Website monitoring checklist for agencies

This checklist is for agencies and freelancers who look after several client websites. It works with any monitoring tool – or as a basis for discussing the topic with clients and your team. Ideally, go through it once per client and record the results in the maintenance contract or your client documentation.

1. Inventory

• A list of all websites you look after, with client, contact person and type of contract (maintenance, hosting, build only).
• For each website: where is the domain registered, where is it hosted, who manages DNS?
• Which subdomains exist (www, shop, booking, …) and are they all still in use?
• Who gets notified today when a website goes down – and does that still hold at night and during holidays?

2. Which pages to monitor

The homepage alone is not enough. For each website, pick the pages the client’s business depends on.

• Homepage – as the basic availability check.
• The one page customers use to get in touch: contact form, appointment booking, quote request, call-back form.
• The page that brings revenue: shop category, product page, price list, menu.
• For each of these pages, note an expected text that only appears when the page works, such as the button label “Request an appointment”. The text must be in the HTML, not added later by JavaScript.
• Leave out pages behind a login or password protection – they can’t be checked meaningfully from outside.

3. Domains, DNS and certificates

• Monitor the TLS certificate of every subdomain in use, not just the main domain.
• An expiry warning at least two weeks in advance.
• Track the expiry of the domain itself in a calendar or at the registrar (website monitoring usually doesn’t check this).
• Note who is allowed to change DNS – clients sometimes change records themselves, for example when switching email providers.

Background: monitoring TLS certificates.

4. Interval and alert rules

• Interval: for small and mid-sized business websites, a few minutes is a good compromise. A one-minute interval produces more messages but rarely a faster response if nobody can react immediately.
• Confirmation: only report an outage after at least two failed checks. A single timeout is often a network hiccup, not an outage.
• One message per incident: not a repeat every few minutes, but one message when it starts and one when it is resolved.
• Recipients: an inbox or distribution list that is reliably read during business hours. Avoid individual employees’ personal inboxes.

5. Handling an incident

• Who looks at an alert first, and within what time?
• Quick cross-check: is the page really broken in a browser (ideally also on mobile data, outside the office network)?
• Rough triage: hosting, DNS, certificate, latest update.
• When is the client informed, and by whom? A template helps – see detecting outages and informing clients.
• After the fix: briefly record cause and duration.

6. After updates and changes

• After plugin, theme or core updates, keep an eye on the monitored pages; an error often only shows on the next check.
• On a relaunch, move or new URLs, update the monitored addresses and expected texts – otherwise you’ll get false alarms.
• Test forms that send emails regularly with a real test submission. Availability monitoring can’t do that.

7. Agree with the client

• What does the maintenance contract include: monitoring, response time, fixing?
• During which hours do you respond (e.g. weekdays 9–5)?
• Which problems are outside your responsibility, e.g. at the host or third-party services?
• How and how often do you report on incidents?

Short version to print

1. Monitor the homepage plus the contact and revenue page of every website.
2. Set an expected text for each page.
3. Check the certificates of all subdomains, with a warning two weeks ahead.
4. Alert only after a confirmed failure, one message per incident.
5. Clear responsibilities and a template for informing clients.
6. Adjust monitoring after updates and relaunches.
7. Test forms regularly with a real submission.

D3bris covers points 1 to 4: up to three pages per website with expected text, a TLS warning 14 days ahead and one confirmed email per incident. Points 5 to 7 remain part of your agency’s process.