Website checks: availability, certificate, CMS

Website

The website checks run on every host name with a website monitor, i.e. at least on apex and www.

http Website: availability, status code, response time, redirect chain, page content and security headers; the result also records the negotiated HTTP version (1.1, 2 or 3) and whether Alt-Svc announces HTTP/3, as information only, without a finding. Connection errors, timeouts and 5xx are critical and open http_down after the failure duration; a status code other than the expected one is a warning (http_status); responses above the slow threshold (default 5 s) open http_slow after three runs; an HTTPS address redirecting to http:// immediately http_no_https. A missing required text or a forbidden one creates http_content. Header findings (HSTS, CSP, nosniff, framing, referrer and permissions policy, exposed server versions) are hints without an incident.
tls Certificate: handshake, chain, host name, validity, signature algorithm and protocol on port 443 or a mail port with STARTTLS. Expired is critical (tls_expired, immediately); under 14 days remaining a warning (tls_expiring), under 30 days a hint. Chain errors, wrong host name, self-signed and not yet valid open tls_invalid after two runs; unreachable tls_unreachable. SHA-1 and TLS 1.0/1.1 are warnings without an incident. A renewal is reported as an event, a new issuer as a warning.
redirects Redirects: http://, http://www., https:// and https://www. must end up at the same canonical HTTPS address. Unreachable variants, a missing redirect to https, an error status at the end and inconsistent targets open redirects_broken; long chains and temporary redirects (302/307) are hints. When the canonical address changes it is reported as a warning. A subdomain such as shop.customer.com has no www counterpart: only http:// and https:// of that host count, and the shared target may be on another host.
ipv6 IPv6: if the host name has AAAA records, every IPv6 address is requested over HTTP. No answer or 5xx opens ipv6_broken after the failure duration; missing AAAA records are a hint. Before every finding DomainWarn verifies its own IPv6 path against reference targets; without an IPv6 route the run ends as an error. The monitor only exists if the operator has enabled IPv6.
ct_log Certificate Transparency: all certificates of the last 30 days for the domain and its subdomains from the CT logs. A previously unknown issuer is a warning without an incident; every newly issued certificate an event. If it falls within 24 hours after a name server or MX change, it is reported as critical. Host names from certificates without a website monitor are collected as suggestions on the domain (up to 50 open) that you accept or dismiss with one click.
cms CMS version: detects the content management or shop system of the homepage (WordPress, TYPO3, Joomla, Drupal, Shopware, Contao, Craft, Ghost …) and its version – from the DomainWarn plugin (WordPress, Shopware; authoritative as long as it reported within the last week), the generator meta tag, the page assets or, for WordPress, the feed. Checked daily against the project releases and the support periods from endoflife.date: an update within the same version line (security and maintenance release) and a support end within the next 120 days are warnings and open cms_outdated, a version without security updates is critical; a newer major version while the own line is still maintained is a hint (for WordPress, which publishes no end of support, a warning after 180 days). Version jumps and system changes appear in the timeline; a hidden version is a hint pointing to the plugin.
privacy Privacy: which third parties does the homepage load on page view, before any consent? Fonts from Google servers (Google Fonts) and active tracking scripts (Analytics, Tag Manager, Meta Pixel, Hotjar …) without consent blocking open privacy_issue; embeds (YouTube, maps), consent managers, CDNs and other third-party hosts are listed as hints. The delivered HTML is checked without running scripts; added or removed services appear in the timeline. Your own hosts (an agency CDN) can be excluded via own_hosts.
pagespeed PageSpeed: weekly measurement of the homepage via PageSpeed Insights (mobile): Lighthouse performance 0–100 with LCP, CLS and blocking time, plus – where Google sees enough real users – the Core Web Vitals from the Chrome UX Report (LCP, INP, CLS) that count for ranking. Below 50 points or with poor field data pagespeed_poor opens; a change of tier (good, needs improvement, poor) appears in the timeline.
security_txt security.txt: is there an RFC 9116 file at https://<domain>/.well-known/security.txt (or at the legacy location /security.txt)? A missing file is a hint. If a file exists it has to be valid: a missing Contact or Expires, an unreadable Expires or a file served over HTTP opens security_txt_invalid; an expired file security_txt_expired, expiry within 30 days security_txt_expiring – unless the server sets Expires anew on every request (such as “now plus 30 days”), in which case the file never expires. Wrong content type, legacy location, unreadable lines and a different Canonical are hints; an OpenPGP signature is detected but not verified. A published or removed file, a new security contact and the renewal of an expiring file appear in the timeline. Daily.
ports Open services: do well-known database, remote access or plain-text ports on the website and mail server addresses accept connections from the internet? Checked by a TCP connection attempt against a fixed list – no port scan, no data, no banner: databases and caches (1433, 1521, 3306, 5432, 6379, 9200, 11211, 27017) and remote access or file sharing (23, 3389, 5900, 445, 2375) are critical, FTP (21) and POP3/IMAP without TLS (110/143, mail servers only) a warning, SSH and common alternative ports (22, 8080, 8443, 8000, 9000) a notice. Expected services (such as SSH on your own server) can be marked as “expected” and no longer count. Nothing is checked behind a CDN, private addresses are skipped; at most five mail servers and eight addresses per run, 20 seconds time budget. A newly opened or closed port appears in the timeline. Daily; the operator enables the check deliberately, from the Freelancer plan.
takeover Subdomain takeover: does a DNS record of the domain point nowhere, so that someone else could take over the subdomain? Checked are the domain, every host with a website monitor, the host names from the CT logs and common prefixes (www, staging, dev, test, app, blog, shop, mail, cdn, api, status, docs, old, beta, demo), at most 60 per run. A CNAME to a target that no longer exists (confirmed by a second resolver) opens takeover (critical) – a deleted Azure web app or Elastic Beanstalk environment, for example. For well-known services (GitHub Pages, Heroku, Amazon S3, Shopify, Netlify, Vercel, Fastly, Zendesk, HubSpot, Unbounce, Ghost, Pantheon, Tumblr, WordPress.com and more) the response of the service shows whether the name is unclaimed there – that is critical as well. So is a subdomain delegated to its own name servers whose servers refuse the zone or no longer exist. An orphaned CNAME nobody can claim (target under your own domain) is a warning, as is a host name from the CT logs whose address belongs to a cloud provider and answers neither on port 80 nor on 443. The fix: delete the record or reclaim the service. DomainWarn only detects and never creates anything anywhere. Daily, from the Freelancer plan.
lookalike Look-alike domains: which spellings of the domain has someone registered – kunde-shop.de, kuncle.de (cl instead of d), dornain.de (rn instead of m), kunde.shop, kunde-login.de, künde.de? DomainWarn generates up to 250 variants (homoglyphs, other TLDs, typos, hyphens, common suffixes, accents as IDN) and checks them daily via DNS: a website or mail server means active, name servers only means parked. The first run is the baseline – whatever exists then is stock and raises no warning. A variant registered later with a website or MX is a warning (lookalike.registered) and appears as the change lookalike.new_domain in the timeline; parked and vanished variants are hints. Your own monitored domains and variants marked as “ours” are never reported. No WHOIS queries, no third-party databases – only what is in the DNS. From Freelancer, for the registrable domain only.
crawl Website check: reads robots.txt and the sitemap (from robots.txt or /sitemap.xml, a sitemap index up to three child sitemaps deep), fetches up to 50 sitemap URLs and up to 100 internal links of the homepage via GET and checks status, redirect, noindex (meta or X-Robots-Tag) and canonical per URL. A robots.txt blocking everything with “Disallow: /” opens crawl_robots_blocked (critical); broken URLs (4xx, 5xx, no answer) are warnings and open crawl_broken from five on. noindex on a sitemap URL and a canonical pointing elsewhere are warnings; a missing sitemap, a redirect in the sitemap and a missing canonical are hints. Every HTML page (up to 50) is also examined for mixed content and Subresource Integrity, without any further request: scripts, stylesheets, frames, objects or form targets over http:// on an https page open crawl_mixed_content (critical, browsers block them), images and media over http:// (including srcset) are a warning; protocol-relative addresses (//…) do not count. External scripts and stylesheets without an integrity attribute, or with integrity but without crossorigin, are hints – the hash is not recomputed, files from your own origin need no SRI. Each finding names the count and up to 20 examples with their page. Every newly broken URL appears as a change in the timeline, the recovery of all as an all-clear; the table of checked URLs lives on the domain page under Website. Daily, not in the Free plan.

See also: Website monitoring · SSL monitoring