Uptime monitoring checklist for web agencies

An agency maintaining thirty or a hundred client sites faces a different problem from a team watching its own product. Every site has its quirks, its host, its deadlines and its contact person, and monitoring tends to grow piecemeal: a check added after an outage, another forgotten during a migration. So the day a domain expires or a backup quietly stops running, it is the client who tells you.

Here is the checklist we recommend, organised by phase: onboarding a client site, alert routing, client communication, account organisation, deployments and the quarterly review. It works whatever tool you use; along the way we point out how to set it up in LucidStack.

When onboarding a client site

This is the moment that counts: once the site is live and the client is happy, nobody comes back to finish the monitoring.

The site and its key pages

• Homepage: an HTTP check on the status code and response time, with a slowness threshold that suits the site.
• Pages that make money: cart, checkout, contact page, customer area. A keyword check confirms that an expected text is displayed, such as the label of the order button.
• Forbidden text: conversely, make sure no page contains "Fatal error", "Maintenance" or "Database connection". An error page served with a 200 code slips past a plain HTTP check.
• API: if the site depends on an API (mobile app, ERP connector, search), check it with assertions on the JSON response rather than the status code alone.

A keyword check confirms that the contact form is displayed, not that messages actually go out. For that second half, monitor the mail server too, as described below.

Certificate, domain, DNS and email

• SSL/TLS certificate: checked on every HTTPS run, with reminders before expiry and an immediate alert if the chain is incomplete or the hostname does not match.
• Domain name: LucidStack detects domains from your monitors and checks them daily via RDAP, with reminders 60, 30, 7 and 1 day before expiry. A name-server change is reported straight away.
• DNS: monitor the records that matter (A, MX, TXT) to spot a change made by the client or their host without telling you.
• Mail server: if you manage the client's email, check SMTP, IMAP or POP with STARTTLS or TLS.

Scheduled jobs and backups

• Backups: every nightly backup sends a heartbeat when it finishes; if the ping does not arrive within the grace period, you get an alert.
• Imports, syncs, newsletter sends: same idea, with the exit code so you can tell a failure from a job that never ran.

The details are in our guide to monitoring a cron job with heartbeats.

The WordPress wp-cron caveat

WordPress has no real scheduler: wp-cron is triggered by page visits. On a low-traffic site, scheduled posts and plugin backups run late, or not at all. And your monitoring checks, by visiting the site every minute, may trigger wp-cron themselves and hide the problem.

// wp-config.php
define( 'DISABLE_WP_CRON', true );

# crontab (with WP-CLI): run due WordPress events every 5 minutes, then report the result
*/5 * * * * cd /var/www/client && wp cron event run --due-now --quiet; curl -fsS -m 10 "https://ping.lucidstack.dev/<token>?exit_code=$?" > /dev/null

Alert routing

An alert sent to everyone is read by no one. Decide who gets what, and through which channel:

• SMS for critical only: texts cost credits and wake people up. Keep them for sites where an outage costs the client money.
• Quiet hours: in LucidStack, warnings (certificate reminders, degraded state) wait until quiet hours end; outages and recoveries always get through.
• Escalation: from the Agency plan, an escalation policy notifies the next person if nobody acknowledges the incident within the delay you set.
• Test every channel: send a test message when you set up each channel, not on the day of the outage.

Client communication

• Status page on the client's domain: for example status.client-example.com, with a CNAME record pointing to status.lucidstack.dev. The HTTPS certificate is issued automatically on the first visit. White label from the Agency plan: logo, colours, no LucidStack branding.
• Subscribers: invite the client and their staff to subscribe to email announcements.
• Monthly report: a PDF sent on the 1st of every month with uptime, incidents, response times and a written summary. It is tangible proof of the work your maintenance contract covers. See client reports.
• Read-only access: the client views their own projects without seeing anyone else's.

A well-kept status page also cuts down on "is the site down?" calls when the problem is actually on the client's own network.

Account organisation

• One project per client, grouping their monitors, status pages, report and recipients.
• A naming convention that still makes sense in an alert read on a phone at 3 a.m.
• Consistent tags: technology, host, contract type. They pay off when a hosting provider goes down and you need to know which clients to warn.
• An inventory of deadlines: LucidStack gathers every certificate and domain deadline in one table, sorted by urgency. Note next to each one who pays for the renewal, the agency or the client.
• Roles for each member: the Agency plan includes 5 members, with roles and an audit log.

Client · Site · Check
Martin Bakery · shop · Checkout (keyword)
Martin Bakery · shop · Nightly backup (heartbeat)

Maintenance windows during deployments

• Schedule a maintenance window before every release or migration: checks during the window do not alert, and the period is excluded from uptime.
• Announce it on the status page so subscribers are informed.
• Keep it short: a four-hour window for a ten-minute deployment hides any real outage that happens in the meantime.
• Check afterwards that all of the client's checks are green again.

The quarterly review

Once a quarter, set aside an hour to tidy up:

• remove monitors for retired sites and departed clients;
• check alert and report recipients, and client access;
• send a test message on every alert channel;
• go over the quarter's incidents and any actions still open;
• look for false positives and adjust timeouts and thresholds;
• review response time trends over 30 days;
• go through the deadlines coming up in the next 90 days;
• compare your usage with your plan's limits.

Summary

What the Agency plan covers

LucidStack's Agency plan, at €24 per month excluding VAT, is built for this way of working: 200 monitors checked as often as every 30 seconds, 100 heartbeats, 50 status pages, white label on status pages and reports, read-only client access, 5 members and escalation policies. Extra monitors are available as an add-on. Everything is detailed on the web agencies page.

With or without LucidStack, what matters is running the same checklist for every new client. That is the difference between maintenance you bill for and maintenance you can prove.