Q —

Check Why a Website Is Down

Homepage (uptime)

This check hits the homepage itself, from outside your own infrastructure, on a schedule. A failure here means the server didn't respond at all — the most literal version of "down," and usually a host, server, or DNS problem underneath it.

TLS certificate expiry

This checks whether the site's TLS certificate is valid and not close to expiring. A failure means the certificate has lapsed or is about to — browsers block or warn on expired certificates outright, so this can make an otherwise healthy site look completely down to visitors.

DNS resolution

This confirms the domain still resolves to the right address. A failure here points to a broken or hijacked DNS record — the site's server can be perfectly healthy and still be unreachable if DNS is pointing nowhere or somewhere wrong.

HTTP→HTTPS redirect

This confirms plain-http requests get redirected to the secure version of the site. A failure here doesn't always mean the site is down, but it means some visitors — or bots and crawlers requesting the plain-http URL — never reach the secure page they should.

Domain registration expiry

This checks how close the domain itself is to lapsing. A failure here is a warning, not yet an outage — but an expired domain takes the whole site and its email dark, often for days, until it's restored.

SPF

This checks whether the domain has a Sender Policy Framework record authorizing which servers can send mail on its behalf. A failure here doesn't affect the site loading — it means outbound mail from the domain is more likely to land in spam.

DMARC

This checks whether the domain publishes a policy for handling mail that fails authentication. A failure here means the domain has less protection against being spoofed — someone else sending mail that looks like it's from you.

HSTS

This checks whether the site tells browsers to always use HTTPS, even before the first redirect happens. A failure here means there's a brief window where a request could be downgraded to plain-http instead of going straight to the secure version.

MX records

This checks whether the domain has valid mail-routing records. A failure here means inbound mail to the domain can't be delivered — the site can be fully up while the domain is effectively unreachable by email.

CAA records

This checks whether the domain restricts which certificate authorities are allowed to issue certificates for it. A failure here doesn't mean the site is down, but it means there's no guardrail against an unauthorized certificate authority issuing a certificate for the domain without anyone noticing.

Security headers

The scan looks for the core browser-protection headers: a Content-Security-Policy, X-Content-Type-Options, frame protection, Referrer-Policy and Permissions-Policy. Missing headers don't take a site down, but they leave visitors more exposed to injected scripts and clickjacking — and they're the kind of thing that silently disappears in a server migration.

Exposed config and source files

The scan requests files that should never be public — .env, .git and similar config or source paths — and verifies they return 404. A failure here is urgent: an exposed .env can leak database credentials and API keys even while the site looks perfectly healthy.