---
title: WatchFor blog — all articles
description: Every WatchFor article: monitoring guides, engineering write-ups, comparisons and free-tool how-tos.
canonical: https://watchfor.io/blog/all
---


# WatchFor blog — all articles

229 articles, newest first. Each is also available as markdown at its URL + `.md`. RSS: https://watchfor.io/blog/rss.xml

- 2026-09-10 · Engineering — [Your CDN didn't go down. It stopped caching — and nothing told you.](https://watchfor.io/blog/why-your-cdn-stopped-caching) — Every other outage announces itself. A CDN that stops caching does the opposite: the site stays up, every status code stays 200, and your uptime dashboard stays green while every single request travels to your origin. Here's why that happens, why one request from one machine can never detect it, and what we built to catch it — including the claims we refused to make.
- 2026-08-28 · Engineering — [What it actually took to make a monitoring platform agent-ready](https://watchfor.io/blog/what-it-took-to-make-monitoring-agent-ready) — AI agents are becoming real API consumers, and scanners now grade how usable your product is for them. We spent a week taking WatchFor from a mediocre agent-readiness score to 100/100 — two MCP servers, OAuth 2.1, signed probes, a no-auth sandbox, and a pile of lessons about what agents (and their scanners) actually check. Here's all of it, including what didn't work.
- 2026-08-06 · Engineering — [Scheduling 25 million checks with one Go binary — and no next_run_at column](https://watchfor.io/blog/scheduling-25-million-checks-one-go-binary) — Most schedulers store the next run time in a database and fight write amplification forever. Ours stores no per-run scheduling state at all: every job's schedule is a pure function, recomputable anywhere. Here's the design — a 256-shard time wheel, an append-only change log — and the honest numbers from load-testing it to 25 million active jobs.
- 2026-09-07 · Monitoring — [Built for humans and AI agents: now your assistant can investigate, not just read](https://watchfor.io/blog/monitoring-for-humans-and-ai-agents) — An AI model can reason about your website all day. It still has no machine in Singapore — we do. WatchFor now lets an AI agent run live diagnostics (DNS, TLS, headers, ping, Core Web Vitals) from 20 locations in 7 regions, over the REST API, MCP and A2A.
- 2026-09-01 · Security — [Why we built our own SSL/TLS grade checker](https://watchfor.io/blog/ssl-grade-checker) — For over a decade, one free tool defined what a 'good' HTTPS setup looks like: the Qualys SSL Labs Server Test and its A+ to F grade. It's brilliant — and showing its age. Here's the short history of the SSL grade, what SSL Labs gets right, where it falls short in 2026, and why we built a faster, more modern grader of our own — including the post-quantum check SSL Labs doesn't have yet.
- 2026-10-22 · Security — [Free PHP Version and Software Exposure Checkers](https://watchfor.io/blog/free-php-version-checker-and-software-exposure-checker) — Two new free tools: check the PHP version of any website against php2shell (CVE-2026-109618, CVE-2026-109619), end of life and known CVEs, and see every software version a site reveals, graded A+ to F with the fix.
- 2026-10-22 · Guides — [php2shell (CVE-2026-109618): how to check if your site is vulnerable](https://watchfor.io/blog/php2shell-check-if-your-site-is-vulnerable) — php2shell is a critical remote code execution bug in PHP itself, fixed on Oct 21, 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Here's how to check which PHP version your site really runs, from outside and on the server, why Debian, Ubuntu and Red Hat builds need a second look, and how to patch without missing the restart.
- 2026-10-22 · Guides — [What your server headers reveal: exposed versions, old software and CVEs](https://watchfor.io/blog/what-your-server-headers-reveal) — Every response your site sends can name the web server, PHP, the CMS and the JavaScript libraries behind it, down to the patch release. Here is what attackers read from headers and HTML, how to check your own site, how to hide versions on nginx, Apache, IIS, PHP and WordPress, and why patching matters more than hiding.
- 2026-10-20 · Monitoring — [From new monitor to post-mortem: one incident, worked with the WatchFor agent](https://watchfor.io/blog/ai-agent-incident-start-to-finish) — One real incident, worked with the agent beside the dashboard: it creates the monitor, explains the failure, re-checks it live and drafts the post-mortem.
- 2026-10-20 · Engineering — [Forty monitors fail at once. Slack gets one message.](https://watchfor.io/blog/alert-grouping-last-mile) — Alert grouping, escaping and retries: what happens after an outage is confirmed, the bug that held a page back for minutes, and the trade-offs we kept.
- 2026-10-20 · Engineering — [Signed, then verified: how WatchForBot became a Cloudflare verified bot](https://watchfor.io/blog/cloudflare-verified-bot-web-bot-auth) — Our signed probes got 403 from sites behind Cloudflare that were up. How Web Bot Auth and Cloudflare's verified bot list fixed it in seven minutes.
- 2026-10-20 · Email — [Email deliverability monitoring: every check was green and the mail still wasn't arriving](https://watchfor.io/blog/email-deliverability-monitoring) — SMTP up, mailbox fine, SPF published, and the password resets landed in spam all weekend. Email deliverability monitoring sends real mail to find out.
- 2026-10-20 · Monitoring — [How uptime is calculated, and why one failed check doesn't count](https://watchfor.io/blog/how-uptime-is-calculated) — Uptime that drops for every failed check measures your monitor, not your site. WatchFor counts only confirmed incidents, and keeps that history forever.
- 2026-10-20 · Security — [How to monitor a login page without leaking the password](https://watchfor.io/blog/monitor-login-page-without-leaking-credentials) — A monitor behind a login needs a password or token. Where it lives, who can read it back and what shows up in results decides whether it leaks.
- 2026-10-20 · Engineering — [Before you run our server agent as root: rebuilt, signed, checked](https://watchfor.io/blog/server-agent-signed-reproducible-releases) — Our open-source server monitoring agent installs with one sudo command. Here is how each release is rebuilt byte for byte, signed, and checked on your server.
- 2026-10-20 · Monitoring — [When your provider is down, say so: third-party status on your status page](https://watchfor.io/blog/third-party-status-on-your-status-page) — Checkout breaks because a provider is down, and your status page stays green. Show third-party status next to yours, without taking the blame for it.
- 2026-10-20 · Reliability — [Uptime alerts on Telegram, ntfy, Slack and your phone: send them where someone looks](https://watchfor.io/blog/uptime-alerts-telegram-ntfy-slack) — The alert fired at 2 a.m. into an inbox nobody reads. How to route uptime alerts to Telegram, ntfy, Slack or phone push so the right person sees them.
- 2026-10-20 · Security — [Website defacement monitoring: would you notice before your customers do?](https://watchfor.io/blog/website-defacement-monitoring) — Your uptime check said 200 OK all weekend while the page served spam links. How website defacement works today, and how to catch it within minutes.
- 2026-10-20 · Reliability — [The post-mortem nobody writes: drafting it from the incident timeline](https://watchfor.io/blog/write-the-postmortem-from-the-timeline) — A post-mortem written a week later is half memory. Draft it from the incident timeline while the facts are fresh, then add the why and the fixes yourself.
- 2026-10-19 · Monitoring — [The uptime monitoring app you install from the browser](https://watchfor.io/blog/uptime-monitoring-app-pwa) — An uptime monitoring app with no app store: install WatchFor from the browser on iPhone or Android, get incident push and act on alerts from anywhere.
- 2026-10-19 · Networking — [3 a.m., no browser, one curl: WatchFor in your terminal](https://watchfor.io/blog/watchfor-in-your-terminal) — Ping, DNS, TLS grades, CDN cache checks and a full website audit from your terminal: curl https://watchfor.io. When to reach for it, and why there's coffee.
- 2026-10-05 · Email — [How to test email delivery end to end (and keep testing it)](https://watchfor.io/blog/how-to-test-email-delivery) — Your mail server is up, the SMTP login works, SPF, DKIM and DMARC are in place, and the password-reset email still doesn't arrive. The only test that proves delivery is sending a real message and finding it in the mailbox. Here's how an email round-trip test works, what it measures (delivery time, Inbox or Spam, every relay hop), what a real result looks like and how to read it.
- 2026-10-05 · Email — [IMAP and POP3 monitoring: how to know when a mailbox stops working](https://watchfor.io/blog/imap-pop3-monitoring) — A mailbox can stop working while the mail server looks perfectly healthy: the password was rotated, the certificate expired on port 993, or the form that should email you every day quietly stopped. IMAP and POP3 monitoring logs in the way a mail client does and tells you which one it is. Here's what to check, what the results look like and how to test it yourself with openssl.
- 2026-10-05 · Email — [SMTP monitoring: is your mail server still accepting and sending mail?](https://watchfor.io/blog/smtp-monitoring-explained) — Your shop's order confirmations, password resets and invoices all leave through one SMTP login. When that login breaks, nothing errors on your website: the emails just don't go out. SMTP monitoring checks both halves of a mail server, the inbound side on port 25 and the sending login on 587 or 465. Here's what each one tells you, which port is which, and how to test it with openssl.
- 2026-10-04 · Guides — [Why can't my server reach the gateway? How to calculate a subnet with the Subnet Calculator](https://watchfor.io/blog/how-to-calculate-a-subnet) — A freshly configured server reaches some machines on its LAN but not the gateway or the printer down the hall. Very often the subnet mask is wrong. To calculate a subnet, apply the mask to the address: you get the network address, the broadcast address and the range of hosts that are on-link. Here's how to do it in one step with the free Subnet Calculator, how to read every field, and a Python one-liner that gives the same answer.
- 2026-10-04 · Guides — [Can we still ship this week? Check with the Error Budget Calculator](https://watchfor.io/blog/how-to-calculate-an-error-budget) — Two incidents have used 31 minutes of downtime twelve days into the month, and a risky migration is planned for Friday. With a 99.9% SLO over 30 days the error budget is 43 minutes 12 seconds; 72% is gone and the burn rate is 1.79×, so at this pace it runs out on day 17. Here's how to calculate an error budget and burn rate with the free Error Budget Calculator, and what to decide from the numbers.
- 2026-10-04 · Guides — [Can we restore 500 GB in an hour? Do the maths with the Bandwidth Calculator](https://watchfor.io/blog/how-to-calculate-bandwidth) — Your recovery plan says the database is back within an hour, and the backup is 500 GB in offsite storage. Over a 1 Gbps link that takes 1 hour 14 minutes, so the plan fails before anything else goes wrong. Here's how to calculate bandwidth and transfer time with the free Bandwidth Calculator, why Mbps and MB/s differ by eight, and how to measure your real throughput from the command line.
- 2026-10-04 · Guides — ["Permissions 0644 are too open"? Fix it with the Chmod Calculator](https://watchfor.io/blog/how-to-calculate-chmod-permissions) — SSH refuses your key with "UNPROTECTED PRIVATE KEY FILE! Permissions 0644 are too open". The fix is chmod 600: read and write for you, nothing for anyone else. Here's how to work out any chmod value with the free Chmod Calculator, what each digit means, which modes SSH accepts, and the commands to check and fix permissions.
- 2026-10-04 · Guides — [Which IPs does this allowlist cover? How to calculate CIDR ranges with the CIDR Calculator](https://watchfor.io/blog/how-to-calculate-cidr-ranges) — A vendor tells you to allowlist 140.82.112.0/20, and your firewall wants a start and end address, a netmask or a list of /24s. To calculate a CIDR range, keep the first N bits of the address and vary the rest: a /20 is 4,096 addresses from 140.82.112.0 to 140.82.127.255. Here's how to get the range, masks and splits in one step with the free CIDR Calculator, and a Python one-liner that checks it.
- 2026-10-04 · Guides — [Did the vendor breach its SLA? Check the downtime with the SLA Calculator](https://watchfor.io/blog/how-to-calculate-sla-downtime) — A provider was down for 52 minutes last month and its SLA promises 99.95% monthly availability. Did it breach? Calculate the SLA downtime allowance (21 minutes 36 seconds in a 30-day month), compare it with the outage, and work out the availability you actually got. Here's how with the free SLA Calculator, how service credits usually work, and the formula to check it yourself.
- 2026-10-04 · Guides — [How much downtime is 99.9% uptime? Calculate it with the Uptime Calculator](https://watchfor.io/blog/how-to-calculate-uptime-and-downtime) — Before you promise customers 99.9% uptime, turn it into minutes: 99.9% allows 43 minutes 12 seconds of downtime in a 30-day month and 8 hours 45 minutes 36 seconds a year. Here's how to calculate uptime and downtime with the free Uptime Calculator, what a target costs in lost revenue, how much each extra nine buys, and the one-line formula to check it yourself.
- 2026-10-04 · Guides — [Custom domain not connecting? How to check a CNAME record with the CNAME Lookup](https://watchfor.io/blog/how-to-check-a-cname-record) — Your CDN, Shopify, Zendesk or status page says the custom domain isn't configured, even though you added the CNAME. To check a CNAME record, look up the hostname and confirm it aliases to the exact target the vendor gave you. Here's how to do it with the free CNAME Lookup, a real CDN example, what the result can and can't show, and the dig commands that reveal every hop of the chain.
- 2026-10-04 · Guides — [DKIM failing? How to check a DKIM record with the DKIM Checker](https://watchfor.io/blog/how-to-check-a-dkim-record) — DMARC reports or message headers say dkim=fail or "no key", and you need to know whether the public key is published. To check a DKIM record, find the selector in the message's DKIM-Signature header, then look up the TXT record at selector._domainkey.yourdomain. Here's how to do it with the free DKIM Checker, how to read the key, and how to check its size with openssl.
- 2026-10-04 · Guides — [Is our domain being spoofed? How to check a DMARC record with the DMARC Checker](https://watchfor.io/blog/how-to-check-a-dmarc-record) — Customers receive phishing that looks like it came from your domain, or Gmail asks bulk senders for DMARC. To check a DMARC record, look up the TXT record at _dmarc.yourdomain and read its policy: p=none only monitors, quarantine sends failing mail to spam, reject blocks it. Here's how to do it with the free DMARC Checker and what every tag means.
- 2026-10-04 · Guides — [Can search engines find my sitemap? How to check with the Sitemap Checker](https://watchfor.io/blog/how-to-check-a-sitemap) — New pages take weeks to show up in search, and you're not sure crawlers even know your sitemap exists. To check a sitemap, look where crawlers look: /sitemap.xml, the common index paths, and the Sitemap: line in robots.txt. Here's how to do it in seconds with the free Sitemap Checker, a real case where a large site's sitemap was invisible at every standard location, and the one-line fix.
- 2026-10-04 · Guides — [New subdomain not resolving? Check a SOA record with the SOA Record Lookup](https://watchfor.io/blog/how-to-check-a-soa-record) — You created a subdomain, it works for you, and a colleague or a certificate authority still gets 'no such domain'. The answer is in the zone's SOA record: its minimum field and TTL set how long resolvers cache a 'doesn't exist' answer. Here's how to check a SOA record with the free SOA Record Lookup, how to read all seven fields, and the dig commands that compare serials across nameservers.
- 2026-10-04 · Guides — [Is my site on IPv6? How to check AAAA records with the AAAA Record Lookup](https://watchfor.io/blog/how-to-check-aaaa-records) — Some users on mobile or IPv6-only networks time out while everyone else is fine, or you're simply not sure your site has IPv6 at all. To check AAAA records, look up the domain's IPv6 addresses: none means IPv4 only, and one that points at a server nobody configured means slow or failing connections. Here's how to do it with the free AAAA Record Lookup, a real domain with no IPv6, and the dig commands that tell 'no AAAA' from 'no such domain'.
- 2026-10-04 · Guides — [Is my domain pointing to the right IP? Check an A record with the A Record Lookup](https://watchfor.io/blog/how-to-check-an-a-record) — You moved your site to a new host or set up a custom domain on GitHub Pages, Netlify or a VPS, and the site doesn't load, or loads only sometimes. To check an A record, look up the IPv4 addresses the domain resolves to and compare them with the exact list your host gives you, no more and no fewer. Here's how to do it with the free A Record Lookup, a real GitHub Pages check, and the dig and curl commands that confirm it.
- 2026-10-04 · Guides — [Will another sender break SPF? How to check an SPF record with the SPF Checker](https://watchfor.io/blog/how-to-check-an-spf-record) — Marketing wants to add one more email tool, and someone has to say whether the SPF record can take another include. To check an SPF record, confirm there is exactly one v=spf1 record, read its ending (~all or -all) and count the DNS lookups against the limit of 10, including the ones hidden inside each include. Here's how, with the free SPF Checker and dig.
- 2026-10-04 · Guides — [Is my SSL certificate valid? How to check it with the SSL Certificate Check](https://watchfor.io/blog/how-to-check-an-ssl-certificate) — The browser says "Your connection is not private" on one hostname and works on the next. To check an SSL certificate, connect to the server the way a browser does and read what it actually serves: who issued it, the dates, and every name it covers. Here's how to do it in seconds with the free SSL Certificate Check, how to read a wildcard SAN list, and the openssl commands that confirm it.
- 2026-10-04 · Guides — [Is my site serving Brotli? How to check with the Brotli Checker](https://watchfor.io/blog/how-to-check-brotli-compression) — You switched Brotli on in nginx or at your CDN, and now you want proof that visitors actually get it. To check Brotli compression, request the page with Accept-Encoding: br and read the Content-Encoding header that comes back. Here's how to do it in seconds with the free Brotli Checker, why a "No" doesn't mean your site is uncompressed, and the curl commands that measure the bytes.
- 2026-10-04 · Guides — [CAA record prevents issuance? How to check CAA records with the CAA Record Lookup](https://watchfor.io/blog/how-to-check-caa-records) — Let's Encrypt, your hosting panel or your CA refuses to issue a certificate with 'CAA record prevents issuance', or the normal certificate works and the wildcard fails. To check CAA records, look up the domain's issue and issuewild entries and confirm your CA's identifier is listed for the kind of certificate you want. Here's how to do it with the free CAA Record Lookup, a real domain with a split policy, and the exact records to add.
- 2026-10-04 · Guides — [Lighthouse says 100, users say slow? Check with the Core Web Vitals Checker](https://watchfor.io/blog/how-to-check-core-web-vitals) — Your laptop's Lighthouse run scores 100, yet phone users say the page is slow or jumps around. To check Core Web Vitals properly, test the same page with the mobile profile, not just desktop, and read LCP and CLS against Google's thresholds. Here's how with the free Core Web Vitals Checker, a real page that scored 100 on desktop and 65 on mobile, and what to fix first.
- 2026-10-04 · Guides — [Has my DNS change propagated? How to check with the DNS Propagation Checker](https://watchfor.io/blog/how-to-check-dns-propagation) — You changed a record, it works on your laptop, and someone else still lands on the old server. To check DNS propagation, ask the same question from many places at once and compare the answers with what your DNS host serves. Here's how to do it in seconds with the free DNS Propagation Checker, how to read a result that shows different answers in different places, and the dig commands that confirm it.
- 2026-10-04 · Guides — [DNS change not working? How to check DNS records with the DNS Lookup](https://watchfor.io/blog/how-to-check-dns-records) — You edited a DNS record, saved it, and the site, mail or verification still behaves as before. To check DNS records properly, ask two places: the domain's authoritative nameserver, which shows what your DNS host really serves, and a public resolver, which shows what visitors get. Here's how to do both with the free DNS Lookup, how to read the answer, and the dig commands that show the TTLs.
- 2026-10-04 · Guides — [Why are my emails going to spam? Check SPF, DKIM and DMARC with Email Health](https://watchfor.io/blog/how-to-check-email-authentication) — Mail from your domain lands in spam, and you want to rule out the usual cause first. To check email authentication, look at the three DNS records receivers use to trust your mail: SPF, DKIM and DMARC. Here's how to check them in one run with the free Email Health check, how to read the grade honestly, and what to fix for each red line.
- 2026-10-04 · Guides — [Why isn't my site HSTS preload-ready? How to check with the HSTS Checker](https://watchfor.io/blog/how-to-check-hsts) — You added Strict-Transport-Security, but the preload list refuses the domain, or a scanner still says the first visit isn't protected. To check HSTS, read the header on the bare domain's own HTTPS response, without following its redirect, and compare it with the preload rules. Here's how to do it with the free HSTS Checker, how to read max-age, includeSubDomains and preload, and the exact header the list expects.
- 2026-10-04 · Guides — [Deployed, but users still see the old page? How to check with the HTTP Headers checker](https://watchfor.io/blog/how-to-check-http-headers) — You shipped a fix, it shows on your machine, and users still get the old version. The answer is in the response headers: Cache-Control, Age and the CDN's cache status say who served the page and how old it is. Here's how to check HTTP headers from outside your network with the free HTTP Headers checker, how to read the caching ones, and what to change when a stale copy is the problem.
- 2026-10-04 · Guides — [What status code does my page return? How to check with the HTTP Status Checker](https://watchfor.io/blog/how-to-check-http-status-codes) — Search Console says a page is "Not found (404)", yet it opens fine in your browser. The page you see and the status code the server sends are two separate things. Here's how to check the HTTP status code of any URL from outside your network with the free HTTP Status Checker, how to read the result, and how to fix a page that looks right but answers wrong.
- 2026-10-04 · Guides — [I opened the port, so why can't I connect? How to check with the Port Checker](https://watchfor.io/blog/how-to-check-if-a-port-is-open) — You added the firewall rule, restarted the service, and the connection still times out. To check if a port is open, try a TCP connection to it from outside your network: open, refused and no answer at all each point to a different fix. Here's how to test any port in seconds with the free Port Checker, how to read the result and the server banner, and the nc commands that confirm it.
- 2026-10-04 · Guides — [Is my CDN actually caching? How to check with the Global CDN Checker](https://watchfor.io/blog/how-to-check-if-your-cdn-is-caching) — You pay for a CDN, yet users in one region say the site is slow, and you can't tell whether the edge is serving from cache or going back to your origin every time. To check if your CDN is caching, request the same URL several times from many regions and read the cache status each edge reports. Here's how with the free Global CDN Checker, a real run across 20 locations, and the curl commands that show the same headers.
- 2026-10-04 · Guides — [Is my IP blacklisted? How to check a mail server with the Blacklist Check](https://watchfor.io/blog/how-to-check-if-your-ip-is-blacklisted) — Your mail bounces with "blocked using Spamhaus" or quietly lands in spam, and you suspect a blocklist. To check if your IP is blacklisted, look up your sending server's address on the DNS blocklists receivers use. Here's how to do it with the free Blacklist Check, what a clean, listed or refused answer means, and how to get delisted.
- 2026-10-04 · Guides — [Why isn't our email arriving? How to check MX records with the MX Lookup](https://watchfor.io/blog/how-to-check-mx-records) — Mail to your domain bounces, or part of it still lands at the old provider after a switch. To check MX records, look up the domain's MX set and confirm every host belongs to the provider you use now, with sensible priorities. Here's how to do it with the free MX Lookup, how to read priorities, and the dig commands that show TTLs.
- 2026-10-04 · Guides — [Why does my SEO audit flag a redirect chain? How to check with the Redirect Checker](https://watchfor.io/blog/how-to-check-redirects) — An SEO crawler reports a redirect chain or a 302 on your homepage, and the browser just shows the final page. To check redirects, request the URL people actually type and follow every hop yourself: status code, Location header and timing for each. Here's how to do it with the free Redirect Checker, how to tell a harmless chain from a costly one, and the curl command that confirms it.
- 2026-10-04 · Guides — [Scanner says "missing security headers"? How to check with the Security Headers Checker](https://watchfor.io/blog/how-to-check-security-headers) — A pentest report or a security questionnaire lists "missing HTTP security headers" and you need to know which ones, on which URL, and what to add. To check security headers, fetch the page the way a browser does and look for seven response headers. Here's how to do it with the free Security Headers Checker, what each missing header leaves open, and the config that adds them, even on a static host.
- 2026-10-04 · Guides — [App can't find its server? How to check SRV records with the SRV Record Lookup](https://watchfor.io/blog/how-to-check-srv-records) — Mail clients, SIP phones, XMPP chat, Minecraft and Active Directory find their servers through DNS SRV records, and when discovery fails the app just says it can't connect. To check an SRV record, look up the full service name (such as _submission._tcp.example.com) and read the target host, port, priority and weight. Here's how to do it with the free SRV Record Lookup, a real Gmail example, and the dig and nc commands that confirm the port answers.
- 2026-10-04 · Guides — [Renewed the certificate but the old expiry still shows? How to check with the SSL Expiry Checker](https://watchfor.io/blog/how-to-check-ssl-certificate-expiry) — Let's Encrypt says the certificate renewed, yet browsers still show the old expiry date. Renewal writes a new file; only the server that loads it serves it, and every hostname can sit on a different server. Here's how to check SSL certificate expiry per hostname with the free SSL Expiry Checker, how to prove which certificate is live, and the openssl commands that compare it with the file on disk.
- 2026-10-04 · Guides — [Are TLS 1.0 and 1.1 really off? How to check with the TLS Version Checker](https://watchfor.io/blog/how-to-check-tls-versions) — An auditor, a PCI scan or a customer questionnaire asks you to prove that TLS 1.0 and 1.1 are disabled. To check which TLS versions a server accepts, offer it each version in turn and record which handshakes succeed. Here's how to do it with the free TLS Version Checker, how to read the protocol row, the openssl loop that produces evidence, and where the setting lives when an old version is still on.
- 2026-10-04 · Guides — [Domain verification failing? How to check TXT records with the TXT Record Lookup](https://watchfor.io/blog/how-to-check-txt-records) — Google, Microsoft, Stripe or Atlassian asks you to add a TXT record, you add it, and Verify still fails. To check a TXT record, look up every TXT record on the exact name the service checks and confirm your token is there, complete and unquoted. Here's how to do it with the free TXT Record Lookup, what a busy real domain looks like, and the dig commands that show how long strings are split.
- 2026-10-04 · Guides — [Is my website healthy? How to check it with the Smart Website Checker](https://watchfor.io/blog/how-to-check-website-health) — Someone asks whether the website is OK, or you inherit one and need to know what will break first. To check website health, look past "does the page load" at the things that fail on a date or fail silently: domain and certificate expiry, DNS, redirects, email authentication and blacklists. Here's how to get all of it in one scan with the free Smart Website Checker, and how to read a result that says A+ and still lists work to do.
- 2026-10-04 · Guides — [Is our domain about to expire? How to check with the Domain Expiry Checker](https://watchfor.io/blog/how-to-check-when-a-domain-expires) — A lapsed domain takes your website and your email down at once, and a renewal that silently failed is easy to miss. To check when a domain expires, read the expiration date the registry itself publishes over RDAP, not the date in a registrar email. Here's how to do it with the free Domain Expiry Checker, how to read the status flags that say whether a domain can still be saved, and the curl command that shows the same date.
- 2026-10-04 · Guides — [Rate limited until 1791068136? Convert it with the Timestamp Converter](https://watchfor.io/blog/how-to-convert-a-unix-timestamp) — An API says you're rate limited until 1791068136, a log line starts with 1791065206319, and you need to know when that is in your own time. A Unix timestamp counts seconds since 1 January 1970 UTC; convert it and you get a date in UTC and in your timezone. Here's a real case from the GitHub API, how to spot a seconds-versus-milliseconds mix-up, and the date commands that do the same.
- 2026-10-04 · Guides — [Is this JWT expired? Read exp and iat with the Epoch Converter](https://watchfor.io/blog/how-to-convert-epoch-time) — Users get 401 "token expired" a few minutes after logging in. The answer is inside the token: its exp and iat claims are epoch times, seconds since 1970 UTC. Convert them and you know when the token was issued, when it dies, and whether the server or the token is wrong. Here's how with the free Epoch Converter, plus the jq one-liner that decodes a JWT locally.
- 2026-10-04 · Guides — [New domain? How to create SPF and DMARC records with the SPF & DMARC Generator](https://watchfor.io/blog/how-to-create-spf-and-dmarc-records) — You're setting up email on a domain that sends from several services, and you need the two TXT records that make receivers trust it. To create SPF and DMARC records, list every service that sends as your domain in one SPF record, keep it under 10 DNS lookups, and start DMARC at p=none with a report address. Here's how with the free SPF & DMARC Generator, using a real three-provider setup.
- 2026-10-04 · Guides — [Mail rejected for missing PTR? How to do a reverse DNS lookup with the Reverse DNS Lookup](https://watchfor.io/blog/how-to-do-a-reverse-dns-lookup) — Gmail bounces your mail with 550 5.7.25 and something about a PTR record. A reverse DNS lookup turns an IP address back into a hostname by querying its PTR record under in-addr.arpa or ip6.arpa. For a mail server that name must exist and resolve back to the same IP. Here's how to check it in seconds with the free Reverse DNS Lookup, what a correct and a missing PTR look like, and how to fix it.
- 2026-10-04 · Guides — [Did the nameserver change work? Find a domain's nameservers with the NS Lookup](https://watchfor.io/blog/how-to-find-a-domains-nameservers) — You moved DNS to Cloudflare or Route 53, changed the nameservers at the registrar, and you're not sure the world follows. To find a domain's nameservers, look up its NS records: they name the servers that answer for the domain. Here's how to check them with the free NS Lookup, how to spot a half-finished move or a lame delegation, and the dig commands that compare the registry's delegation with the zone.
- 2026-10-04 · Guides — [Who owns this domain? How to find out with the Whois Lookup](https://watchfor.io/blog/how-to-find-who-owns-a-domain) — A link in an email, a lookalike of your brand, a name you want to buy: first you want to know who is behind the domain. To find who owns a domain, run a Whois (RDAP) lookup: it shows the registrar, when the domain was registered, when it expires and how it is locked, while the owner's personal details are usually redacted. Here's how to read a real lookup, how to reach a hidden owner, and the curl commands that go one step further.
- 2026-10-04 · Guides — [What's my public IP address? How to find it with What Is My IP](https://watchfor.io/blog/how-to-find-your-public-ip-address) — The firewall rule is saved, the vendor has added your IP to their allowlist, and you still can't get in. Usually the address you gave them isn't the one the internet sees. Your public IP is the address servers see when you connect, and it's rarely the one your computer shows you. Here's how to find it in one click, how to read IPv4, IPv6, ISP and location, and the commands that confirm it from a terminal.
- 2026-10-04 · Guides — ["Problems parsing JSON"? Find the error with the JSON Formatter & JSONPath](https://watchfor.io/blog/how-to-format-and-query-json) — An API answers 400 "Problems parsing JSON" and doesn't say where. Paste the body into a JSON validator and it names the line and column where parsing stopped; the mistake is almost always the character just before it. Here's a real case from the GitHub API, how to read the error, how to format and query a response with JSONPath, and the jq one-liners that do the same.
- 2026-10-04 · Guides — [Who owns this IP address? How to find out with the IP Address Lookup](https://watchfor.io/blog/how-to-look-up-an-ip-address) — An address in your logs is making thousands of requests and says it's Googlebot. To find out who owns an IP address, look up the network that announces it (its ASN and BGP prefix) and its reverse DNS name, then confirm the name points back to the same address. Here's how to do it in one step with the free IP Address Lookup, how to read every field, and the dig and RDAP commands that confirm it.
- 2026-10-04 · Guides — [Is it the server or my connection? How to ping a server online with Ping](https://watchfor.io/blog/how-to-ping-a-server-online) — Video calls stutter, SSH lags and a site feels slow, and nobody knows whether to blame the server or the office line. Pinging the server from outside your network gives you a second opinion: if a data-centre location sees a steady round trip and you don't, the problem is on your side. Here's how to run an online ping test, how to read RTT, jitter and loss, and the ping commands that finish the diagnosis.
- 2026-10-04 · Guides — [My ISP gave me a /56. Now what? How to plan IPv6 subnets with the IPv6 Subnet Calculator](https://watchfor.io/blog/how-to-plan-ipv6-subnets) — Your ISP or cloud gives you an IPv6 prefix like 2001:db8:abcd:1200::/56, and you need to turn it into networks for the office, the guests and the servers. To plan IPv6 subnets, give every LAN its own /64 and count how many /64s your prefix holds: a /56 has 256, a /48 has 65,536. Here's how to work it out with the free IPv6 Subnet Calculator, and a Python check that lists every subnet.
- 2026-10-04 · Guides — [Late or in spam? How to read email headers with the Email Header Analyzer](https://watchfor.io/blog/how-to-read-email-headers) — A customer says your password-reset email arrived 45 minutes late, in the spam folder. To read email headers, copy the raw headers of that message, follow the Received lines from the bottom up to find where time was lost, and read Authentication-Results for the SPF, DKIM and DMARC verdict. Here's how with the free Email Header Analyzer, which runs in your browser, on a test message we built.
- 2026-10-04 · Guides — [Packet loss at one hop: is it a problem? How to run a traceroute online with Traceroute](https://watchfor.io/blog/how-to-run-a-traceroute-online) — Someone sends you a traceroute with a red 33% next to one router and asks why your network is dropping packets. To run a traceroute online and read it correctly, trace the path from a server outside your network and look at what happens at the destination, not at one hop in the middle. Here's how with the free Traceroute tool, how to read loss and latency per hop, and the mtr command that confirms it.
- 2026-10-04 · Guides — [Cron job ran on the wrong day? Test it with the Cron Expression Tester](https://watchfor.io/blog/how-to-test-a-cron-expression) — A "first Monday of the month" job ran four days in a row. Cron treats day-of-month and day-of-week as OR when both are set, so 0 9 1-7 * 1 means the 1st to the 7th and every Monday. To test a cron expression, read it back in plain English and check its next run times before you deploy. Here's how with the free Cron Expression Tester, the fix, and how to check a schedule on the command line.
- 2026-10-04 · Guides — [Why won't my WebSocket connect? How to test it with the WebSocket Tester](https://watchfor.io/blog/how-to-test-a-websocket) — Your WebSocket works on localhost and fails in production, and the browser console only says the connection failed. To test a WebSocket, open the connection from outside your network and look at the HTTP status of the upgrade: 101 means it works, anything else names the layer that refused it. Here's how with the free WebSocket Tester, a working socket next to a failing one, and the proxy settings that usually fix it.
- 2026-10-04 · Guides — [Is the API broken, or just my network? How to test it with the API Tester](https://watchfor.io/blog/how-to-test-an-api-online) — An integration reports API errors, yet the same call works from your laptop. To test an API online, send the request from a machine outside your network and read all of the response: status, timing, headers and body fields, not just the status code. Here's how with the free API Tester, a real request to the GitHub API that shows why rate-limit headers matter, and the curl commands to reproduce it.
- 2026-10-04 · Guides — [MCP server won't connect? How to test it with the MCP Server Checker](https://watchfor.io/blog/how-to-test-an-mcp-server) — Claude, Cursor or another AI client says it can't connect to your MCP server, and opening the URL in a browser shows an error that may or may not be normal. To test an MCP server, run the protocol's initialize handshake and list its tools, the way a client does. Here's how with the free MCP Server Checker, why a 405 in the browser is expected, and the curl commands that reproduce each step.
- 2026-10-04 · Guides — [Is this time server any good? How to test an NTP server with the NTP Server Test](https://watchfor.io/blog/how-to-test-an-ntp-server) — 2FA codes get rejected, tokens are 'not yet valid', logs from two servers disagree by seconds. Before you point a fleet at a time server, test it: ask it for the time and check that it answers, is synchronised, sits at a low stratum and agrees with a good clock to within milliseconds. Here's how with the free NTP Server Test, how to read offset, delay, stratum and leap, and a ten-line script that does the same query.
- 2026-10-04 · Guides — [Will our new mail server accept mail? How to test it with the SMTP Server Test](https://watchfor.io/blog/how-to-test-an-smtp-server) — You're about to point MX at a new mail server, or mail to your server has stopped arriving, and a test from your laptop just times out. To test an SMTP server, connect to it from the outside the way a sending server does and check four things: the greeting banner, STARTTLS, relay refusal and reverse DNS. Here's how with the free SMTP Server Test, and the openssl commands that do the same.
- 2026-10-04 · Guides — [Is my site compressed? How to test it with the Gzip Compression Test](https://watchfor.io/blog/how-to-test-gzip-compression) — PageSpeed Insights tells you to enable text compression, and you're sure gzip is already on. To test gzip compression, request the page with Accept-Encoding: gzip and check for Content-Encoding: gzip in the response, then compare the bytes with and without it. Here's how with the free Gzip Compression Test, how to read its Brotli-first answer, and the curl commands that measure the saving.
- 2026-10-04 · Guides — [Why is my SSL grade a B? How to test it with the SSL/TLS Grade checker](https://watchfor.io/blog/how-to-test-your-ssl-tls-grade) — A customer's security questionnaire asks for an A, and your site scores a B. To test your SSL/TLS grade, scan which protocol versions and ciphers the server accepts, check the certificate, and look for HSTS. Here's how to do it in seconds with the free SSL/TLS Grade checker, how the A+ to F grade is built, and the exact settings that took a real B to an A.
- 2026-10-04 · Guides — [Is my XML sitemap valid? How to validate it with the Sitemap Validator](https://watchfor.io/blog/how-to-validate-an-xml-sitemap) — Search Console flags sitemap problems, or lists pages as excluded, and you need to know whether the sitemap itself is the cause. To validate an XML sitemap, confirm it parses, stays within the protocol limits and lists only URLs that return 200 and are meant to be indexed. Here's how with the free Sitemap Validator, what it means when it reports 10 URLs for a site with thousands of pages, and the commands that check the rest.
- 2026-10-04 · Guides — [Every 15 minutes on weekdays? Write the crontab line with the Crontab Generator](https://watchfor.io/blog/how-to-write-a-crontab-schedule) — You need a job every 15 minutes during office hours, Monday to Friday. The crontab line is */15 9-17 * * 1-5, but that runs until 17:45, not 17:00, and at 09:00 in the server's timezone, which may not be yours. Here's how to write a crontab schedule with the free Crontab Generator, check every run before you paste it into crontab -e, and turn it into a complete, logged line.
- 2026-10-03 · Networking — [47-day SSL certificates: what breaks and how to stay ahead](https://watchfor.io/blog/47-day-ssl-certificates) — Public TLS certificates already max out at 200 days, drop to 100 in March 2027 and to 47 in March 2029, and proof of domain control will be reusable for only 10 days. Here is the exact CA/Browser Forum schedule, the setups that will break first, and a checklist for automating renewal and checking what your servers actually serve.
- 2026-10-03 · Reliability — [PagerDuty alternatives: the best on-call scheduling tools in 2026](https://watchfor.io/blog/best-pagerduty-alternatives) — Opsgenie stops working on 5 April 2027 and the open-source Grafana OnCall is archived, so a lot of teams are choosing an on-call tool this year. Here is what PagerDuty actually costs now, seven alternatives with prices checked on 3 October 2026, and the one question that decides most of it: where do your alerts come from?
- 2026-10-03 · DevOps — [The best server monitoring tools in 2026, sorted by how many servers you have](https://watchfor.io/blog/best-server-monitoring-tools) — Server monitoring tools are not competing for the same job. A per-second dashboard for one box, a Prometheus stack you run yourself, a Zabbix install for a data centre and a per-host SaaS bill are four different decisions. Here is how to pick, with prices checked on 3 October 2026 and an honest note on where each one loses.
- 2026-10-03 · Monitoring — [The best synthetic monitoring tools in 2026 for browser and Playwright checks](https://watchfor.io/blog/best-synthetic-monitoring-tools) — Your homepage returns 200 while nobody can sign in. Catching that takes a browser that walks the journey on a schedule. Here are eight synthetic monitoring tools sorted by how you want to write the check (Playwright code, a vendor's script dialect or a recorder), what one journey costs a month on each, and where each one loses. Prices checked on 3 October 2026.
- 2026-10-03 · Monitoring — [Command palette and keyboard shortcuts: run your monitoring from the keyboard](https://watchfor.io/blog/command-palette-keyboard-shortcuts) — You have 200 monitors and you need the checkout one. Scrolling a list is slow, and the filter is three clicks away. Press ⌘K, type chec, press Enter. Here is everything the WatchFor dashboard does from the keyboard: the command palette, the g and c chords, the Inbox keys, and an incident handled almost without the mouse.
- 2026-10-03 · Engineering — [How we confirm an outage before paging anyone](https://watchfor.io/blog/confirm-outage-before-paging) — A single failed check is a rumour, not an outage. Here's the pipeline that decides which is which: rotating locations, accelerated re-checks driven back into the scheduler, a severity cascade, and an alert manager that deduplicates, silences, inhibits, groups and escalates. Real defaults from the code, and the honest cost: about a minute of extra latency, and blind spots we chose to keep.
- 2026-10-03 · Security — [How to detect DNS hijacking before your customers do](https://watchfor.io/blog/detect-dns-hijacking) — A hijacked DNS record doesn't take your site down. It sends your users somewhere else, often behind a valid padlock. Four real incidents, the records worth watching, how to lock down your registrar, and how to get an alert the moment an answer stops matching what you expect.
- 2026-10-03 · Reliability — [Incident status update templates: copy-paste wording for every stage](https://watchfor.io/blog/incident-status-update-templates) — Nobody writes well at 3 a.m. with checkout down. Here are status page updates you can copy and fill in for every stage of an incident (investigating, identified, monitoring, resolved), plus scheduled maintenance, partial outages, a provider's outage, a security incident and the follow-up, each with when to use it and the mistakes that cost you trust.
- 2026-10-03 · Security — [Magecart and injected scripts: how to catch a tampered page](https://watchfor.io/blog/magecart-injected-scripts) — A skimmer doesn't break your checkout. It copies every card number typed into it and lets the payment go through, which is why the people who notice are usually a bank, a researcher or a stranger on social media. What happened at British Airways, Ticketmaster and polyfill.io, how the code gets in, what PCI DSS 4.0 now requires, and how to detect a tampered page yourself.
- 2026-10-03 · Monitoring — [Monitor a checkout flow with Playwright, step by step](https://watchfor.io/blog/monitor-checkout-flow-with-playwright) — Your checkout page can return 200 while nobody can buy anything. Here's a Playwright test that signs in, adds a product, checks out with test data and asserts the order confirmation, why each line is written the way it is, how to avoid real orders and leaked passwords, and how to run it every few minutes from more than one place.
- 2026-10-03 · Monitoring — [Monitoring 100 client websites: a setup for agencies](https://watchfor.io/blog/monitoring-client-websites-for-agencies) — One client site is a monitor. A hundred is a system: names and tags you can search, the same checks on every site, alerts that reach the right people, maintenance that doesn't page you, a status page per client and a number for the monthly report. Here's a setup that scales, what it costs in monitor slots, and the parts WatchFor doesn't do for agencies yet.
- 2026-10-03 · Security — [Security headers checklist (and how to keep them from silently disappearing)](https://watchfor.io/blog/security-headers-checklist) — Seven response headers, the values worth sending, copy-paste config for nginx, Caddy, Cloudflare and Vercel/Next.js, the headers to stop sending, and the boring ways they vanish after you set them: a new location block, a 404 page, a redirect, a CDN migration. Plus how to notice the day one goes missing.
- 2026-10-02 · Monitoring — [Uptime monitoring in Grafana: scrape WatchFor with Prometheus](https://watchfor.io/blog/prometheus-grafana-uptime-monitoring) — Your Grafana already shows CPU, queues and error rates. What it usually can't show is whether a customer in another country can reach you right now. Here's how to put WatchFor's outside view (confirmed status, incident-based uptime, certificate and domain expiry, heartbeats) into your own Prometheus: the five-line scrape config, the PromQL worth keeping, alert rules that don't double-page, the dashboard, and when the open-source exporter is the better fit.
- 2026-09-29 · Monitoring — [How to monitor a login with 2FA (TOTP) in Playwright](https://watchfor.io/blog/monitor-a-2fa-login-with-playwright) — Your login is the one page every customer must get through, and two-factor authentication is the part a monitor usually skips. It doesn't have to: a TOTP code is just arithmetic on a shared secret and the clock. Here's a Playwright test that signs in with a real one-time code, the three ways it goes wrong, and how to run it every few minutes without leaking the secret.
- 2026-09-11 · Engineering — [100/100 on ora.ai: what the last six points cost](https://watchfor.io/blog/100-on-ora-ai) — On 10 September 2026 ora.ai scored watchfor.io 100/100 for agent-readiness and listed it first among the 90,000-odd domains it has scanned. We are proud of that. This is the honest version: what the last six points took, why we sit in the Community category, and what a 100 does not mean.
- 2026-09-11 · Monitoring — [The best API monitoring tools in 2026](https://watchfor.io/blog/best-api-monitoring-tools) — An API that returns 200 with the wrong body passes every uptime check ever written. The tools worth paying for are the ones that assert on what came back — and they split cleanly into two camps depending on whether you want checks in a repository or not.
- 2026-09-11 · Monitoring — [The best cron job monitoring tools in 2026](https://watchfor.io/blog/best-cron-job-monitoring-tools) — A cron job that stops running produces no error, no alert and no log line — it produces silence, which looks exactly like success. Here are the tools that notice, what each one actually measures, and how to pick between a heartbeat and full job telemetry.
- 2026-09-11 · Monitoring — [The best DNS monitoring tools in 2026](https://watchfor.io/blog/best-dns-monitoring-tools) — Most tools that claim DNS monitoring resolve a name and check it answered. That catches an outage and misses everything that actually goes wrong with DNS — a record edited by the wrong person, propagation that stalled in one region, a nameserver that disagrees with its siblings.
- 2026-09-11 · Monitoring — [The best free website monitoring tools in 2026](https://watchfor.io/blog/best-free-website-monitoring-tools) — Free monitoring tiers differ far more than the monitor counts suggest. Check interval, how many people can see the alerts, and — the one almost nobody checks — which check types the free tier actually includes.
- 2026-09-11 · Monitoring — [Pingdom alternatives in 2026, and what you lose by leaving](https://watchfor.io/blog/best-pingdom-alternatives) — Most people leave Pingdom over the renewal quote. Before you do, be clear about the two things it does that almost nothing on the shortlist replaces — real user monitoring and scripted transactions — and then pick the alternative that covers what you actually use.
- 2026-09-11 · Monitoring — [The best SSL certificate monitoring tools in 2026](https://watchfor.io/blog/best-ssl-monitoring-tools) — Certificate expiry is the most preventable outage there is, and it still happens constantly — usually because the alert went to someone who left, or because the tool only checked the certificate the CDN presents. Here is what each tool actually checks, and what most of them miss.
- 2026-09-11 · Monitoring — [The best status page tools in 2026](https://watchfor.io/blog/best-status-page-tools) — A status page has one job: to be believed. Most of the decision is not features — it is whether the page is hosted away from your infrastructure, whether it updates itself, and whether anyone can post to it during an incident without a deploy.
- 2026-09-11 · Monitoring — [The best uptime monitoring tools in 2026, sorted by what you are actually afraid of](https://watchfor.io/blog/best-uptime-monitoring-tools) — Most round-ups rank monitoring tools by feature count, which is useless — the tools are not competing for the same job. This one sorts them by the failure you are trying to catch, with prices checked on a stated date and an honest note about where each one loses.
- 2026-09-11 · Monitoring — [Uptime Kuma vs hosted monitoring: what self-hosting actually costs](https://watchfor.io/blog/uptime-kuma-vs-hosted-monitoring) — Uptime Kuma is free and genuinely good, and for a lot of people it is the right answer. The honest comparison is not about features — it is about two structural problems that no amount of configuration fixes, and whether either of them applies to you.
- 2026-09-11 · Monitoring — [UptimeRobot alternatives in 2026, including the case for staying](https://watchfor.io/blog/uptimerobot-alternatives) — UptimeRobot's free tier is the most generous in monitoring and most people should keep it. This is about the three specific reasons teams leave — no login seats on the free plan, per-seat billing once you pay, and a catalogue that stops at ten check types — and which alternative answers which.
- 2026-09-08 · Security — [Clickjacking Explained: how an invisible frame steals a click](https://watchfor.io/blog/clickjacking-explained) — Any website can load yours inside an invisible frame and let someone click your buttons while they think they're clicking something else. One header stops it, and almost nothing can go wrong by adding it.
- 2026-09-08 · Security — [Content Security Policy Explained: what CSP actually stops](https://watchfor.io/blog/content-security-policy-explained) — Your site works perfectly and still runs any script it's told to, from anywhere on the internet. CSP is the list that says which ones you actually meant — here's what it prevents, and how to switch it on without breaking your own site.
- 2026-09-08 · Security — [MIME Sniffing and nosniff: when the browser guesses what your file is](https://watchfor.io/blog/mime-sniffing-explained) — Browsers don't always believe you about what a file is — they look inside and decide for themselves. That guess is how an uploaded 'image' occasionally ends up running as code. One header ends the guessing.
- 2026-09-08 · Security — [Permissions-Policy Explained: switching off what your site never uses](https://watchfor.io/blog/permissions-policy-explained) — Your page can ask for the camera, the microphone and the visitor's location — and so can every script and iframe you embed, in your name. Permissions-Policy is how you say which of those your site actually needs.
- 2026-09-08 · Security — [Referrer-Policy Explained: what every outbound link tells strangers](https://watchfor.io/blog/referrer-policy-explained) — Click a link on your site and the browser quietly tells the destination which page you came from — the full URL, including whatever is in it. Sometimes that's a reset token. One header decides how much gets sent.
- 2026-08-23 · Monitoring — [Six scheduled jobs that will eventually burn you — and the exact check-in for each](https://watchfor.io/blog/cron-monitoring-recipes) — Backups, certificate renewal, queue workers, ETL, cleanup jobs, billing runs — every team runs them, every team has been burned by one going silent. Recipes with the exact ping patterns: exit codes, run duration, output capture, and the grace period that fits each job.
- 2026-08-23 · Networking — [DNS propagation is a myth: what's actually happening when your record 'takes 48 hours'](https://watchfor.io/blog/dns-propagation-myths) — Nothing propagates. DNS changes don't spread across the internet — caches expire, one resolver at a time, on a timer you set yourself. Once you see it that way, migrations stop being scary: here's the TTL playbook, the myths that refuse to die, and the checks that tell you the truth.
- 2026-08-23 · Reliability — [How to read (and write) an SLA report that isn't lying](https://watchfor.io/blog/honest-sla-reports) — Two companies report 99.95% uptime. One had a flawless month; the other hid a six-hour outage behind measurement tricks. Same number. Here's where SLA reports bend the truth — planned downtime, degraded time, measurement gaps, cherry-picked windows — and what an honest report discloses.
- 2026-08-23 · Reliability — [Maintenance windows done right: stop paging yourself for planned work](https://watchfor.io/blog/maintenance-windows-done-right) — Every team has planned downtime — deploys, migrations, nightly batches. Most handle it by pausing monitors or eating the false alarms. Both are wrong. Here's what a real maintenance window does: silence the noise, keep the data, and keep your SLA honest.
- 2026-08-23 · Monitoring — [The agentic supply chain: monitoring MCP servers you host — and the ones you only consume](https://watchfor.io/blog/mcp-agentic-supply-chain) — Every MCP server your agents connect to is a live dependency — like an npm package that can change under you at runtime, with no lockfile and no changelog. Here's the monitoring playbook for both sides of that relationship: the servers you run, and the third-party ones you merely trust.
- 2026-08-23 · Monitoring — [Who changed the monitor? Why your monitoring needs an audit trail](https://watchfor.io/blog/monitoring-audit-trail) — The postmortem question that has no answer in most monitoring setups: who disabled that alert, when, and what did it look like before? Here's why an audit trail on your monitoring config is as important as one on your production data — for debugging, for teams, and for the SOC 2 auditor.
- 2026-08-23 · Reliability — [On-call scheduling without a second tool: rotations, escalations and fair shift math](https://watchfor.io/blog/on-call-scheduling-in-watchfor) — Most teams bolt a paging product onto their monitoring and glue them together with webhooks. Here's how full on-call management — rotation calendars, escalation chains, personal paging and compensation-ready shift totals — works when it's built into the monitor itself.
- 2026-08-23 · Monitoring — [Seven API monitors every SaaS should be running (with the exact assertions)](https://watchfor.io/blog/seven-api-monitors-every-saas-needs) — Not a philosophy post — a checklist. Seven concrete API monitors, the exact assertion each one needs, and the failure it catches: the lying health endpoint, the silently expiring token, the queue that backs up on Friday night, and four more.
- 2026-08-23 · Monitoring — [The complete status page guide: from bare green dots to a page customers actually trust](https://watchfor.io/blog/status-page-complete-guide) — A status page is the most public thing your infrastructure has. This guide covers every layer of building a good one: branding and themes, components and grouping, automatic vs. manual state, third-party dependencies, maintenance announcements, visibility modes, badges and JSON — and the trust rules that make or break all of it.
- 2026-08-23 · Monitoring — [Webhook reliability: designing deliveries that survive, and monitoring both ends](https://watchfor.io/blog/webhook-reliability-guide) — Webhooks fail silently by design — the sender moves on, the receiver never knows what it missed. Here's the engineering playbook for both sides: retries and idempotency, signatures and ordering, dead letters — and the monitoring that catches a dead webhook pipeline before your data drifts.
- 2026-08-09 · Monitoring — [API monitoring beyond status codes: assert on the response, chart what matters](https://watchfor.io/blog/api-monitoring-beyond-status-codes) — A 200 OK only proves your API answered — not that the answer was right. Here's why status-only checks miss real outages, what monitoring the response actually takes, and how WatchFor's new API monitor asserts on JSON, extracts values into charts, and pages you when the body goes wrong.
- 2026-07-30 · Monitoring — [Heartbeat & Cron Job Monitoring: the Dead Man's Switch Your Backups Deserve](https://watchfor.io/blog/heartbeat-cron-monitoring) — Most monitoring checks that something is up. Heartbeat monitoring does the opposite — it alerts when something that should run goes silent. The concept, who needs it, and how to set it up so a dead backup job can't hide for three weeks.
- 2026-07-30 · Monitoring — [MCP Server Monitoring: Why "HTTP 200" Means Nothing to an AI Agent](https://watchfor.io/blog/mcp-server-monitoring) — MCP servers fail in ways no uptime check can see: the port answers 200 while the handshake breaks, tools vanish, or a tool description is silently rewritten under your agents. Here's how protocol-level MCP monitoring works — and why we built it.
- 2026-06-26 · Networking — [Advanced SSH: jump hosts, tunnels, and power-user tricks](https://watchfor.io/blog/advanced-ssh-tunnels-jump-hosts) — Once you know basic SSH, a whole toolbox opens up: jump hosts to reach private servers, port forwarding, SOCKS proxies, agent forwarding, and a config file that makes it all effortless. The power-user guide.
- 2026-06-26 · Networking — [FTP vs FTPS vs SFTP: file transfer protocols explained](https://watchfor.io/blog/ftp-ftps-sftp-explained) — FTP, FTPS, and SFTP all move files — but only two are safe, and they work in completely different ways. Here's how each protocol works, active vs passive mode, the best clients per OS, and which to use.
- 2026-06-26 · Reliability — [SLA vs SLO vs SLI: the reliability promise, decoded](https://watchfor.io/blog/sla-slo-sli) — Three little acronyms quietly run every serious reliability conversation — and almost everyone mixes them up. Here's what SLA, SLO and SLI actually mean, how they fit together, and how to set ones that won't page you at 3am for nothing.
- 2026-06-26 · Networking — [SSH explained: secure remote access, keys, and sessions](https://watchfor.io/blog/ssh-explained) — SSH is how you securely log into and control machines anywhere in the world. Here's what it is, how password vs public-key auth really works, how to run remote commands, and the best clients for every OS.
- 2026-06-25 · Reliability — [Alert Fatigue: why your team stopped reading alerts (and how to fix it)](https://watchfor.io/blog/alert-fatigue) — When everything alerts, nothing does. Alert fatigue is how real outages slip past tired teams — and it's fixable. Here's why it happens, what it costs, and how to get back to a pager you can trust.
- 2026-06-24 · Monitoring — [Status Page Best Practices: turning your worst day into trust](https://watchfor.io/blog/status-page-best-practices) — A status page is the one place customers look when things go wrong — and most are an afterthought. Here's how to run one that deflects tickets, calms users, and quietly earns trust during an outage.
- 2026-06-23 · Monitoring — [Uptime Monitoring 101: how to never be the last to know](https://watchfor.io/blog/uptime-monitoring-101) — The worst way to find out your website is down is from an angry customer. This is the beginner-friendly guide to uptime monitoring — what it is, why it matters, and how to set it up so you always hear it first.
- 2026-06-22 · Networking — [HTTP Status Codes Explained: what 404, 500 and 503 really mean](https://watchfor.io/blog/http-status-codes-explained) — Every status code is your server trying to tell you something. Here's a plain-English guide to the ones you'll actually meet — what they mean, whose fault they are, and what to do about each.
- 2026-06-19 · Performance — [Core Web Vitals Explained: LCP, CLS, INP (and how to keep them green)](https://watchfor.io/blog/core-web-vitals-explained) — Google grades your pages on three numbers — and they affect both how your site feels and how it ranks. Here's what LCP, CLS and INP actually measure, what 'good' looks like, and how to fix them.
- 2026-06-16 · Networking — [How to Never Get Caught by an Expired SSL Certificate](https://watchfor.io/blog/ssl-certificate-expiry) — An expired TLS certificate takes your whole site offline with a scary red warning — and it's 100% preventable. Here's why certificates expire, what it costs, and how to make sure it never catches you.
- 2026-06-12 · Networking — [How DNS Works (and What 'Propagation' Really Means)](https://watchfor.io/blog/how-dns-works) — DNS is the internet's phonebook — and one of the most common causes of outages nobody understands. Here's how a domain name becomes an IP address, in plain English, plus what 'propagation' actually is.
- 2026-06-09 · Reliability — [The Blameless Postmortem: turning incidents into improvements (with a template)](https://watchfor.io/blog/blameless-postmortem) — After an outage you can hunt for someone to blame, or hunt for what to fix. Only one makes you more reliable. Here's how to run a blameless postmortem — plus a copy-paste template.
- 2026-06-06 · Monitoring — [Synthetic vs Real User Monitoring (RUM): what's the difference?](https://watchfor.io/blog/synthetic-vs-real-user-monitoring) — Synthetic monitoring and RUM answer two different questions about your site. Here's what each one does, where each shines, and why the best setups use both.
- 2026-06-03 · Monitoring — [API Monitoring Guide: how to watch the endpoints your business runs on](https://watchfor.io/blog/api-monitoring-guide) — Your website can be perfectly up while your API quietly fails — and APIs power the integrations, apps and partners you can't see. Here's how to monitor them properly.
- 2026-05-30 · Monitoring — [What is 99.9% Uptime? The downtime hiding behind the nines](https://watchfor.io/blog/what-is-99-9-percent-uptime) — “99.9% uptime” sounds almost perfect — until you do the maths. Here's exactly how much downtime each level of nines allows, how it's calculated, and how to pick a target you can actually hit.
- 2026-05-27 · Reliability — [On-Call Best Practices: a rotation that doesn't burn people out](https://watchfor.io/blog/on-call-best-practices) — Done badly, on-call wrecks sleep, morale and retention. Done well, it's a fair, calm safety net the whole team trusts. Here's how to build the second kind.
- 2026-05-23 · Monitoring — [Website Downtime: the most common causes (and how to prevent each)](https://watchfor.io/blog/website-downtime-causes) — Most outages aren't mysterious — they come from the same short list of causes, again and again. Here's that list, what each one looks like, and how to stop it taking your site down.
- 2026-05-20 · Monitoring — [Observability vs Monitoring: what's the difference (and do you need both)?](https://watchfor.io/blog/observability-vs-monitoring) — Monitoring tells you something broke. Observability helps you figure out why. Here's how the two differ, where each fits, and why modern teams lean on both.
- 2026-05-16 · Reliability — [Incident Metrics Explained: MTTR, MTTD, MTBF and friends](https://watchfor.io/blog/incident-metrics-mttr-mttd-mtbf) — MTTR, MTTD, MTBF, MTTA — the alphabet soup of incident metrics, explained in plain English. What each measures, how to calculate it, and how to actually improve the numbers.
- 2026-05-13 · Networking — [502 Bad Gateway: what it means and how to fix it](https://watchfor.io/blog/502-bad-gateway) — A 502 Bad Gateway means the server in front of your app couldn't get a valid response from the app itself. Here's what's really happening, the usual causes, and how to fix — and prevent — it.
- 2026-05-09 · Networking — [DNS Record Types Explained: A, AAAA, CNAME, MX, TXT and more](https://watchfor.io/blog/dns-record-types-explained) — Setting up a domain means meeting a zoo of record types — A, AAAA, CNAME, MX, TXT, NS. Here's what each one does, when to use it, and the gotchas that trip people up.
- 2026-05-06 · Security — [How HTTPS Works: the TLS handshake, explained simply](https://watchfor.io/blog/how-https-works) — That little padlock does a lot of work. Here's what actually happens when you connect over HTTPS — the TLS handshake, certificates and encryption — without the cryptography headache.
- 2026-05-02 · Networking — [Ping, Traceroute & MTR: network troubleshooting basics](https://watchfor.io/blog/ping-traceroute-mtr) — When something's slow or unreachable, three classic tools tell you whether it's you, the network, or them. Here's how ping, traceroute and MTR work — and when to reach for each.
- 2026-04-29 · Reliability — [Incident Response: a step-by-step playbook](https://watchfor.io/blog/incident-response-playbook) — The alert just fired. Now what? A clear, repeatable incident-response process — from detection to all-clear — so the answer is never 'everyone panic'.
- 2026-04-25 · Email — [Email Authentication Explained: SPF, DKIM & DMARC](https://watchfor.io/blog/spf-dkim-dmarc-explained) — If your emails land in spam — or scammers send mail pretending to be you — these three records are why. Here's what SPF, DKIM and DMARC do, how they work together, and how to set them up right.
- 2026-04-22 · Performance — [Latency & Percentiles: why p99 matters more than the average](https://watchfor.io/blog/latency-percentiles-p99) — Your average response time looks great — so why are users complaining? Because averages lie. Here's why percentiles like p95 and p99 tell the real story of how your service feels.
- 2026-04-18 · Monitoring — [Webhooks 101: what they are and how to use them](https://watchfor.io/blog/webhooks-101) — A webhook is how one app says 'hey, this just happened' to another — instantly, without anyone asking. Here's what webhooks are, how they differ from polling, and how to use them well.
- 2026-04-15 · Networking — [503 Service Unavailable: what it means and how to fix it](https://watchfor.io/blog/503-service-unavailable) — A 503 means your server is alive but can't handle the request right now — usually overload or maintenance. Here's what's happening, how to fix it, and how to keep it from surprising your users.
- 2026-04-11 · Networking — [504 Gateway Timeout: what it means and how to fix it](https://watchfor.io/blog/504-gateway-timeout) — A 504 means a proxy waited for your app to respond — and gave up. It's the signature of something slow, not something dead. Here's how to find the slowness and fix it.
- 2026-04-08 · Performance — [What is a CDN? (And do you actually need one?)](https://watchfor.io/blog/what-is-a-cdn) — A CDN makes your site faster by serving it from locations close to your users. Here's how that works, what you actually gain, and whether your site needs one.
- 2026-04-04 · Networking — [TCP vs UDP: the difference, explained simply](https://watchfor.io/blog/tcp-vs-udp) — Two protocols carry almost everything on the internet. TCP is the careful courier; UDP is the fast one that doesn't look back. Here's how they differ and when each is the right choice.
- 2026-04-01 · Monitoring — [Rate Limiting & HTTP 429 Explained](https://watchfor.io/blog/rate-limiting-explained) — Rate limiting is how services protect themselves from too many requests — and HTTP 429 is how they say 'slow down'. Here's how it works, and how to handle it gracefully on both sides.
- 2026-03-28 · Networking — [IPv4 vs IPv6: what's the difference (and why IPv6 exists)?](https://watchfor.io/blog/ipv4-vs-ipv6) — Every device online needs an address — and we ran out of the old kind. Here's the difference between IPv4 and IPv6, why the switch is happening, and whether you need to care.
- 2026-03-25 · Email — [Email Blacklists (RBLs): why you're blocked and how to get off](https://watchfor.io/blog/email-blacklists-rbl) — If your email suddenly stops arriving, a blacklist may be the culprit. Here's what RBLs are, how you end up on one, and the step-by-step to get off — and stay off.
- 2026-03-21 · Reliability — [Disaster Recovery: RTO vs RPO explained](https://watchfor.io/blog/disaster-recovery-rto-rpo) — When the worst happens, two numbers decide how bad it really is: how much data you lose, and how long you're down. Here's what RTO and RPO mean, and how to set targets you can actually meet.
- 2026-03-18 · Reliability — [What is SRE? Site Reliability Engineering, explained](https://watchfor.io/blog/what-is-sre) — SRE is what you get when you treat reliability as an engineering problem instead of a firefighting one. Here's what Site Reliability Engineering actually means, its core ideas, and how it differs from DevOps.
- 2026-03-14 · Performance — [What is TTFB (Time to First Byte) and how to improve it](https://watchfor.io/blog/ttfb-explained) — TTFB is the first number that tells you whether your backend is fast or slow. Here's what Time to First Byte measures, what's 'good', what makes it bad, and how to bring it down.
- 2026-03-12 · Networking — [404 Not Found: what it means and how to handle it](https://watchfor.io/blog/404-not-found) — 404 is the internet's most famous error — and unlike most, it's often nobody's emergency. Here's what it means, when it's fine, when it isn't, and how to handle it well.
- 2026-03-10 · Networking — [403 Forbidden: causes and how to fix it](https://watchfor.io/blog/403-forbidden) — A 403 means the server understood you perfectly — and is refusing anyway. Here's what causes 'Forbidden', how it differs from 401, and how to track down the fix.
- 2026-03-08 · Networking — [401 vs 403: Unauthorized vs Forbidden](https://watchfor.io/blog/401-vs-403) — 401 and 403 are the two 'you can't have this' codes — and they're constantly confused. Here's the simple rule for telling them apart, with examples.
- 2026-03-06 · Networking — [500 Internal Server Error: what it means and how to fix it](https://watchfor.io/blog/500-internal-server-error) — 500 is the server's way of saying 'something went wrong and I don't know how to explain it.' Here's what causes it, how to find the real error, and how to stop it recurring.
- 2026-03-04 · Networking — [301 vs 302 Redirects: which one should you use?](https://watchfor.io/blog/301-vs-302-redirects) — Both send visitors from one URL to another — but to search engines they mean very different things. Use the wrong one and you can quietly tank your SEO. Here's the difference.
- 2026-03-02 · Monitoring — [CORS Errors Explained (and how to fix them)](https://watchfor.io/blog/cors-errors-explained) — Every web developer meets the dreaded 'blocked by CORS policy' error. It's not a bug — it's a security feature. Here's what CORS is, why the browser blocks your request, and how to fix it properly.
- 2026-02-28 · Performance — [ERR_TOO_MANY_REDIRECTS: causes and how to fix it](https://watchfor.io/blog/too-many-redirects) — When a page keeps redirecting to itself, the browser gives up with 'too many redirects'. Here's why redirect loops happen and the usual culprits behind them.
- 2026-02-26 · Security — [SSL/TLS Handshake Failed: causes and how to fix it](https://watchfor.io/blog/ssl-handshake-failed) — When the secure connection can't be agreed, you get a handshake failure — and the page never loads. Here's what goes wrong during the TLS handshake, and how to fix each cause.
- 2026-02-24 · Security — [Mixed Content Warnings: what they are and how to fix them](https://watchfor.io/blog/mixed-content-warnings) — Your site is on HTTPS, but the padlock has a warning — or images won't load. That's mixed content: a secure page pulling in insecure resources. Here's how to find and fix it.
- 2026-02-22 · Networking — [ERR_CONNECTION_REFUSED: what it means and how to fix it](https://watchfor.io/blog/connection-refused) — Connection refused means you reached the server's door — and it slammed shut. Nothing is listening (or something is blocking). Here's how to track down which.
- 2026-02-20 · Monitoring — [How to Monitor a Website (a step-by-step guide)](https://watchfor.io/blog/how-to-monitor-a-website) — Monitoring your website sounds technical, but the essentials take minutes. Here's a plain, step-by-step guide to going from 'I hope it's up' to 'I'll know the second it isn't'.
- 2026-02-18 · Monitoring — [Server Monitoring Basics: CPU, memory, disk and network](https://watchfor.io/blog/server-monitoring-basics) — Before an app falls over, the server usually shows it coming. Here are the four resources to always watch — and what 'healthy' versus 'about to break' looks like for each.
- 2026-02-16 · Monitoring — [Database Monitoring: what to watch (and why)](https://watchfor.io/blog/database-monitoring) — When the database struggles, everything that depends on it struggles too — usually as timeouts and slow pages. Here's what to monitor so the DB never becomes your silent bottleneck.
- 2026-02-14 · Networking — [What is a Network Port? (and how to monitor one)](https://watchfor.io/blog/what-is-a-network-port) — An IP address gets you to the right machine; a port gets you to the right service on it. Here's what ports are, the common ones, and why monitoring them catches outages a website check misses.
- 2026-02-12 · Monitoring — [Keyword Monitoring: catching the '200 OK but broken' page](https://watchfor.io/blog/keyword-monitoring) — A page can return a perfect 200 OK and still be completely broken. Keyword monitoring checks the actual content — so a blank page, an error, or a defacement doesn't slip past your checks.
- 2026-02-10 · Monitoring — [Monitoring Microservices: seeing health across many moving parts](https://watchfor.io/blog/monitoring-microservices) — Microservices trade one big app for dozens of small ones — and turn one dashboard into a puzzle. Here's how to monitor a distributed system without drowning in noise.
- 2026-02-08 · Monitoring — [Monitoring Kubernetes: from pods to nodes to probes](https://watchfor.io/blog/monitoring-kubernetes) — Kubernetes is brilliant at hiding failures — it restarts and reschedules so smoothly you may not notice trouble until it's everywhere. Here's what to watch so the magic doesn't mask a problem.
- 2026-02-06 · Monitoring — [Monitoring Serverless (Lambda and friends)](https://watchfor.io/blog/monitoring-serverless) — Serverless means no servers to watch — and a few new things that can go wrong. Here's what to monitor when your code runs as functions: cold starts, duration, errors and throttles.
- 2026-02-04 · Monitoring — [How Often Should You Monitor? (choosing a check interval)](https://watchfor.io/blog/monitoring-interval) — Check too rarely and you find out about outages late; check constantly and you pay for it. Here's how to choose a monitoring interval that matches what each service is actually worth.
- 2026-02-02 · Monitoring — [Why Monitor From Multiple Locations?](https://watchfor.io/blog/global-monitoring-locations) — Checking your site from one place gives you one opinion — and it's often wrong. Here's why monitoring from multiple global locations kills false alarms and reveals problems a single check can't see.
- 2026-01-31 · Performance — [How to Speed Up Your Website (the high-impact wins first)](https://watchfor.io/blog/how-to-speed-up-your-website) — Website speed affects conversions, bounce rate and even SEO. The good news: most of the gains come from a short list of fixes. Here they are, roughly in order of impact.
- 2026-01-29 · Performance — [LCP Explained: Largest Contentful Paint (and how to improve it)](https://watchfor.io/blog/lcp-explained) — LCP is the Core Web Vital that answers 'when does the page feel loaded?' Here's exactly what it measures, what counts as good, and the handful of fixes that move it most.
- 2026-01-27 · Performance — [CLS Explained: Cumulative Layout Shift (and how to fix it)](https://watchfor.io/blog/cls-explained) — CLS measures the most annoying thing on the web: the page jumping around as it loads. Here's what it is, what counts as good, and how to stop your layout from dancing.
- 2026-01-25 · Performance — [INP Explained: Interaction to Next Paint (and how to improve it)](https://watchfor.io/blog/inp-explained) — INP is the newest Core Web Vital — it measures how quickly your page responds when people actually interact with it. Here's what it is, what's good, and how to make your site feel snappy.
- 2026-01-23 · Performance — [Lighthouse Explained: how to read the score](https://watchfor.io/blog/lighthouse-explained) — Lighthouse gives your page a 0–100 score across performance, accessibility, SEO and more. Here's what it actually measures, how to read it, and the trap of chasing a perfect 100.
- 2026-01-21 · Performance — [Image Optimization for the Web (the biggest easy win)](https://watchfor.io/blog/image-optimization) — Images are usually the heaviest thing on a page — and the easiest to fix. Here's how to make them load fast without looking worse: compress, resize, modern formats, and lazy loading.
- 2026-01-19 · Performance — [Caching Explained: browser, CDN and server caches](https://watchfor.io/blog/caching-explained) — Caching is the closest thing the web has to free speed: store a result once, reuse it many times. Here are the three layers of caching, how each works, and the one hard part — invalidation.
- 2026-01-17 · Networking — [HTTP/2 vs HTTP/3: what actually changed](https://watchfor.io/blog/http2-vs-http3) — HTTP keeps getting faster. HTTP/2 fixed how requests share a connection; HTTP/3 changed the connection itself. Here's what's different, in plain terms, and whether you should care.
- 2026-01-15 · Performance — [Gzip vs Brotli: web compression compared](https://watchfor.io/blog/gzip-vs-brotli) — Text compression shrinks your HTML, CSS and JS before they travel — for free speed. Here's how gzip and Brotli compare, and which to use where.
- 2026-01-13 · Performance — [Web Font Performance: fast text without the flash](https://watchfor.io/blog/web-font-performance) — Custom fonts make a site look great — and can quietly slow it down or make text vanish during load. Here's how to keep your typography both beautiful and fast.
- 2026-01-11 · Networking — [What is Latency? (and how to reduce it)](https://watchfor.io/blog/what-is-latency) — Latency is the delay between asking for something and getting it — and it shapes how fast everything online feels. Here's what it is, what causes it, and the practical ways to cut it.
- 2026-01-09 · Networking — [Bandwidth vs Latency: what's the difference?](https://watchfor.io/blog/bandwidth-vs-latency) — “I have fast internet, so why is this slow?” Because speed has two dimensions — bandwidth and latency — and they're not the same thing. Here's the difference, with a simple analogy.
- 2026-01-07 · Networking — [What is Packet Loss? (causes, effects and fixes)](https://watchfor.io/blog/what-is-packet-loss) — When data packets vanish in transit, calls stutter, games rubber-band and pages crawl — even on a 'fast' connection. Here's what packet loss is, what causes it, and how to track it down.
- 2026-01-05 · Networking — [Anycast Explained: one IP, served from everywhere](https://watchfor.io/blog/anycast-explained) — Anycast is the clever routing trick behind fast CDNs and resilient DNS: one IP address answered by the nearest of many servers. Here's how it works and why it matters.
- 2026-01-03 · Networking — [What is BGP? (and why it can break the whole internet)](https://watchfor.io/blog/what-is-bgp) — BGP is the protocol that decides how traffic travels between the world's networks — the internet's routing map. When it goes wrong, large chunks of the internet go dark. Here's how it works.
- 2026-01-01 · Networking — [What is a Reverse Proxy?](https://watchfor.io/blog/reverse-proxy-explained) — A reverse proxy is the front door to your servers — handling traffic before it ever reaches your app. Here's what it does, why nearly every serious site uses one, and how it differs from a forward proxy.
- 2025-12-30 · Networking — [Load Balancing Explained](https://watchfor.io/blog/load-balancing-explained) — A load balancer spreads traffic across many servers so no single one gets overwhelmed — and quietly routes around the ones that fail. Here's how it works and why it's the backbone of scalable, reliable sites.
- 2025-12-28 · Security — [What is a Firewall?](https://watchfor.io/blog/what-is-a-firewall) — A firewall is the gatekeeper that decides which network traffic gets through and which gets blocked. Here's what firewalls do, the main types, and the gotcha they create for monitoring.
- 2025-12-26 · Networking — [What is an IP Address?](https://watchfor.io/blog/what-is-an-ip-address) — An IP address is how one machine on the internet finds another — the postal address of the digital world. Here's what it is, the difference between public and private, and the two versions in use.
- 2025-12-24 · Networking — [What is NAT? (Network Address Translation, explained)](https://watchfor.io/blog/nat-explained) — NAT is the quiet trick that lets all your home and office devices share a single public IP address. Here's how it works, why it exists, and the headaches it sometimes causes.
- 2025-12-22 · Security — [TLS 1.2 vs 1.3: what changed (and why it matters)](https://watchfor.io/blog/tls-1-2-vs-1-3) — TLS 1.3 made HTTPS both faster and more secure than 1.2 — by doing less, not more. Here's what changed in the handshake, why it matters, and what to make sure your servers support.
- 2025-12-20 · Security — [HSTS Explained: forcing browsers to always use HTTPS](https://watchfor.io/blog/hsts-explained) — You redirect HTTP to HTTPS — but that first insecure request is still a risk. HSTS closes that gap by telling browsers to never even try HTTP. Here's how it works and how to deploy it safely.
- 2025-12-18 · Security — [What is a DDoS Attack? (and how to defend against one)](https://watchfor.io/blog/what-is-a-ddos-attack) — A DDoS attack drowns your service in traffic from thousands of sources until it buckles. Here's how these attacks work, the main types, and the practical layers of defence.
- 2025-12-16 · Security — [What is a WAF (Web Application Firewall)?](https://watchfor.io/blog/waf-explained) — A regular firewall guards the network; a WAF guards your application — inspecting web requests and blocking attacks like injection and bots. Here's how it works and what it does (and doesn't) cover.
- 2025-12-14 · Security — [Zero Trust Explained](https://watchfor.io/blog/zero-trust-explained) — The old security model trusted anyone inside the network. Zero Trust throws that out: trust nothing, verify everything, every time. Here's what it means in practice.
- 2025-12-12 · Security — [What is a CVE? Vulnerability basics](https://watchfor.io/blog/what-is-a-cve) — When a security flaw is found in software, it gets a CVE — a global ID so everyone can track and fix it. Here's what CVEs are, how severity is scored, and how to stay on top of them.
- 2025-12-10 · Security — [Secrets Management Explained](https://watchfor.io/blog/secrets-management) — API keys, passwords and tokens are the keys to your kingdom — and they end up hard-coded, committed to git, and shared in chat far too often. Here's how to handle secrets properly.
- 2025-12-08 · Security — [What is mTLS (Mutual TLS)?](https://watchfor.io/blog/mtls-explained) — Normal HTTPS proves the server's identity to you. mTLS goes both ways — the client proves itself too. Here's what mutual TLS is, where it's used, and why it's a Zero Trust building block.
- 2025-12-06 · Security — [Domain Spoofing and How to Prevent It](https://watchfor.io/blog/domain-spoofing) — Scammers can send email that looks exactly like it's from your domain — phishing your customers and torching your reputation. Here's how domain spoofing works and how to lock it down.
- 2025-12-04 · Security — [DNSSEC Explained: signing DNS so it can't be faked](https://watchfor.io/blog/dnssec-explained) — DNS was built without security — answers can be forged, sending users to fake servers. DNSSEC adds cryptographic signatures so resolvers can verify DNS answers are genuine. Here's how.
- 2025-12-02 · Email — [Why Your Emails Go to Spam (and how to fix it)](https://watchfor.io/blog/why-emails-go-to-spam) — Your perfectly legitimate emails keep landing in junk — and you have no idea why. Here's how spam filters actually decide, and the practical checklist to get back in the inbox.
- 2025-11-30 · Email — [How to Set Up DMARC (step by step)](https://watchfor.io/blog/dmarc-setup-guide) — DMARC is what actually stops scammers spoofing your domain — but rushing it can block your own email. Here's the safe, staged way to roll it out from monitoring to full enforcement.
- 2025-11-28 · Email — [Email Bounces: Hard vs Soft (and what to do about each)](https://watchfor.io/blog/email-bounce-types) — When an email can't be delivered, it 'bounces' — but not all bounces are equal. Here's the difference between hard and soft bounces, and why handling them right protects your deliverability.
- 2025-11-26 · Email — [BIMI Explained: your logo in the inbox](https://watchfor.io/blog/bimi-explained) — BIMI puts your brand's verified logo next to your emails in supporting inboxes — a trust signal and an anti-spoofing reward. Here's what it is, what it requires, and whether it's worth it.
- 2025-11-24 · Reliability — [Error Budgets Explained](https://watchfor.io/blog/error-budgets-explained) — An error budget turns the endless 'ship fast vs stay stable' fight into a single number both sides can see. Here's what it is, how to calculate it, and how it changes the way teams work.
- 2025-11-22 · Reliability — [Chaos Engineering Explained](https://watchfor.io/blog/chaos-engineering) — Chaos engineering means deliberately breaking your own systems — in a controlled way — to find weaknesses before real failures do. Here's the idea, the method, and why it makes you more resilient.
- 2025-11-20 · Reliability — [Incident Severity Levels (SEV1–SEV4) Explained](https://watchfor.io/blog/incident-severity-levels) — Not every incident deserves the same response. Severity levels — SEV1 to SEV4 — give your team a shared language for 'how bad is this?' so the response always matches the reality.
- 2025-11-18 · Reliability — [How to Write a Good Runbook](https://watchfor.io/blog/runbooks-guide) — A runbook turns 3am panic into a calm checklist. Here's what makes a runbook actually useful when an alert fires — and the mistakes that make them worthless.
- 2025-11-16 · Reliability — [Capacity Planning Basics](https://watchfor.io/blog/capacity-planning) — Run out of capacity at the wrong moment and your big day becomes an outage. Capacity planning is how you have the headroom before you need it. Here's the simple version.
- 2025-11-14 · Reliability — [High Availability Explained](https://watchfor.io/blog/high-availability) — High availability means designing so that one failure isn't an outage. Here's what HA actually means, the building blocks (redundancy, failover, no single point of failure), and how far to take it.
- 2025-11-12 · DevOps — [Feature Flags Explained](https://watchfor.io/blog/feature-flags-explained) — Feature flags let you turn functionality on and off at runtime — shipping code safely, releasing gradually, and rolling back instantly without a deploy. Here's how they work and why teams love them.
- 2025-11-10 · DevOps — [Canary vs Blue-Green Deployments](https://watchfor.io/blog/canary-vs-blue-green) — Two popular strategies for shipping without downtime — and without betting the whole site on a release working. Here's how canary and blue-green deployments differ, and when to use each.
- 2025-11-08 · DevOps — [CI/CD Explained](https://watchfor.io/blog/ci-cd-explained) — CI/CD is the automated pipeline that takes your code from commit to production — testing it, building it, and shipping it without manual drudgery. Here's what the letters mean and why it matters.
- 2025-11-06 · DevOps — [Infrastructure as Code Explained](https://watchfor.io/blog/infrastructure-as-code) — Infrastructure as Code means defining your servers and cloud resources in version-controlled files instead of clicking through dashboards. Here's what it is and why it transforms reliability.
- 2025-11-02 · Monitoring — [How to Choose a Monitoring Tool](https://watchfor.io/blog/monitoring-tools-how-to-choose) — There are dozens of monitoring tools, and the marketing all sounds the same. Here's a practical, vendor-neutral checklist of what actually matters — so you pick the one that fits your needs.