Overview
Site Watch Lite monitors your website's health with 12 automated checks. Each check runs on a schedule to catch issues before they impact your users.
How It Works
- ✅ Checks run automatically on schedule
- 📧 Get email alerts when issues are detected
- 📊 View detailed reports in your dashboard
- 🔧 Follow fix guides to resolve issues
SSL Certificate
What It Checks
Monitors your SSL/TLS certificate expiration, validity, and configuration. Ensures your site has HTTPS enabled and the certificate is trusted.
Why It Matters
Expired or invalid SSL certificates cause browser warnings, hurt SEO rankings, and can lose customer trust. Google Chrome shows "Not Secure" warnings for sites without valid HTTPS.
What We Monitor
- Expiration Date: Days until certificate expires
- Validity: Certificate is properly signed and trusted
- Configuration: Strong cipher suites and protocols
Alert Triggers
You'll receive an alert when your certificate expires in 14 days or less.
How to Fix Issues
- Renew through your hosting provider or certificate authority
- Use Let's Encrypt for free automated certificates
- Set up auto-renewal to prevent future expirations
- Update DNS records if moving to a new certificate
Domain & WHOIS
What It Checks
Monitors domain registration details including expiration date, registrar, name servers, and contact information.
Why It Matters
Expired domains mean your website goes offline completely. Domain theft or unauthorized transfers can happen if you're not monitoring your registration.
What We Monitor
- Expiration: Days until domain expires
- Registrar: Who manages your domain
- Name Servers: DNS configuration
- Status: Transfer lock and DNSSEC
Alert Triggers
You'll receive an alert when your domain expires in 30 days or less.
How to Fix Issues
- Log into your domain registrar account
- Enable auto-renewal to prevent expiration
- Update payment information if needed
- Enable transfer lock to prevent unauthorized transfers
- Consider enabling DNSSEC for additional security
DNS Records
What It Checks
Monitors all DNS records for your domain including A, AAAA, MX, CNAME, TXT, NS, CAA, and SOA records. Tracks changes to detect unauthorized modifications.
Why It Matters
DNS changes can break your website, email, or other services. Unauthorized DNS changes are a common attack vector for domain hijacking and traffic redirection.
Record Types We Monitor
- A & AAAA: Your website's IP addresses
- MX: Email server configuration
- TXT: SPF, DKIM, DMARC, and verification records
- NS: Name server delegation
- CAA: Certificate authority authorization
Alert Triggers
You'll receive an alert when any DNS records change (A, MX, or NS records).
Understanding Changes
DNS changes can be intentional (server migration, CDN setup) or malicious (hijacking attempt). Always verify changes with your team.
Pro Tip: Enable 2FA on your DNS provider account and use a reputable provider with change notifications.
Security Headers
What It Checks
Analyzes HTTP security headers that protect against common web attacks like XSS, clickjacking, MIME sniffing, and data injection.
Why It Matters
Missing security headers leave your site vulnerable to attacks. Modern browsers use these headers to enable built-in security protections.
Headers We Check
- Strict-Transport-Security (HSTS):Forces HTTPS connections to prevent downgrade attacks
- X-Frame-Options:Prevents clickjacking by controlling iframe embedding
- X-Content-Type-Options:Prevents MIME sniffing attacks
- Referrer-Policy:Controls how much referrer information is shared
- Permissions-Policy:Controls browser features like camera, microphone, geolocation
Understanding Grades
Alert Triggers
You'll receive an alert when your security grade is D or F.
How to Fix Issues
Add headers to your web server configuration:
# Nginx add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; # Apache Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" Header always set X-Frame-Options "SAMEORIGIN" Header always set X-Content-Type-Options "nosniff" Header always set Referrer-Policy "strict-origin-when-cross-origin"
Content Security Policy (CSP)
What It Checks
Analyzes your Content Security Policy configuration, which controls what resources (scripts, styles, images) can load on your site and from where.
Why It Matters
CSP is your primary defense against XSS (Cross-Site Scripting) attacks. Even if an attacker injects malicious code, a strong CSP prevents it from executing.
What We Analyze
- Policy Presence: Header, report-only, or meta tag
- Unsafe Keywords: 'unsafe-inline', 'unsafe-eval'
- Directive Coverage: script-src, style-src, img-src, etc.
- Modern Features: Nonces, hashes, strict-dynamic
- Protection Directives: object-src, base-uri, frame-ancestors
Alert Triggers
You'll receive an alert when your CSP grade is D or F.
Common Issues & Fixes
❌ Using 'unsafe-inline'
Allows inline scripts - defeats CSP's main purpose
Fix: Use nonces or hashes for inline scripts
❌ Using 'unsafe-eval'
Allows eval() - major XSS risk
Fix: Refactor code to avoid eval() and Function()
⚠️ Missing object-src 'none'
Flash and plugins can be exploited
Fix: Add object-src 'none' to your policy
Mixed Content
What It Checks
Scans your HTTPS site for resources (scripts, images, CSS) loaded over insecure HTTP connections.
Why It Matters
Modern browsers block or warn about mixed content. Active mixed content (scripts, iframes) is blocked entirely. Passive mixed content (images) shows warnings. This breaks functionality and erodes trust.
Severity Levels
Active Content
Scripts, stylesheets, iframes, fonts - browsers block these
Forms
Form submissions to HTTP endpoints
Passive Content
Images, audio, video - shows warnings but loads
Alert Triggers
You'll receive an alert when active mixed content (high severity) is detected.
How to Fix Issues
- Update all resource URLs from http:// to https://
- Use protocol-relative URLs (//example.com/script.js) if the resource supports both
- Use Content-Security-Policy: upgrade-insecure-requests to auto-upgrade
- Test thoroughly after changes
Performance
What It Checks
Runs Google PageSpeed Insights on mobile and desktop to measure performance, accessibility, best practices, and SEO scores.
Why It Matters
Page speed affects user experience, conversion rates, and Google rankings. Studies show 1 second delay = 7% reduction in conversions. Google uses Core Web Vitals as ranking signals.
Metrics We Track
- First Contentful Paint (FCP): When first content appears
- Largest Contentful Paint (LCP): Main content loads (Core Web Vital)
- Cumulative Layout Shift (CLS): Visual stability (Core Web Vital)
- Total Blocking Time (TBT): Page interactivity delay
- Speed Index: How quickly content is visually displayed
Understanding Scores
Alert Triggers
You'll receive an alert when your performance score drops below 50.
Common Improvements
- Optimize and compress images (use WebP)
- Minify CSS and JavaScript
- Enable compression (gzip/brotli)
- Implement browser caching
- Use a CDN for static assets
- Lazy load images and videos
- Eliminate render-blocking resources
Broken Links
What It Checks
Crawls your website to find broken links, missing images, dead CSS/JavaScript files, and excessive redirects.
Why It Matters
Broken links frustrate users, hurt SEO rankings, and look unprofessional. Google considers broken links a sign of poor site maintenance. Users may leave if they encounter too many 404 errors.
What We Find
- 404 Errors: Pages that don't exist
- 500 Errors: Server errors
- Redirects: Excessive redirect chains
- Timeouts: Resources that take too long to load
- Mixed Content: HTTP resources on HTTPS pages
Alert Triggers
You'll receive an alert when more than 5 broken links are detected or any mixed content is found.
How to Fix Issues
- Review the broken links report in your dashboard
- Update links to correct URLs or remove them
- Set up 301 redirects for moved pages
- Create a custom 404 page with helpful navigation
- Use relative URLs for internal links when possible
- Regularly audit external links (they change often)
Accessibility
What It Checks
Scans your website for accessibility issues using axe-core following WCAG 2.1 Level AA guidelines. Tests multiple pages from your sitemap.
Why It Matters
15% of the world's population has some form of disability. An inaccessible site excludes millions of potential users. Many countries have legal requirements (ADA, Section 508, EAA). Better accessibility also improves SEO and overall usability.
What We Test
- Color Contrast: Text is readable for low vision users
- Keyboard Navigation: All functionality works without a mouse
- Screen Reader Support: Proper ARIA labels and semantic HTML
- Form Labels: All form fields have proper labels
- Image Alt Text: All images have descriptive alternatives
- Heading Structure: Proper heading hierarchy (H1-H6)
Issue Severity
Must fix immediately
Serious barriers - users cannot access content
High priority
Significant difficulties for some users
Should be fixed
Minor barriers to access
Nice to fix
Best practice improvements
Alert Triggers
You'll receive an alert when your score is below 70 or when critical issues are detected.
Page Limits by Plan
Uptime Monitoring
What It Checks
Pings your website every hour to verify it's online and responding. Measures response time and tracks downtime incidents.
Why It Matters
Website downtime means lost revenue, frustrated users, and damage to your brand. The faster you know about problems, the faster you can fix them. Studies show 88% of online consumers are less likely to return after a bad experience.
What We Monitor
- Site Status: Up or down
- Response Time: How fast your site responds
- HTTP Status: 200 OK, 404, 500, etc.
- Downtime Duration: How long outages last
- Uptime Percentage: Reliability over time
Alert Triggers
You'll receive an immediate alert when your site goes down.
You'll receive a recovery alert when your site comes back online with downtime duration.
Understanding Uptime Percentages
Common Downtime Causes
- Server overload or crashes
- DNS configuration issues
- SSL certificate problems
- DDoS attacks
- Hosting provider outages
- Code deployment errors
- Database connection failures
Frequently Asked Questions
How often do checks run?
Most checks run weekly on Mondays at scheduled times (UTC). Uptime monitoring runs every hour. You can see each check's schedule at the bottom of its section.
Can I trigger checks manually?
Yes! Go to your dashboard and click the refresh icon next to any check to run it immediately.
How do I disable specific checks?
Each check has an "Auto-check enabled" toggle. Turn it off to pause that specific check. Your data remains saved - just turn it back on when ready.
What alerts will I receive?
You'll get email alerts for critical issues:
- SSL certificate expiring (14 days warning)
- Domain expiring (30 days warning)
- Site goes down (immediate)
- DNS records change
- Security grade drops to D or F
- 5+ broken links detected
- Performance score below 50
Can I monitor multiple websites?
Yes! Your plan determines how many websites you can monitor:
How far back does history go?
We store all check history indefinitely. You can view trends, compare results, and track improvements over time.
Are checks accurate?
We use industry-standard tools (Google PageSpeed Insights, axe-core accessibility engine) and best practices. However, always verify critical issues before making changes.
What if I get a false positive?
Run the check again manually. If the issue persists but you believe it's incorrect, contact support with the specific check details. We continuously improve our detection algorithms.
Can I export check results?
Currently, you can view and screenshot reports in your dashboard. Export functionality (PDF, CSV) is coming soon.
Do checks affect my website performance?
Checks are read-only and designed to have minimal impact. We use rate limiting and respectful crawling. Uptime checks are simple HEAD requests. Performance tests are run by Google's servers, not ours.
What if my site requires authentication?
Currently, we only monitor publicly accessible pages. Support for authenticated pages is planned for a future release.
How do I fix issues I don't understand?
Each check includes explanations and fix guides in your dashboard. You can also refer to this documentation or contact support for help with specific issues.
Still have questions? Contact Support
Last updated: 10/31/2025