---
title: Domain, certificate, breach and blocklist incidents close on the first healthy check
description: A domain-expiry incident needed three healthy checks in a row to close, and with one check a day that kept it open for three days after you renewed or…
canonical: https://watchfor.io/changelog/2026-10-22-single-check-recovery
---

[All updates](/changelog#2026-10-22-single-check-recovery) 🐛 Fixed Oct 22, 2026 · v 12.0.3

# Domain, certificate, breach and blocklist incidents close on the first healthy check

A domain-expiry incident needed three healthy checks in a row to close, and with one check a day that kept it open for three days after you renewed or loosened the rule. The page only said "Threshold: 3". Domain expiry, SSL certificate, breach and blocklist monitors now close on one healthy check, since their answer doesn't flap. Open incidents show where recovery stands, like "Recovering 1/3 · next check in ~23 h".

## What changed

- One healthy check closes an incident on domain expiry, SSL certificate, breach and blocklist monitors, for new and existing rules. Other types keep their numbers: three in a row for most, see [Resolving incidents](/docs/alerting/resolving#automatic-resolution-recovery).

- Recovery you can see : the incident page shows Recovering 1/3 beside the severity and as the last row of the timeline, or Still failing , with when the next check is due and roughly when the incident resolves if the checks stay healthy. The timeline also says how many failed checks opened the incident and how many healthy checks close it.

- The monitor's Uptime card adds the next check to recovering 1/3 , and the Alerting tab says how an incident of that type closes.

- Domain-expiry, breach and blocklist monitors now show Recovering n/m in the monitor list and header too.

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-10-22-single-check-recovery · Site guide: https://watchfor.io/llms.txt