---
title: FAQ
description: Answers to common questions about WatchFor — monitoring, alerts and incidents, status pages, the API and MCP server, plans, billing and data.
canonical: https://watchfor.io/faq
---

# Frequently asked questions

## Getting started

### What is WatchFor?

WatchFor is modern uptime and infrastructure monitoring for humans and AI agents. It watches websites, APIs, MCP servers, DNS, certificates, mail servers, cron jobs and Core Web Vitals from 20 locations across 7 world regions — and, with the open-source watchfor-agent, the servers themselves: CPU, memory, disk, network and processes. It confirms real failures before it pages anyone and hands you the root cause, then handles what comes next: incidents, on-call, post-mortems, reports and public status pages. Everything in the dashboard is also available to AI agents through the REST API, MCP server and A2A. It starts with one URL on a free plan and scales to millions of endpoints.

[Read the docs](https://watchfor.io/docs) · [See pricing](https://watchfor.io/pricing)

### What can I monitor?

30 check types: websites (HTTP/HTTPS), APIs (with JSON assertions & response validation), Playwright browser checks (scripted journeys such as sign-in, search and checkout), DNS, TCP and UDP ports, ping (ICMP), SSL/TLS certificates and configuration grade, domain expiry, mail servers (SMTP, IMAP and POP3), email round-trip delivery and email policy (SPF, DMARC, DKIM), the full network path (MTR/traceroute), Core Web Vitals, cron jobs and heartbeats, MCP servers, page integrity (defacement and injected scripts), CDN, compression, sitemaps, WebSockets, NTP, FTP/SFTP, data-breach and blacklist checks, and more. Plus your own servers from the inside with the open-source watchfor-agent (Starter plan and up).

[All monitor types](https://watchfor.io/monitoring) · [Server monitoring](https://watchfor.io/server-monitoring)

### How is the API monitor different from an HTTP check?

The API monitor validates the response, not just that it answered. It asserts on the response content — JSON body fields (via JSONPath), headers and body text — and extracts numbers from the JSON (like queue depth or active users) into metrics you can chart over time, each on its own scale, and alert on. You build it live with Run & inspect: fire the request once from a real probe and click any field to extract or assert on it, no typing JSONPaths. Status code (via a 2xx/3xx picker), response time and SSL are alert rules, so a wrong status, a failed assertion and a real outage each raise the right incident. It's a full HTTP monitor underneath (SSL expiry, timing breakdown, redirects, HTTP/3, basic/digest/bearer auth). Use the HTTP monitor for simple 'is it up'; use the API monitor when the response contents matter.

[API monitoring](https://watchfor.io/api-monitoring)

### Can WatchFor run my Playwright tests as monitors?

Yes — that is the browser check. You paste or import a Playwright Test file (TypeScript or JavaScript, including npx playwright codegen output or a Chrome DevTools Recorder export, which becomes editable Playwright code), run it once from the editor, and it then runs on your schedule in a real Chromium on the pinned Playwright runtime, with the same file still running on your laptop. Each run shows every test.step with its duration and screenshot, console errors, failed requests and Web Vitals, and failed runs keep a Playwright trace you open in WatchFor's own trace viewer. A failed test is retried once in a fresh browser and a failing run is confirmed by a second run about a minute later before an incident opens; neither counts against your plan. Passwords and TOTP secrets are stored as encrypted secrets, read as process.env, and masked in logs, errors, step titles, traces and screenshots of every run. Runs are sandboxed and reach the public internet only. The Free plan includes one browser check running hourly.

[Playwright browser checks](https://watchfor.io/playwright-monitoring) · [Browser check docs](https://watchfor.io/docs/monitors/browser-checks)

### Can WatchFor monitor MCP servers?

Yes. The MCP monitor runs a real Model Context Protocol session on every check — the initialize handshake and a full tools/list walk — instead of just asking whether the port answers. It fingerprints the whole tool inventory (names, descriptions and input schemas) and alerts with the exact diff when anything changes, which is how a “rug-pull” prompt-injection or a tool that silently vanished after a deploy gets caught. Checks are read-only (tools are never called), bearer tokens and custom headers are supported, and an MCP monitor counts as one regular monitor on every plan, including Free. There is also a free, no-signup MCP server checker.

[MCP server monitoring](https://watchfor.io/mcp-monitoring) · [MCP monitor docs](https://watchfor.io/docs/monitors/mcp)

### How do I get started?

Sign up, create a monitor (an HTTP check on your website is a great first one), choose how often to check it, and turn on an alert. It takes a couple of minutes, and WatchFor starts checking within about a minute. Already monitoring elsewhere? Import your monitors instead of re-creating them.

[Quick start guide](https://watchfor.io/docs/quick-start)

### Can I migrate from another monitoring tool?

Yes. Monitors → Import brings your monitors over from UptimeRobot, StatusCake, Pingdom, Checkly, Site24x7 and Instatus, or from a CSV file, with a preview before anything is created (owners and admins). Everything else — alert rules, channels, status pages — can be created in bulk through the REST API, or by an AI agent using the MCP server.

[Monitors guide](https://watchfor.io/docs/monitors) · [REST API](https://watchfor.io/docs/api)

### Do I need to install anything on my servers?

Not for the checks. WatchFor monitors your services from the outside, the same way your users reach them (synthetic monitoring), so nothing is installed or maintained on your side. Server monitoring — CPU, memory, disk, network and processes from inside the machine — is optional and uses the open-source watchfor-agent: one command installs it, it talks to WatchFor over outbound HTTPS only, opens no inbound port and never receives commands, and one command removes it again.

[Server monitoring](https://watchfor.io/server-monitoring) · [The agent](https://watchfor.io/agent)

### Is there a free plan?

Yes — free forever, not a trial, and no credit card. The Free plan includes 15 monitors checked every 3 minutes from one region, one Playwright browser check running hourly, confirmed incidents and alerting to 5 contacts, 3 status pages, 3 team members, and full access to the REST API, MCP server and A2A agent. Every account gets one free organization; extra organizations need their own plan.

[Compare plans](https://watchfor.io/pricing)

## Monitoring

### How often are checks performed?

You choose the interval per monitor. The shortest interval depends on your plan: every 3 minutes on Free, every minute on Starter and Pro, every 30 seconds on Business. A few types run less often by design because their answer changes slowly: SSL monitors at most hourly, domain expiry once a day. When a check fails, WatchFor automatically re-checks faster from other locations to confirm or dismiss the problem, so detection is quicker than the interval alone suggests. You can also run a check on demand at any time with Run check now (once per hour per monitor).

[Compare plans](https://watchfor.io/pricing) · [Locations & scheduling](https://watchfor.io/docs/monitors/scheduling)

### Where does WatchFor check from?

From 20 probe locations across 7 world regions, on several cloud and network providers. You pick the regions for each monitor — 1 on Free, 2 on Starter, 3 on Pro and all 7 on Business — and from Starter you can pin exact cities; on Pro and Business a monitor can also check from all its locations at once instead of rotating through them. WatchFor confirms a failure from several locations before calling it an outage, which is how a local network glitch is told apart from a real one and how a region-only problem shows up as exactly that.

[Infrastructure](https://watchfor.io/infrastructure) · [Probe locations & IP ranges](https://watchfor.io/ip-ranges)

### Can I monitor a service behind a firewall?

If the service is reachable from the internet but restricted, allowlist WatchFor's published probe IP ranges in your firewall so checks aren't blocked. Purely internal services with no public route can't be reached by an external checker — for those, a heartbeat monitor (the job pings us) is the usual answer.

[IP ranges to allowlist](https://watchfor.io/ip-ranges) · [Heartbeat monitoring](https://watchfor.io/docs/monitors/heartbeat)

### My site is behind Cloudflare — will bot protection block the checks?

It can: managed challenges and Bot Fight Mode may serve our probes a JavaScript challenge, which shows up as a slow or failing check even though your site is fine. The fix takes two minutes — add a WAF custom rule that Skips bot protection when the User-Agent contains "WatchForBot", optionally tightened with our published probe IPs. Every probe also has verifiable reverse DNS under *.probe.watchfor.io, so you can confirm a request is genuinely ours. The same approach works on other CDNs and WAFs.

[Cloudflare allowlist guide](https://watchfor.io/docs/reference/probe-locations) · [About WatchForBot](https://watchfor.io/bot)

### How do I know a request really came from WatchFor?

Three ways, from simple to cryptographic. Every check sends the User-Agent “WatchForBot” from fixed IP addresses published at /ips.json. Every IPv4 probe has forward-confirmed reverse DNS under *.probe.watchfor.io. And every HTTP(S) probe request is signed with the fleet's Ed25519 key using RFC 9421 HTTP message signatures (the Web Bot Auth profile), verifiable against the public keys at /.well-known/http-message-signatures-directory — so a spoofed User-Agent can't impersonate us.

[Identify & verify WatchForBot](https://watchfor.io/bot)

### Can I monitor over IPv6?

Yes. All probes but one are dual-stack (IPv4 + IPv6). Checks prefer IPv4 by default; for any type that connects to your target you can switch a monitor to Force IPv6 (or Force IPv4) under Settings → Advanced Options, so a broken AAAA record or an IPv6-only outage shows up instead of hiding behind a working IPv4 path.

[IP version](https://watchfor.io/docs/monitors/scheduling#ip-version)

### What's the difference between “down” and “degraded”?

A failing check shows as Degraded while it is being confirmed — any alert rule counts, so an HTTP 500 or a slow response turns a monitor Degraded within one check. “Down” is reserved for a confirmed incident — a failure verified from several locations — so your dashboard reflects genuine outages instead of momentary blips. A warning-level incident also shows as Degraded; only critical incidents count as down.

[How monitors work](https://watchfor.io/docs/monitors)

### How is uptime calculated?

One formula everywhere — monitor cards, the monitor page and its Uptime SLA tab, the dashboard, reports and the API: uptime = (observed time − time in confirmed critical incidents − scheduled maintenance) ÷ observed time. A single failed check never lowers uptime, a warning incident shows Degraded but doesn't count as downtime, maintenance is neutral, an incident marked as a false positive is left out entirely, and an acknowledged incident keeps counting until it resolves. Check success is shown separately, and it answers a different question: it is the share of checks where our probe reached your service and got a response — a reachability signal, not a health one. A response that then fails a rule (wrong status code, failed assertion, expired certificate) still counts as reached, so a monitor can be down at 100 % check success; read it for flakiness such as timeouts or refused connections from one location. Monitors younger than a day are judged on the time they have existed and say “since created”.

[How uptime is calculated](https://watchfor.io/docs/monitors#how-uptime-is-calculated)

### Can I reset a monitor's statistics?

Yes. Owners and admins can choose Reset history from the monitor's menu: it deletes every check, incident, note and post-mortem the monitor ever recorded and starts uptime over from that moment, while the monitor keeps its id, settings, alert rules, tags, locations and status-page components. It cannot be undone, so the dialog asks you to type the monitor's name.

[Actions on a monitor](https://watchfor.io/docs/monitors#actions-on-a-monitor)

### Can WatchFor watch my cron jobs and scheduled tasks?

Yes — heartbeat monitors work in reverse: your backup, cron job or worker pings a unique URL when it runs, and WatchFor alerts you when the ping doesn't arrive on time. You can expect pings on an interval or a cron schedule (with a grace period), jobs can report their exit code so a failed run alerts differently from a missing one, and the ping URLs are compatible with Healthchecks-style clients.

[Heartbeat & cron job monitoring](https://watchfor.io/docs/monitors/heartbeat)

### Can WatchFor detect website defacement or injected scripts?

Yes — that is the page integrity monitor. It compares your key pages (home, login, checkout, pricing — up to 50 per monitor) with a baseline you accept, and alerts on what tampering actually looks like today: a script from a new source, a vendor script that now serves different code, a form that sends data to another site, a redirect, a removed or weakened security header, tamper words such as “hacked by”, new spam links, or visible text that changed more than the sensitivity you chose. Your own site's scripts never count as a new source, so a deploy doesn't page you, and one API call from your deploy pipeline checks the pages and accepts that check as the new baseline. Accepting a change you meant to make resolves its incident at once, unless another page still differs. Browser mode renders each page in a real browser to catch scripts injected after load and new data destinations, and keeps screenshots of the baseline and of any check that differs. Available from the Starter plan; browser mode from Pro.

[Page integrity monitoring](https://watchfor.io/page-integrity-monitoring) · [Page integrity docs](https://watchfor.io/docs/monitors/integrity)

### Can WatchFor monitor mailboxes and email delivery?

Yes, on the Pro and Business plans. The IMAP and POP3 monitors log in to a mailbox on every check and report TLS, the certificate, the login, message counts and how old the newest message is, so you hear when a login breaks or mail stops arriving; IMAP also shows how full the mailbox is against its quota and warns at 90 % and 99 %, before new mail starts bouncing (POP3 reports the mailbox size); the mailbox is opened read-only and no subject, sender or body is read. The SMTP monitor can also log in on 587 or 465 to check that authenticated sending works (never on port 25). The email round-trip monitor goes end to end: at most every 5 minutes it sends a fixed test message through your SMTP server, finds it over IMAP or POP3, and reports the delivery time, Inbox or Spam, the SPF, DKIM and DMARC verdict the receiving server gave and every relay hop, then deletes it. Mailbox passwords are encrypted at rest and never shown again. Gmail needs an app password; Microsoft 365 has turned off password logins for IMAP and POP3, and OAuth sign-in isn't supported yet.

[IMAP monitoring](https://watchfor.io/imap-monitoring) · [POP3 monitoring](https://watchfor.io/pop3-monitoring) · [Email round-trip monitoring](https://watchfor.io/email-round-trip-monitoring)

### How do I check how secure my mail server is?

Run the free Mail Server Checker on your domain. It finds your inbound MX, SMTP submission, IMAP and POP3 servers and grades each one from A+ to F: TLS versions and ciphers, the certificate, whether STARTTLS is offered, whether a password is accepted before encryption, whether port 25 relays mail for strangers, reverse DNS, MTA-STS, TLS-RPT and DANE. It runs from three regions, never logs in and never sends a message, and every problem comes with the fix. The IMAP, POP3 and SMTP monitors then keep watching the same servers.

[Free mail server checker](https://watchfor.io/mail-server-checker) · [IMAP monitor grade](https://watchfor.io/docs/monitors/imap#mail-server-grade)

### Can I monitor page speed and Core Web Vitals?

Yes. The Core Web Vitals monitor loads your page in a real browser and runs a full Lighthouse audit — LCP, CLS, TBT, the performance, accessibility, SEO and best-practices scores — on a desktop or mobile profile, keeps a screenshot, filmstrip and the full HTML report as evidence, and alerts you when a metric enters the “poor” band or a score drops below your threshold.

[Performance monitoring](https://watchfor.io/docs/monitors/performance)

### Do you check TLS configuration quality, not just certificate expiry?

Yes. Besides expiry and chain validation, the SSL monitor grades your TLS setup from A+ to F — protocols, ciphers, forward secrecy, certificate strength — once a day, and you can alert when the grade drops below the letter you choose. The grade also refreshes whenever you press Check now, so you see the effect of a config change immediately. Grading is included from the Starter plan and is on by default there. There's a free, no-signup SSL/TLS grade checker as well.

[TLS grade](https://watchfor.io/docs/monitors/certificates#tls-grade) · [Free SSL/TLS grade checker](https://watchfor.io/ssl-grade-checker)

### How many monitors can I create?

15 on Free, 50 on Starter, 100 on Pro and 250 on Business; larger fleets are handled on Enterprise terms. Organize monitors with tags, manage them in bulk, and WatchFor warns you before you reach a limit. Any monitor type counts as one monitor — there is no surcharge for MCP, browser or API checks.

[Plans & limits](https://watchfor.io/pricing)

### Can I pause a monitor, or only silence its alerts?

Both. Pause stops the checks: it clears the failure counters, the monitor shows Unknown until the first check after you resume, and if an incident is open WatchFor asks you to confirm because pausing resolves it. Mute keeps the checks and the incident running and only silences notifications, for 1 hour, 8 hours, 24 hours or 7 days. For planned work with a known start and end, use a maintenance window instead: the checks keep running and the time is left out of your uptime.

[Actions on a monitor](https://watchfor.io/docs/monitors#actions-on-a-monitor) · [Maintenance windows](https://watchfor.io/docs/monitors/maintenance)

### A monitor shows “down” but the site looks fine — what should I check?

Usually it's something between us and your origin: a firewall or rate-limiter blocking our probe IPs, aggressive bot protection, geo-blocking, or a cache serving a stale page. Open the incident — its root-cause section shows the exact failing condition and the locations that confirmed it. Allowlist our published IP ranges, and use the no-cache preset to test the origin directly.

[Probe IP ranges](https://watchfor.io/ip-ranges)

### Can I bypass a cache or CDN to test my origin?

Yes. A one-click “no-cache headers” preset on HTTP monitors adds headers that bypass caches and CDNs, so you're testing your actual origin rather than a cached copy.

[Web monitoring](https://watchfor.io/docs/monitors/web)

### Can I catch a page that returns 200 OK but is broken?

Yes. A body-match rule on an HTTP monitor requires that the page contains expected text — or doesn't contain something it shouldn't, like an error message — using exact text, wildcards or a regular expression. A missing keyword opens its own incident even when the status code looks healthy. For JSON endpoints, the API monitor asserts on individual fields instead.

[Web monitoring](https://watchfor.io/docs/monitors/web)

## Servers & hosts

### Can WatchFor monitor my servers (CPU, memory, disk)?

Yes. Install the open-source watchfor-agent on a Linux server and it reports CPU (user, system, I/O wait, steal), load, memory and swap, disk usage and I/O per filesystem and disk, network traffic per interface, process counts, the busiest processes and any processes you name — plus uptime, hardware and cloud facts. Each host gets its own page with live cards and charts. Alert rules for a silent agent, a disk almost full and memory pressure are on from the start; high CPU, load, I/O wait, swap, inodes, reboots and watched processes are one switch away. Available on Starter and up.

[Server monitoring](https://watchfor.io/server-monitoring) · [Hosts docs](https://watchfor.io/docs/hosts)

### Which Linux distributions and architectures does the agent support?

Any Linux distribution that runs systemd, on amd64 or arm64. The agent is a single static Go binary, so there is nothing else to install. Hosts that must not run a daemon can run `watchfor-agent once` from cron instead: it collects, pushes one batch and exits. Windows is planned; macOS is not.

[The agent](https://watchfor.io/agent) · [Hosts docs](https://watchfor.io/docs/hosts)

### Is the agent safe to run on a production server?

It is built to be. The agent is open source (Apache-2.0), so you can read exactly what it does, and `watchfor-agent check` prints the batch it would send without sending it. It runs as its own unprivileged user under a hardened systemd unit, reads only /proc and /sys, talks to WatchFor over outbound HTTPS and never receives commands — the traffic is one way, out. Releases are signed and reproducible, with build provenance you can check, and `watchfor-agent verify` confirms the binary on disk against the signed release.

[The agent](https://watchfor.io/agent) · [Hosts docs](https://watchfor.io/docs/hosts)

### Do I need to open a firewall port for the agent?

No. The agent only makes outbound HTTPS connections to WatchFor; nothing listens on the server, so there is no inbound port to open or allowlist. If your servers sit behind an egress allowlist, allow outbound HTTPS to WatchFor — and to GitHub's release hosts if you want upgrades to download — and that is all.

[The agent](https://watchfor.io/agent) · [Hosts docs](https://watchfor.io/docs/hosts)

### What happens when a server loses its connection to WatchFor?

Nothing is lost. While WatchFor is unreachable the agent spools its batches on disk and replays them in order once the connection is back, so the charts fill in without gaps. On the WatchFor side a host shows Online while batches arrive, Stale after three missed pushes (never sooner than 90 seconds) and Offline after 10 minutes, and the Agent Silent rule opens an incident when no batch has arrived for three push intervals plus a minute — so a dead server and a cut network are both caught, and a short blip only fills the spool.

[Hosts docs](https://watchfor.io/docs/hosts)

### How do agent updates work?

By hand, or on a daily timer you opt in to — never silently. WatchFor tells a running agent when a newer release exists and the host page shows an update badge with the command. `sudo watchfor-agent upgrade` downloads the release, verifies its signature with the key built into the agent, checks the archive against the signed checksums, swaps the binary in atomically and restarts the service; if any step fails, nothing is replaced. Turn on daily auto-update with `sudo watchfor-agent auto-update on` (or the installer's --auto-update flag): it installs only signed releases the server has reported, at a random moment within a six-hour window so a fleet never restarts in lockstep, and the agent itself keeps running unprivileged.

[Hosts docs](https://watchfor.io/docs/hosts) · [The agent](https://watchfor.io/agent)

### How many hosts can I add, and how often do they report?

It depends on the plan: none on Free, 1 host on Starter, 5 on Pro, 25 on Business and unlimited on Enterprise. Agents push every 60 seconds on Starter and Pro and every 15 seconds on Business and Enterprise. You do not configure the interval — the server answers every batch with the shortest interval your plan allows and a running agent adjusts on the spot, so an upgrade speeds up every host within a minute.

[Compare plans](https://watchfor.io/pricing) · [Hosts docs](https://watchfor.io/docs/hosts)

### Can I watch a specific process, like nginx or postgres?

Yes. Name the processes you care about in agent.yml — by process name, by command line, or by the user they run as — and each becomes a watched process: whether it is running, how many instances there are, and their CPU and memory. A watched process that is not running always raises a critical incident. Independently of that, the agent reports the busiest processes by CPU and memory, so the host page shows what is eating the machine even when you did not name it.

[Hosts docs](https://watchfor.io/docs/hosts) · [Server monitoring](https://watchfor.io/server-monitoring)

### How do I remove the agent?

One command on the server: `sudo watchfor-agent uninstall`. It shows what it found and asks before it stops and removes the service, the update timer, the cron entry, the binary, the spool, the config with the token and the watchfor-agent system user (add -keep-config to keep agent.yml). In WatchFor, Remove on the host page revokes the token and deletes the host's metric history, alert rules and incidents.

[Hosts docs](https://watchfor.io/docs/hosts)

## Alerts & incidents

### How do I get alerted when something breaks?

Alerts go to notification channels you set up: email, Slack, Discord, Telegram, Microsoft Teams, Google Chat, Mattermost, Rocket.Chat, ntfy push, Gotify, Pushover, Pushbullet, PagerDuty, Opsgenie, Zapier and webhooks — 16 channel types. SMS isn't offered yet. Telegram takes under a minute — press Start on the official WatchFor bot, it replies with your chat ID, paste it in. Contact groups and routing send each alert to the right people. Every incident also lands in the dashboard bell and Inbox, where each member chooses which events they want to see.

[Notification channels](https://watchfor.io/docs/notifications)

### Is there a mobile app?

Yes — WatchFor installs as an app straight from the browser, with no App Store or Google Play download. On Android tap Install app in Chrome, Edge or Samsung Internet (or ⋮ → Install in Firefox); on iPhone and iPad tap Share → Add to Home Screen; Chrome and Edge on the desktop and Safari on the Mac install it too. The installed app opens the dashboard in its own window and can receive incident push notifications on the phone — on iPhone and iPad push works only from the installed app. A native Android app already works and is being tested in our lab, and native iOS and Android apps are planned for December 2026.

[WatchFor on mobile](https://watchfor.io/mobile) · [Native Android app](https://watchfor.io/mobile-app) · [Install the app](https://watchfor.io/docs/organization#install-the-app)

### How do you avoid false alarms?

Before opening an incident, WatchFor confirms the failure from several locations, so a single flaky check never pages you. While a critical incident is open on a monitor, its warning-level rules stay quiet instead of piling on, and simultaneous alerts are grouped into one notification per channel instead of a flood. You also control the confirmation threshold (from 1 to 10 failed checks — 3 by default; 1 is fastest and noisiest), severities and “must persist for” durations to tune sensitivity to your service.

[Alert rules](https://watchfor.io/docs/alerting)

### Can I get uptime reports by email?

Yes. Weekly (Mondays) and monthly (the 1st) report emails go to up to five recipients of your choice — weekly is on by default for new organizations — uptime, incidents, MTTR and response-time trends, always compared with the previous period, plus plain-language insights like which monitor caused most incidents or which certificate is about to expire. The same report is available on demand on the dashboard Reports page, where you can print it or save it as a PDF and export it as CSV, and as JSON over the API, MCP and A2A for AI agents.

[Reports](https://watchfor.io/reporting) · [Reports docs](https://watchfor.io/docs/reports)

### Does WatchFor support on-call rotations and escalations?

Yes. On-call schedules define who's on call with daily, weekly or custom rotations, optional layers for business-hours setups, a month calendar with per-person totals for compensation, and one-off overrides for vacations. Escalation policies then page the current on-call person through their own notification methods (email, Telegram, ntfy, Pushover, Gotify, Pushbullet) and keep escalating step by step until someone acknowledges the incident — acknowledge, resolve or a maintenance window stops the chain. On-call starts on the Starter plan with one schedule; Pro includes 3 and Business 10.

[On-call & escalations](https://watchfor.io/on-call) · [On-call docs](https://watchfor.io/docs/alerting/on-call)

### Can I schedule maintenance so I'm not alerted during planned work?

Yes. A maintenance window silences alerts for the monitors you choose (individually or by tag, including monitors you tag later) and excludes that time from your uptime and SLA — treated as neutral, not downtime, and called out on the SLA report. Windows are one-time or repeat daily, weekly or monthly. The checks keep running, so you still see whether the work broke something, and if a monitor is still down when the window ends you are notified within about a minute. A one-time window can also announce itself on your status pages ahead of time, and deploy pipelines can open one through the API. How many windows can be upcoming or active at once depends on your plan; ended windows never count.

[Maintenance windows](https://watchfor.io/docs/monitors/maintenance) · [Plan limits](https://watchfor.io/pricing)

### What information does an incident include?

Each incident has a root-cause breakdown — the failing condition, the check results that confirmed it, and the alert rule in effect at the time — plus a timeline, private team-only internal notes with @mentions, and the option to acknowledge or resolve it by hand. In the dashboard bell and Inbox an incident shows as Down, Acknowledged or Resolved as it moves through its lifecycle.

[How incidents work](https://watchfor.io/docs/alerting/incidents) · [Root cause analysis](https://watchfor.io/docs/alerting/root-cause)

### Can I write post-mortems for incidents?

Yes — a dedicated Post-mortems section lets you write a structured retrospective on any incident: severity and root-cause classification, a rich-text document from a proven template (Markdown available as an advanced mode), an extendable timeline, and action items with assignees and due dates so follow-ups actually get done. Completed post-mortems can optionally be published to your status page. Available from the Starter plan.

[Post-mortems](https://watchfor.io/docs/alerting/postmortems)

### Can I set alert severities and route them differently?

Yes. Mark each rule Warning or Critical, then route severities to different channels — for example Critical incidents to PagerDuty or Opsgenie, Warnings to a Slack channel. Each channel has its own severity filter, and contact groups decide which monitors reach which channels.

[Alerting](https://watchfor.io/docs/alerting)

### Can I check whether an alert was actually delivered?

Yes. The delivery log under Alerting → Channels & contacts records every attempt per incident and channel: sent, failed (with the exact error, such as an HTTP status or a refused connection) or silenced because the monitor was muted or in a maintenance window. Use it to answer “did we get paged for that?” or to find a channel that stopped working. Send test on any channel checks it end to end. Test sends are recorded too, with a Test badge.

[Notification history](https://watchfor.io/docs/notifications/history)

### Can I get incident alerts as push notifications on my phone?

Yes. Turn push on per device under Settings → Notifications → Push notifications. Android, Chrome, Edge, Firefox and Safari on the Mac work from the browser; on iPhone and iPad (iOS 16.4+) add WatchFor to the Home Screen first and turn push on in the installed app. You get a push when an incident opens and when it resolves; on Android and desktop Chrome or Edge the notification has an Acknowledge button. Tapping a notification opens the incident and switches to its organization. Turning Incidents off in your in-app notification preferences silences push too.

[Push notifications](https://watchfor.io/docs/organization#push-notifications)

### Will I keep getting notified while an incident stays down?

By default you're notified once when an incident opens. On each monitor's Alerting tab you can turn on repeat reminders — every 1, 6, 12 or 24 hours while it stays down. Reminders stop the moment you acknowledge the incident or it resolves.

[Alerting](https://watchfor.io/docs/alerting)

### Can I resolve an incident manually?

Owners and admins can resolve an incident by hand — from the incident page, from the row menu on the incidents list, or for several incidents at once by selecting them there. Any member can acknowledge the same way. If the underlying check is still failing it simply re-opens, and the channels that were alerted are told who resolved it and why. Incidents also close automatically when you pause the monitor or disable its rule.

[Resolving incidents](https://watchfor.io/docs/alerting/resolving)

### A probe glitch caused a false incident — can I exclude it from uptime?

Yes. Once the incident is resolved, an owner or admin can Mark as false positive on its page (or tick the box while resolving it): the incident stays on record with a badge, but it leaves your uptime, SLA and reports and is removed from the public status page. Count as downtime again undoes it; if the outage was real but planned, mark it as maintenance instead.

[False positives](https://watchfor.io/docs/alerting/resolving#false-positives)

### How fast are alerts — and can I delay them?

Detection speed depends on your check frequency and the automatic faster re-checks that follow a failure: the more often a monitor runs, the sooner a problem is seen. You can also require a problem to persist for a chosen duration before it alerts, so brief, self-healing blips stay quiet while real outages still page you.

[Alert rules](https://watchfor.io/docs/alerting)

## Status pages

### Can I show customers a public status page?

Yes. Publish a branded status page on its own web address (yourname.watchfor.io) with live component status backed by your monitors and servers, incidents auto-published as they are confirmed (on by default) or written in your own words, scheduled maintenance announced from your maintenance windows, a live uptime heatmap, an RSS feed your users can subscribe to, and an embeddable badge. Plans include 3 to 100 pages.

[Status pages](https://watchfor.io/docs/status-pages)

### Does an auto-published incident tell visitors what went wrong?

Only if you want it to. Each status-page component chooses: Status only (the default — "db-01 service disruption"), Cause (the kind of problem in plain words, such as "Disk space running low" or "Returning errors", with no values, paths or process names), or Full detail (what was detected, such as "Disk / is 92.0% full" — meant for internal or password-protected pages). It works the same for monitors and for servers running the agent.

[Incident details on the public page](https://watchfor.io/docs/status-pages/components#incident-details-on-the-public-page)

### Are page integrity incidents shown on my status page?

Not automatically. Tampering is not downtime, and the details — a new script host or form target — could point visitors at an attacker's servers, so page integrity incidents are never auto-published: the component stays Operational while your team investigates. If you want to tell your users, post an incident on the status page in your own words.

[Auto-published incidents](https://watchfor.io/docs/status-pages/updates#auto-published-incidents)

### Can a status page be private?

Each page can be public, password-protected for selected viewers, or private — a private page is not served publicly at all (its URL returns 404) and is only visible as a preview in your dashboard. You can run several pages with different visibility at once.

[Status page visibility](https://watchfor.io/docs/status-pages/visibility)

### Can I embed my status on my own website?

Yes. Every public status page has an embeddable SVG status badge for READMEs, footers and dashboards, and a CORS-enabled status.json endpoint you can read from your own front end. Both are public-page only, so a private page never leaks through the embed.

[Badge & embed](https://watchfor.io/docs/status-pages/embed)

### Can I show my providers' status (GitHub, Cloudflare, Stripe…) on my page?

Yes. Add a third-party component and it mirrors the provider's own public status page, keeps a 90-day history, and doesn't affect your own “all systems operational” banner — so your customers see the whole picture without you re-typing someone else's incident.

[Third-party components](https://watchfor.io/docs/status-pages/components#third-party-components)

### Can a status page use my own domain, or email subscribers?

Not yet. Pages live at yourname.watchfor.io (also reachable at watchfor.io/stats/yourname). Visitors can follow a public page by RSS, and you can embed the badge or status.json on your own site. Custom domains and email subscribers are on the roadmap.

[Badge & embed](https://watchfor.io/docs/status-pages/embed)

## AI agents & API

### Is there an API?

Yes — a REST API at /api/v1 (89 operations, OpenAPI 3.1 spec, cursor pagination, Idempotency-Key on writes) with per-organization Bearer API keys (scoped read or read+write, stored hashed, revocable instantly) or OAuth 2.1. It covers monitors and alert rules, checks and uptime (including any single check in full, redacted), hosts running watchfor-agent (liveness, CPU/memory/disk gauges, metric time series), incidents (list, acknowledge, resolve, stats, post-mortems), maintenance windows — handy for opening a window from your deploy pipeline — contacts and groups, status pages, reports, notification channels (secrets masked), notification history and the activity log, plus a Prometheus metrics endpoint on the Pro plan and above — and the objects carry the same detail the dashboard shows: root cause, mute state, last and next check, who is on call next. Available on every plan, including Free, with per-plan rate limits and standard X-RateLimit headers.

[Developer portal](https://watchfor.io/developers) · [API documentation](https://watchfor.io/docs/api)

### Can I get WatchFor's data into Prometheus and Grafana?

Yes, on the Pro plan and above. GET /api/v1/metrics serves monitor status, uptime over 24 hours, 7 and 30 days, response times, certificate and domain expiry, heartbeat check-ins and hosts in the Prometheus text format, refreshed every minute, so your Prometheus scrapes it like any other target with an organization API key. A ready-made Grafana dashboard covers fleet health, a status timeline, uptime against your SLO, response times and expiry, and an open-source exporter puts several organizations behind one scrape target.

[Prometheus metrics docs](https://watchfor.io/docs/api/prometheus) · [Pricing](https://watchfor.io/pricing)

### Can AI agents use WatchFor?

Yes — everything in the dashboard is available to AI agents, with no human in the loop. The MCP server at watchfor.io/api/mcp exposes 63 tools to Claude, Cursor, VS Code, Claude Code and any MCP client; agents sign in through OAuth 2.1 on a consent screen in your browser (you choose read-only or read+write and can revoke it instantly), or use an API key. The A2A endpoint publishes 19 skills that other agents can delegate to, a separate documentation MCP server lets an agent search these docs, and agents.md explains when to use WatchFor and when not to.

[MCP server](https://watchfor.io/docs/api/mcp) · [Agent quickstart](https://watchfor.io/agents.md)

### Can an AI agent run a check on something I don't monitor?

Yes. Live diagnostics let an agent run any of 26 checks — DNS, DNS propagation, DNS health, whois, ping, traceroute, TCP ports, blacklists, SSL, TLS grade, HTTP headers, the PHP version a site runs, the software versions it reveals, redirect chains, WebSocket, SMTP, a graded mail server check, NTP, API requests, CDN, sitemap, compression, email policy, Core Web Vitals, MCP handshake or a full site audit — against any public target from the probe fleet, monitored or not. Graded checks return the same A+ to F grade as the free tools, with what capped it and the fix. One call, diagnose-target, runs the whole bundle from up to three regions and returns a single verdict with a list of what looks wrong. Runs need a read+write key, because they send real traffic from our probe IPs, and they spend the same per-plan allowance as the dashboard Toolbox — every response says how much is left.

[Live diagnostics](https://watchfor.io/docs/api/diagnostics) · [Free tools](https://watchfor.io/free-tools)

### Can I try the API without an account?

Yes. The no-auth sandbox at watchfor.io/api/v1/sandbox returns live, read-only sample data in exactly the production shapes — summary, monitors, incidents, monitor types, locations and reports — so you can build against it before creating a key. Every sandbox payload is marked as such.

[Sandbox](https://watchfor.io/docs/api/sandbox)

### Are there SDKs or a command-line tool?

Yes. One package name on every registry — watchfor on npm, PyPI and RubyGems — gives you a typed client for TypeScript/JavaScript, Python and Ruby, each generated from the OpenAPI specification, plus a small CLI (for example `watchfor summary` or `npx watchfor incidents`) for a quick look from the terminal. Any other language can generate a client from the spec.

[Developer portal](https://watchfor.io/developers) · [OpenAPI specification](https://watchfor.io/docs/api/openapi)

## Account, team & billing

### Can I invite my team?

Yes. Invite teammates and assign roles — owner, admin or member — to control what each person can do. Members see everything, acknowledge incidents and write internal notes and post-mortems; changing monitors, alerting, status pages, organization settings, channel tests and API keys is for owners and admins, and a member sees those controls disabled with the reason rather than hitting an error. Invitations can be re-sent if one never arrives, and removing someone, leaving an organization or revoking an invitation always asks for confirmation. A per-organization activity log records who changed what, and when.

[Members & roles](https://watchfor.io/docs/organization)

### Does WatchFor charge per seat?

No. There are no per-seat fees on any plan; the number of members is simply one of your plan's limits (3 on Free, 25 on Starter, 50 on Pro, 100 on Business), alongside monitors, check frequency and regions.

[Pricing](https://watchfor.io/pricing)

### Can I have more than one organization?

Yes. Every account includes one free organization, and you can create more — for example one per client or company. Each additional organization needs its own plan and stays locked until one is chosen, so your existing free organization is never affected. Being invited into other organizations doesn't count against this.

[Members & organizations](https://watchfor.io/docs/organization)

### How does billing work?

Plans are subscriptions billed monthly or yearly (yearly is cheaper), in euros, through Stripe. Your plan sets how many monitors you can run, how often you can check them and from how many regions; team members are always included. You can change plans at any time, and you'll get email and in-app notifications about payments.

[Pricing](https://watchfor.io/pricing) · [Billing & plans](https://watchfor.io/docs/organization/billing)

### What happens if I downgrade?

You keep everything you have until the period you've paid for ends; then the smaller plan starts. Nothing is deleted — whatever the new plan doesn't cover pauses (the newest monitors past its limits, types it doesn't include, extra status pages or schedules), and running monitors follow its fastest interval and regions. The change dialog lists exactly what would pause before you confirm, and everything comes back on its own when you upgrade again. History follows the new plan's window, while uptime and incident history stay complete.

[When a plan no longer covers something](https://watchfor.io/docs/organization/billing#when-a-plan-no-longer-covers-something)

### How far back can I see my history?

Uptime, SLA and incident history are kept on every plan with no time limit — the Uptime SLA tab on each monitor covers any date range and prints as a report. Individual check results (timings, status codes, response bodies) and the response-time charts and reports built from them go back as far as your plan's history window, longer on higher plans; weekly and monthly reports compare each period with the one before. The pricing page lists every plan's window.

[Data retention](https://watchfor.io/docs/organization/data-retention) · [Pricing](https://watchfor.io/pricing) · [Reports docs](https://watchfor.io/docs/reports)

### How long do you keep my monitoring data?

It depends on the kind of data. Uptime, SLA and incident history: unlimited on every plan. Individual check results: your plan's check history (30 days on Free, longer on paid plans). Charts and reports: your plan's chart history (3 months on Free, years on paid plans). Screenshots, traces and Lighthouse reports: your plan's artefact window. Upgrading lengthens retention for new data: everything recorded from then on is kept for the longer windows, while data recorded before keeps its original deletion schedule (you can see it until then). The dashboard and the API say where your plan's history ends, and the pricing page compares every plan.

[Data retention](https://watchfor.io/docs/organization/data-retention) · [Compare plans](https://watchfor.io/pricing)

### Do you support two-factor authentication and Google sign-in?

Yes. You can secure your account with two-factor authentication (2FA) and sign in with Google. Inside an organization, access is role-based and every change is recorded in the activity log.

[Members & roles](https://watchfor.io/docs/organization)

### How do I manage billing, invoices and cancellation?

Everything is self-serve from Settings → Subscription: change or cancel your plan (upgrades start now with a prorated charge, downgrades and cancellations at the end of the paid period), update your payment method, download invoices and redeem a coupon. If a payment fails your plan keeps working for 7 days while Stripe retries; you get an email and an in-app notice with the link to pay.

[Billing & plans](https://watchfor.io/docs/organization/billing)

### Where is my data stored, and does GDPR apply?

Monitoring configuration and incident history are stored in the European Union — in a TIER III data center on renewable energy — under European law, so GDPR applies end to end. Checks run from locations worldwide, but they only ever touch the targets you configure.

[Infrastructure](https://watchfor.io/infrastructure) · [Privacy policy](https://watchfor.io/legal/privacy) · [Subprocessors](https://watchfor.io/legal/subprocessors)

## Free tools & trust

### Are there free tools I can use without an account?

Yes — 64 tools, no sign-up required: DNS lookup, propagation and a DNS health grade, SSL and TLS grade, a PHP version checker that grades php2shell exposure and end of life, a software exposure checker that grades the versions your site reveals, ping, traceroute, port and blacklist checks, Core Web Vitals, HTTP headers, SPF/DMARC/DKIM, a mail server checker that grades SMTP, IMAP and POP3, WHOIS, an MCP server checker, an email header analyzer, an SPF & DMARC record generator, and in-browser calculators for subnets (IPv4 & IPv6), cron expressions, timestamps, error budgets, JSON/JSONPath, bandwidth and chmod.

[Open the free tools](https://watchfor.io/free-tools)

### How do I check whether my site is vulnerable to php2shell?

Run the free PHP Version Checker on your site. It reads the PHP version your server announces in the X-Powered-By or Server header — with plain GET requests, nothing exploit-like — and tells you whether that version is affected by php2shell (CVE-2026-109618 and CVE-2026-109619), which other known CVEs apply, whether the branch still gets security fixes and the exact release to install. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and older got no fix. If your server hides its version, the checker says so instead of guessing: check it on the server with php -v. Debian, Ubuntu and Red Hat builds may carry the fix under an older version number, so verify those in your vendor's tracker.

[Free PHP version checker](https://watchfor.io/php-version-checker) · [php2shell guide](https://watchfor.io/blog/php2shell-check-if-your-site-is-vulnerable)

### How do I check which software versions my website reveals?

Run the free Software Exposure Checker on your site. It fetches the page once with a plain GET and lists every version the headers and HTML give away — the Server and X-Powered-By headers, the generator tag, WordPress asset URLs, JavaScript libraries in script URLs, server signatures on error pages — then grades them A+ to F: what you reveal, what is outdated or past end of life, and which known CVEs may apply, flagged where CISA lists them as exploited. Each finding comes with the fix, including the config that hides the version on nginx, Apache, IIS, PHP and WordPress. Debian, Ubuntu and Red Hat builds may carry fixes under an older version number, so those are marked verify rather than failed, and a JavaScript library's CVE depends on how the page uses it, so those cap at C.

[Free software exposure checker](https://watchfor.io/software-exposure-checker) · [What your server headers reveal](https://watchfor.io/blog/what-your-server-headers-reveal)

### What do the A+ to F grades on the free tools mean?

They are WatchFor Grades: one scale and one method for SSL/TLS, security headers, PHP versions, software exposure, mail servers, Core Web Vitals, CDN delivery, Email Health, DNS health and MCP servers. A grade starts at A+ and every problem found can only lower the ceiling, so the worst finding sets the letter. The findings are listed under it, worst first, each with what it means and the exact fix. Every rule set is versioned and published in full on its tool page, and if a server could not be reached from our locations you get no grade rather than an F.

[How WatchFor grades](https://watchfor.io/grades)

### Is my data secure?

Traffic between you, the agent and WatchFor uses TLS 1.2 or newer. API keys are shown once, stored as hashes, scoped read or read+write and revocable, and OAuth access for AI clients can be revoked instantly; two-factor authentication is available to every user, and team access is role-based with an activity log. Every query is scoped to your organization. Credentials you give a check (HTTP passwords, bearer tokens, API-key headers, mailbox and FTP passwords, browser-check secrets) are encrypted at rest, bound to that check and never shown again, not even to owners, and credentials that turn up in a check result (tokens, cookies, API keys) are redacted before you see it. An independent assessment of the public service in September 2026 found no critical or high-severity issues. To report a vulnerability, see the security page or /.well-known/security.txt.

[Security](https://watchfor.io/docs/security) · [Infrastructure & trust](https://watchfor.io/infrastructure)

### Is there a status page for WatchFor itself?

Yes, at status.watchfor.io, with a machine-readable version at status.watchfor.io/status.json. It is an ordinary WatchFor status page, the same kind you publish for your own users.

[WatchFor status](https://status.watchfor.io)

### Are there keyboard shortcuts?

Yes. ⌘K (Ctrl K on Windows and Linux) or / opens the command palette: type a few letters of a monitor, host, page or tool and press Enter. g then a letter jumps to a section (g m for Monitors, g i for Incidents), c then a letter creates something (c m for a new monitor, c s for a status page), and ? shows the full cheat sheet.

[Keyboard shortcuts](https://watchfor.io/docs/reference/keyboard-shortcuts)

### I can't type into input fields on my phone — what's wrong?

If you're on Firefox for Android and the keyboard opens (its suggestion bar even reacts to what you type) but no text appears in the field, you've hit a known Firefox for Android browser bug: the connection between the keyboard and the browser breaks for the whole browsing session, on every website — closing tabs doesn't help. Fully close and restart Firefox and it works again, or use another browser such as Chrome, which isn't affected.

### Where can I learn more?

Browse the documentation for step-by-step guides, the developer portal for the API, MCP server and SDKs, the glossary for monitoring and DevOps terminology, and the changelog to see what we've shipped recently.

[Docs](https://watchfor.io/docs) · [Developer portal](https://watchfor.io/developers) · [Glossary](https://watchfor.io/docs/reference/glossary) · [Changelog](https://watchfor.io/changelog)

---

Canonical page: https://watchfor.io/faq · Pricing: https://watchfor.io/pricing.md · Site guide: https://watchfor.io/llms.txt