---
title: X
description: An incident that just says "503" at 3 a.m. still leaves the diagnosis to you. Every incident now opens with a plain-language summary of what visitors…
canonical: https://watchfor.io/changelog/2026-07-24-incident-explanations
---

[All updates](/changelog/page/8#2026-07-24-incident-explanations) ⚡ Improved Jul 24, 2026 · v 4.5.2

# Incidents now explain themselves

An incident that just says "503" at 3 a.m. still leaves the diagnosis to you. Every incident now opens with a plain-language summary of what visitors experienced and whose side the problem is on, backed by expert explanations for hundreds of HTTP statuses, network and TLS failures. Copy-paste diagnostic commands come with your real host already filled in, and one-click links re-check the target with our free tools.

The incident opens with what visitors saw and where the problem is.

Likely causes, commands with your host filled in, and one-click re-checks.

## What an incident page shows

- What happened : one plain sentence anyone on the team can read. It says what visitors experienced and whose side the problem is on: your server, DNS, a certificate, an access rule, or the network in between.

- Expected and detected : what the rule required next to what the check measured.

- Why this happens : what that status code or error usually means, and its most common causes, most likely first.

- Quick diagnostics : commands such as curl -I , dig , openssl s_client and mtr , with your real host already filled in. Click one to copy it.

- Free tool links that run the same check again from a browser.

The explanations cover hundreds of HTTP statuses and network and TLS errors. They are written by people, show up instantly, and read the same every time.

## Example

At 03:10 your API monitor opens an incident: 403 from every location that checked. The page starts with "Visitors were blocked or asked to authenticate instead of seeing the page", which points at access rules rather than a crash. Under Why this happens , the first cause is a firewall or bot-protection rule blocking the monitoring requests. You check the WAF, find a rule added yesterday, and [allowlist the monitoring addresses](/ip-ranges). No guessing at 3 a.m.

## Where to find it

Open any incident from Incidents . [Root cause analysis](/docs/alerting/root-cause) explains each part of the page.

Since then, every alert type has its own explanation and diagnostics, including heartbeat, MCP and API assertion incidents. See [the September update](/changelog/2026-09-04-readable-incident-descriptions).

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-07-24-incident-explanations · Site guide: https://watchfor.io/llms.txt