--- title: Blog — page 2 of 9 description: Practical guides on monitoring, reliability, and performance — plus product news and lessons from the WatchFor team. canonical: https://watchfor.io/blog/page/2 --- # What we watch for — page 2 Practical guides on monitoring, reliability, and performance — plus product news and lessons from keeping our own systems online. [All](/blog)[Monitoring](/blog/category/monitoring)[Networking](/blog/category/networking)[Performance](/blog/category/performance)[Security](/blog/category/security)[Reliability](/blog/category/reliability)[Email](/blog/category/email)[DevOps](/blog/category/devops)[Engineering](/blog/category/engineering)[Guides](/blog/category/guides) [All articles](/blog/all) 229 posts · 167 article s · [62 tool guides](/blog/category/guides) · page 2 of 9 [EmailOct 05, 2026 ## IMAP and POP3 monitoring: how to know when a mailbox stops working A mailbox can stop working while the mail server looks perfectly healthy: the password was rotated, the certificate expired on port 993, or the form that should email you every day quietly stopped. IMAP and POP3 monitoring logs in the way a mail client does and tells you which one it is. Here's what to check, what the results look like and how to test it yourself with openssl.WatchFor Team6 min read](/blog/imap-pop3-monitoring)[EmailOct 05, 2026 ## SMTP monitoring: is your mail server still accepting and sending mail? Your shop's order confirmations, password resets and invoices all leave through one SMTP login. When that login breaks, nothing errors on your website: the emails just don't go out. SMTP monitoring checks both halves of a mail server, the inbound side on port 25 and the sending login on 587 or 465. Here's what each one tells you, which port is which, and how to test it with openssl.WatchFor Team5 min read](/blog/smtp-monitoring-explained)[NetworkingOct 03, 2026 ## 47-day SSL certificates: what breaks and how to stay ahead Public TLS certificates already max out at 200 days, drop to 100 in March 2027 and to 47 in March 2029, and proof of domain control will be reusable for only 10 days. Here is the exact CA/Browser Forum schedule, the setups that will break first, and a checklist for automating renewal and checking what your servers actually serve.WatchFor Team12 min read](/blog/47-day-ssl-certificates)[ReliabilityOct 03, 2026 ## PagerDuty alternatives: the best on-call scheduling tools in 2026 Opsgenie stops working on 5 April 2027 and the open-source Grafana OnCall is archived, so a lot of teams are choosing an on-call tool this year. Here is what PagerDuty actually costs now, seven alternatives with prices checked on 3 October 2026, and the one question that decides most of it: where do your alerts come from?WatchFor Team7 min read](/blog/best-pagerduty-alternatives)[DevOpsOct 03, 2026 ## The best server monitoring tools in 2026, sorted by how many servers you have Server monitoring tools are not competing for the same job. A per-second dashboard for one box, a Prometheus stack you run yourself, a Zabbix install for a data centre and a per-host SaaS bill are four different decisions. Here is how to pick, with prices checked on 3 October 2026 and an honest note on where each one loses.WatchFor Team9 min read](/blog/best-server-monitoring-tools)[MonitoringOct 03, 2026 ## The best synthetic monitoring tools in 2026 for browser and Playwright checks Your homepage returns 200 while nobody can sign in. Catching that takes a browser that walks the journey on a schedule. Here are eight synthetic monitoring tools sorted by how you want to write the check (Playwright code, a vendor's script dialect or a recorder), what one journey costs a month on each, and where each one loses. Prices checked on 3 October 2026.WatchFor Team8 min read](/blog/best-synthetic-monitoring-tools)[MonitoringOct 03, 2026 ## Command palette and keyboard shortcuts: run your monitoring from the keyboard You have 200 monitors and you need the checkout one. Scrolling a list is slow, and the filter is three clicks away. Press ⌘K, type chec, press Enter. Here is everything the WatchFor dashboard does from the keyboard: the command palette, the g and c chords, the Inbox keys, and an incident handled almost without the mouse.WatchFor Team6 min read](/blog/command-palette-keyboard-shortcuts)[EngineeringOct 03, 2026 ## How we confirm an outage before paging anyone A single failed check is a rumour, not an outage. Here's the pipeline that decides which is which: rotating locations, accelerated re-checks driven back into the scheduler, a severity cascade, and an alert manager that deduplicates, silences, inhibits, groups and escalates. Real defaults from the code, and the honest cost: about a minute of extra latency, and blind spots we chose to keep.WatchFor Team13 min read](/blog/confirm-outage-before-paging)[SecurityOct 03, 2026 ## How to detect DNS hijacking before your customers do A hijacked DNS record doesn't take your site down. It sends your users somewhere else, often behind a valid padlock. Four real incidents, the records worth watching, how to lock down your registrar, and how to get an alert the moment an answer stops matching what you expect.WatchFor Team12 min read](/blog/detect-dns-hijacking)[ReliabilityOct 03, 2026 ## Incident status update templates: copy-paste wording for every stage Nobody writes well at 3 a.m. with checkout down. Here are status page updates you can copy and fill in for every stage of an incident (investigating, identified, monitoring, resolved), plus scheduled maintenance, partial outages, a provider's outage, a security incident and the follow-up, each with when to use it and the mistakes that cost you trust.WatchFor Team13 min read](/blog/incident-status-update-templates)[SecurityOct 03, 2026 ## Magecart and injected scripts: how to catch a tampered page A skimmer doesn't break your checkout. It copies every card number typed into it and lets the payment go through, which is why the people who notice are usually a bank, a researcher or a stranger on social media. What happened at British Airways, Ticketmaster and polyfill.io, how the code gets in, what PCI DSS 4.0 now requires, and how to detect a tampered page yourself.WatchFor Team13 min read](/blog/magecart-injected-scripts)[MonitoringOct 03, 2026 ## Monitor a checkout flow with Playwright, step by step Your checkout page can return 200 while nobody can buy anything. Here's a Playwright test that signs in, adds a product, checks out with test data and asserts the order confirmation, why each line is written the way it is, how to avoid real orders and leaked passwords, and how to run it every few minutes from more than one place.WatchFor Team12 min read](/blog/monitor-checkout-flow-with-playwright)[MonitoringOct 03, 2026 ## Monitoring 100 client websites: a setup for agencies One client site is a monitor. A hundred is a system: names and tags you can search, the same checks on every site, alerts that reach the right people, maintenance that doesn't page you, a status page per client and a number for the monthly report. Here's a setup that scales, what it costs in monitor slots, and the parts WatchFor doesn't do for agencies yet.WatchFor Team13 min read](/blog/monitoring-client-websites-for-agencies)[SecurityOct 03, 2026 ## Security headers checklist (and how to keep them from silently disappearing) Seven response headers, the values worth sending, copy-paste config for nginx, Caddy, Cloudflare and Vercel/Next.js, the headers to stop sending, and the boring ways they vanish after you set them: a new location block, a 404 page, a redirect, a CDN migration. Plus how to notice the day one goes missing.WatchFor Team14 min read](/blog/security-headers-checklist)[MonitoringOct 02, 2026 ## Uptime monitoring in Grafana: scrape WatchFor with Prometheus Your Grafana already shows CPU, queues and error rates. What it usually can't show is whether a customer in another country can reach you right now. Here's how to put WatchFor's outside view (confirmed status, incident-based uptime, certificate and domain expiry, heartbeats) into your own Prometheus: the five-line scrape config, the PromQL worth keeping, alert rules that don't double-page, the dashboard, and when the open-source exporter is the better fit.WatchFor Team9 min read](/blog/prometheus-grafana-uptime-monitoring)[MonitoringSep 29, 2026 ## How to monitor a login with 2FA (TOTP) in Playwright Your login is the one page every customer must get through, and two-factor authentication is the part a monitor usually skips. It doesn't have to: a TOTP code is just arithmetic on a shared secret and the clock. Here's a Playwright test that signs in with a real one-time code, the three ways it goes wrong, and how to run it every few minutes without leaking the secret.WatchFor Team5 min read](/blog/monitor-a-2fa-login-with-playwright)[EngineeringSep 11, 2026 ## 100/100 on ora.ai: what the last six points cost On 10 September 2026 ora.ai scored watchfor.io 100/100 for agent-readiness and listed it first among the 90,000-odd domains it has scanned. We are proud of that. This is the honest version: what the last six points took, why we sit in the Community category, and what a 100 does not mean.WatchFor Team4 min read](/blog/100-on-ora-ai)[MonitoringSep 11, 2026 ## The best API monitoring tools in 2026 An API that returns 200 with the wrong body passes every uptime check ever written. The tools worth paying for are the ones that assert on what came back — and they split cleanly into two camps depending on whether you want checks in a repository or not.WatchFor Team4 min read](/blog/best-api-monitoring-tools)[MonitoringSep 11, 2026 ## The best cron job monitoring tools in 2026 A cron job that stops running produces no error, no alert and no log line — it produces silence, which looks exactly like success. Here are the tools that notice, what each one actually measures, and how to pick between a heartbeat and full job telemetry.WatchFor Team5 min read](/blog/best-cron-job-monitoring-tools)[MonitoringSep 11, 2026 ## The best DNS monitoring tools in 2026 Most tools that claim DNS monitoring resolve a name and check it answered. That catches an outage and misses everything that actually goes wrong with DNS — a record edited by the wrong person, propagation that stalled in one region, a nameserver that disagrees with its siblings.WatchFor Team4 min read](/blog/best-dns-monitoring-tools) --- Canonical page: https://watchfor.io/blog/page/2 · Site guide: https://watchfor.io/llms.txt