Website Monitoring That Tells You Before Your Client Does

The first time a customer tells you your site was down, you have already been down for as long as it took them to care enough to type it. That is the whole argument for website monitoring, and it is a much smaller and more practical argument than the phrase usually gets. It does not need a dashboard anyone logs into. It needs a check that runs when nobody is watching, and an alert that reaches the right person before the wrong person notices.

We built that into Enterramon, and it is worth writing down properly, because the difference between monitoring one site and monitoring a hundred is smaller than most people expect and the difference between doing it and not doing it is enormous.

Three ways to find out your site is down

There are only three, and they are not equally expensive.

The cheapest is that something tells you, unprompted, within a few minutes. The middling one is that you happen to look, which means the length of your outage is a function of your curiosity. The expensive one is that a customer, a client or a search engine finds out first, and the length of your outage becomes a function of how long it takes a stranger to complain.

Most single-site owners live in the middle category without realising it. You check the site when you are working on it or when someone mentions it, and the rest of the time you assume. That assumption holds right up until it does not, and the failure modes that hit small sites are not exotic. A certificate that lapsed because the renewal notice went to an old mailbox. A domain registration that expired because it was paid on a card that had since been replaced. A plugin update that broke one page, not the home page, so the site looked perfectly fine from the outside while a checkout page returned a 500.

None of those are downtime in the obvious sense. All three cost money quietly. That is why the check has to run on a clock rather than on your attention.

What a five minute website monitoring check is really doing

Every paid Enterramon plan checks each site every five minutes. That is 288 checks a day per domain, and it is the number that matters, because a daily check tells you a site was down at some point in the last twenty four hours and a five minute check tells you it is down now.

Four things raise an alert. The site stops answering. A page starts returning an HTTP error, which catches the broken checkout case rather than just the dead server case. A certificate moves close to its expiry. A domain registration does the same. Alerts go out by email and by SMS, with separate switches for alerts, SSL, domain and reports, so the person who needs to know about a lapsed certificate is not necessarily the person woken up at two in the morning by an outage. A recovery notice follows, which matters more than it sounds. Without one, every outage ends with somebody logging in to check.

SMS credits are included on every paid plan, ten a month on Lite, fifty on Pro, two hundred and fifty on Business and a thousand on Agency, with spare zero-cost credits spent before the monthly top-up so a quiet month does not waste the allowance. SMS is reserved for critical notifications on purpose.

The same engine that watches uptime is also testing the site properly. A real browser, from one of five regions, Cape Town, Frankfurt, Singapore, St Louis or Sydney, on a connection profile you choose from six, ranging from native speed down to 4G LTE. The region is set per site, which matters if your traffic is mostly local and you keep wondering why a test from the other side of the world looks worse than your visitors’ experience.

curl -sI https://example.com | grep -i -E 'strict-transport-security|cache-control|content-encoding'

Run that against your own site and you get three answers in one line. Whether the browser is being told to insist on HTTPS, whether it is allowed to keep a copy, and whether the text was compressed on the way out. They are the sort of headers a monitor records on every run and a site owner almost never looks at, and the aggregate figures later in this piece show how many sites are missing them.

The score is the least useful part of the report

Every run produces an Overall figure with Performance, Security, SEO and Caching underneath it, and Accessibility measured alongside. The dial is the part people screenshot and the part that changes least. What changes your site is the list underneath it.

There are thirty six deterministic findings in the engine, fifteen on performance, seven on security and fourteen on SEO. Each one arrives with a severity, a scope that says desktop or mobile, a sentence explaining why it matters and a fix written for a real stack. That last part is the difference between a report and a lecture. “Reduce your JavaScript” is not a fix. “Bundle, tree shake and code split so only what the page needs is shipped, and add defer or async to anything not required for first render” is a fix, and it is the kind of thing you can hand to a developer or do yourself.

Two things about the scoring are worth being precise about, because we would rather explain them than let a number imply something it does not.

The score is additive. Every check adds its credit or does not. Nothing is taken away for a missing header, so a high score does not mean a site has no work left, it means the work that is left was not counted against it. Read the recommendations, not the dial.

Accessibility is measured and displayed, and kept out of the Overall figure. A 41 there is a count of what the scanner could catch automatically, not a verdict on the page. Treating it as a compliance statement would be a claim we cannot support, since automated testing finds a class of problems and not all of them.

One honest run, on our own site

We run the same engine against enterramon.com on a schedule, because a monitoring product that does not monitor itself is not worth much. A recent run from Cape Town on a 50 Mbps profile came back with an Overall of 97 and Performance, Security and SEO each at 100, with Accessibility at 41 and not weighted.

Underneath the dial, desktop load time was 2,116 milliseconds and time to first byte was 202.3 milliseconds. Largest contentful paint was 488 milliseconds, cumulative layout shift 0.011, and total blocking time 34 milliseconds on desktop and 65 on mobile. The cache hit ratio was 94.7.

The line that changed how we think about our own build was not any of those. The page carried 16 JavaScript files at 1,126,674 bytes, 6 stylesheets at 154,403 bytes and 13 images at 624,135 bytes, and then ten third-party requests accounted for 1,025,828 bytes, about a third of everything the page transferred, and not one of those bytes came from our own infrastructure. In the waterfall the two slowest entries were third-party scripts at 988 and 856 milliseconds. We would not have found that by loading the page in a browser and looking at it, and it is the same discovery most site owners make the first time they sit down with a waterfall instead of a score. If that pattern sounds familiar, the JavaScript file count and oversized asset write ups go through what to do about it.

We also produce an SEO section on every run, and ours is a decent example of how unglamorous the useful findings are. Word count 4,224, roughly a nineteen minute read. Four images, two with alt text, none missing an alt attribute and two with empty alt attributes, which is the correct treatment for images that carry no meaning. Fifty six links, forty five of them internal. One H1, nine H2s, twenty one H3s. An Organization schema block present. None of that is exciting, and all of it is the difference between a site a crawler can outline and a site it has to guess at.

If you want the guided version of that section, reading an Enterramon report walks through every panel and what it is measuring.

Judging your own numbers against a moving backdrop

A score on its own is close to meaningless. Fifty eight for SEO looks bad until you learn that it is the SEO average, which is the midpoint of the scale. That is why we publish the aggregate of everything the platform tests on the global analytics page, updated daily, as a backdrop for judging your own numbers.

At the last update the dataset held 2,895 tests across 39 countries, from 734 unique domains. Average Performance came out at 82, SEO at 58, Security at 64 and Accessibility at 68, for an Overall of 74.

Read those together and the shape of the ordinary web appears. Encryption is essentially solved at 96 percent. The enforcement layer on top of it is not, at 37 percent, which means a certificate is doing its job and nothing is instructing the browser to insist on it. Two thirds of sites answer on IPv4 only. Barely one site in six sends GZIP, with a third serving Brotli. Fewer than half tell a browser it may keep a copy of anything.

Speed splits the same way. Average desktop time to first byte across the dataset was 516 milliseconds, which Google counts as good, and the slowest tenth of tests ran past a full second, which it does not. Largest contentful paint averaged 2.08 seconds on desktop and 1.88 on mobile, and the slowest tenth of tests came in at 3.97 and 3.74 seconds. Layout shift is the one the web handles well, averaging 0.074 on desktop and 0.039 on mobile. The thresholds themselves are Google’s, documented on web.dev, and the caveat is that this dataset is an aggregate of what got tested rather than a census, so it tells you what is unremarkable rather than what is right for your site.

Two live KB pieces are worth reading against those figures, the HSTS explanation if the 37 percent is your site too, and the certificate expiry guide if you have never checked when yours runs out.

The single site that has to stay open

Start where most people start, which is a single site that matters. A shop, a practice, a booking system, a site that takes money or bookings and therefore cannot be quietly closed for an afternoon.

Two domains checked every five minutes costs $4.95 a month, which is the cheapest honest answer to the only two questions a single-site owner has. Is it up. Is it quietly getting worse. The second question is the one a monitor answers that a manual check never will, because performance does not fall off a cliff, it slides, and a slow slide is invisible from the front end until a customer mentions it.

Lite covers two domains at $4.95 a month and Pro covers five at $9.95. Both check every five minutes, both carry all four alert types, and both produce the full compiled report with the recommendations. If one of your two domains is a staging copy or a second brand, Lite is the entire answer and there is no reason to buy more.

The point where four properties outgrow your memory

The next step is not really about monitoring, it is about not being able to hold every property in your head at once. A shop, a blog, a landing page for a campaign, a booking system on a subdomain’s parent domain. Four or five things that all need to be up and are not equally important.

Pro starts at five domains and grows in blocks of five, ten or fifteen, so it reaches twenty without a tier change. Each site has its own monitoring region and its own report, which is what lets you say the campaign landing page is the slow one rather than averaging the problem across everything and learning nothing.

Twenty five client sites, where the job changes character

Somewhere between ten and twenty five sites you stop being the owner of the sites and start being answerable for them. A freelancer or a small studio with a client roster has a different problem from a business with five of its own properties. You are not the one who gets hurt by an outage. You are the one who gets the phone call about it.

Business earns its keep here, and the features that matter are about delivery. White-label PDF reports, so the document arriving in your client’s inbox carries your mark rather than ours. Editable email templates on three tabs covering the header and footer, the report content and the notifications, down to the company name, by-line, contact phone, website and disclaimer. A logo in a light and a dark variant, so it reads whether the mail client paints a white card or a dark one. Your own SMTP server, so the reports leave from your domain and land in your client’s inbox as mail they recognise.

Then the quiet one that saves the most awkward conversations. Per-domain recipients, so each client is told about their own site and never sees a list of your other clients. Twenty five sites with one shared recipient list is a confidentiality problem waiting to happen, and it is the sort of thing you only notice once.

Business carries twenty five domains at $54.95 a month, grows to sixty five, holds twelve months of report history against ninety days on Pro, and adds scheduled reports per client so the monthly update goes out whether or not anyone remembered to assemble it.

A hundred domains and the end of being last to know

Past a certain size the question stops being whether you can check a site and becomes whether you can be the last to know about a hundred of them at the same time. That is a different problem, and the question becomes a portfolio one.

Agency starts at a hundred domains at $99.95 a month with no ceiling, and capacity is added in the same blocks of five, ten or fifteen. Five more sites is $4.95 a month, ten is $9.90 and fifteen is $14.85. Domains are verified by TXT record, by tag or by file, and added, removed and re-verified as the watchlist moves rather than as a support ticket allows. The portfolio view rolls uptime, average score and certificate coverage onto one screen, which is the part that makes a Monday morning survivable. Business and Agency both carry 5 percent off domain registrations and renewals, which on a roster that size is not a rounding error.

Now put the aggregate figures back beside that. If only a third of sites serve Brotli and two thirds are not enforcing HTTPS, then across a hundred domains you are looking at dozens of sites carrying the same cheap, fixable problem. That is the argument for monitoring at scale. Not that you will find one dramatic failure, but that you will find the same boring one thirty times and fix it once.

What it does not do, stated plainly

A report cannot be shared by a public link. It is tied to the account that owns the site, and there is no anonymous viewer. The client-facing route is a scheduled report sent to their email address, branded on Business and Agency. If a share link is what you need, this product does not do it and we would rather say so here than have you find out after buying.

There is no daily emailed report. The daily part is the check, and every check leaves a report you can open or download on the day. The emails themselves come in two cadences, an overview each week and the full edition each month.

Recommendations are on the report in the dashboard on every paid plan, and deliberately left out of the printed PDF, because a run can produce forty or fifty of them and a printed document is the wrong place for that list. The dashboard is the right place for it, and the PDF is an artefact you hand to somebody.

An upgrade can be requested at any time and costs only the pro-rated difference for what remains of your cycle, applied once that invoice is paid. A downgrade always lands at the end of the cycle you have already paid for, never in the middle of it. Both of those are choices we made rather than defaults we tuned.

And the thing a monitor cannot do is fix anything. It can tell you a checkout page is returning a 500 at ten past two in the morning, and it can tell you which file made your page heavy. What happens next is a person with a login.

You can find out what your own site looks like in thirty to forty seconds using the free test on enterramon.com, with no account and no catch. If what you want is to stop finding out from somebody else, the plans and the pricing are here, and the five minute check is the same on all of them.