeks is a routine email to the client. The same domain lapsing on a Sunday night is an emergency, a furious phone call, and sometimes a ransom to a drop-catcher. Kockpit turns the second story into the first, for every domain on the list, including the ones a client registered themselves and forgot to tell you about renewing.

Nameservers, MX records, SPF, DMARC policy and DKIM selectors, recorded nightly for every site. When something changes, the change shows up in the daily digest with the old value beside the new one.

This is the check that solves the mystery tickets. A client's mail quietly stops landing, and the answer is almost always here: a nameserver moved during a hosting migration, an SPF record was flattened by a new marketing tool, a DMARC policy got stricter than the sending setup could satisfy. Instead of an afternoon of spelunking, the answer is already in the record.

Kockpit probes each site for the things that should never be public: environment files, version control directories, database dumps, backup archives and stack traces left in debug mode. Every finding is confirmed before it is reported, so a clever 404 page does not become a false alarm.

These are the mistakes that happen on hosting you did not pick, during deploys you did not run. They are invisible from the browser and catastrophic in a breach report. A nightly check costs nothing; finding out from a client's lawyer costs rather more.

Kockpit detects what each site runs and flags the ones falling behind, a WordPress left several releases back being the classic case. Across a portfolio, this becomes a work queue: the sites that need attention this month, sorted by how far behind they are.

The dangerous site is never the busy one. It is the brochure site nobody has touched in a year, still faithfully serving pages, still on the plugin version with the known exploit. Monitoring exists precisely for the sites nobody is looking at.

Some checks only matter at a moment: security headers before a client's audit, broken links after a content migration, real page-load metrics when someone says the site feels slow, and a pre-launch checklist before anything goes live. These run per site, when you ask, and land as a report your developer can paste straight into a ticket.

The pre-launch list covers the things everyone means to check and someone always forgets: the HTTPS redirect, the favicon, a real 404 page, placeholder copy, the copyright year, a reachable contact route, form protection.