Documentation

Monitors

Monitors perform HTTP/HTTPS requests to your URLs at a set interval. Checks run from multiple regions (US, EU, APAC) and record status, response time, and optional content analysis.

Creating a monitor

Go to Monitors → Add monitor. Fields:

• URL — Full URL (e.g. https://api.example.com/health) or domain (example.com). Missing scheme defaults to https://.
• Monitor name — Auto-generated from URL; you can override.
• HTTP method — GET, POST, PUT, PATCH, DELETE, HEAD, or OPTIONS. Use POST/PUT/PATCH for API health checks that require a request body.
• Check interval — How often to check. Free: 10-minute minimum; Starter and Business: 1-minute minimum.
• Timeout — 1–120 seconds (default 30). Request is marked failed if no response within this time.
• Accepted status codes — Presets: 200 only, any 2xx, any 2xx or 3xx, any response; or custom comma-separated (e.g. 200, 201, 204).
• Keyword validation — Optional. Require a specific string in the response body for the check to pass.
• Custom headers — Key-value pairs for Authorization, API keys, etc.
• Request body — JSON body for POST, PUT, or PATCH requests.
• Notification channels — Select which channels receive down/up alerts.

Managing monitors

From the monitor list or detail view:

• Pause/Resume — Temporarily stop checks without deleting. Useful during maintenance.
• Test now — Run a single check on demand to verify configuration.
• Edit — Change any monitor settings.
• Delete — Permanently remove the monitor and its history.

Monitor detail view

Click a monitor to see: uptime history bar (daily status), stats cards (current status, 24h uptime, avg response time, last check), response time chart, recent checks table, related incidents, and settings summary. For HTTPS monitors, SSL expiry info is shown.

SSL Certificate Monitoring

For HTTPS monitors, Webalert automatically checks SSL certificate expiration. No extra configuration required.

How it works

Each check validates the certificate chain and extracts expiry date, issuer, and days remaining. Alerts are sent at 30, 14, 7, and 1 day before expiry through your configured notification channels.

Dashboard display

On the monitor detail page and dashboard SSL widget you see: issuer (e.g. Let's Encrypt), expiry date, days remaining, certificate chain validation status, and any configured alert thresholds.

Response Time Monitoring

Every check records response time in milliseconds. This data powers charts, stats, and optional alerts.

Dashboard and charts

On the monitor detail page you see: average, min, and max response time; a sparkline or line chart over time; and historical data for 30-day, 60-day, or 1-year depending on your plan.

Response time alerts (Starter+)

Enable in the monitor's advanced settings:

• Threshold (ms) — 100–30,000 (default 1,000). Alert fires when response exceeds this.
• Consecutive checks — 2–10 (default 3). Alert only after this many consecutive slow checks to reduce false positives.
• Cooldown — Prevents repeated alerts for the same slow period.

Content Change Detection Starter

Content change detection alerts you when the response body size (or content hash) changes beyond a threshold. Useful for detecting accidental edits, defacement, or unauthorized changes.

Configuration

Enable in the monitor's Content Change Detection section:

• Size change threshold — 1–100% (default 20%). Alert when response size changes by this percentage.
• Comparison checks — 5–50 (default 10). Number of prior checks to compare against.
• Content check interval — 5 min, 10 min, 15 min, 30 min, or 1 hour. How often content is checked.

Alerts fire when the change is detected. A cooldown prevents repeated alerts for the same change.

DOM Structure Monitoring Business

DOM structure monitoring computes a hash of the page's HTML structure. If the structure changes (e.g. layout broken, critical element removed, defacement), an alert is sent. Use cases: detect defacement, broken layouts, or unauthorized UI changes.

Difference from content change detection

Content change detection compares response size or body hash. DOM structure monitoring compares the parsed HTML structure—so reordering elements or changing text without changing size can still be detected. Both have cooldown settings to prevent alert spam.

SEO Cloaking Detection Business

SEO cloaking is when a site serves different content to search engines (e.g. Googlebot) than to normal visitors—often a sign of compromise, malware, or spam injection.

How it works

Webalert fetches the page twice: once as a regular user and once with a Googlebot user-agent. It compares the DOM hashes. If they differ, a security alert is sent with both hashes so you can investigate. Enable the toggle in the monitor's advanced settings.

Notification Channels

Channels define where alerts are sent when monitors go down or recover. Create channels in Notification Channels, then attach them to monitors.

Email

Enter an email address. Alerts are sent to this address. Always available on all plans.

Slack

Create an incoming webhook in Slack (Settings → Integrations → Incoming Webhooks), copy the webhook URL, and paste it into Webalert. Alerts appear in the channel you configured.

Discord

In Discord: Server Settings → Integrations → Webhooks → New Webhook. Copy the webhook URL and paste it into Webalert. Alerts post to the channel the webhook is configured for.

Microsoft Teams

In Teams: Channel → Connectors → Incoming Webhook. Create a webhook and copy the URL. Paste it into Webalert.

Webhooks

Enter your endpoint URL and choose HTTP method (POST or PUT). Webalert sends a JSON payload. Example payload (down alert):

{
  "event": "incident",
  "incident_id": 123,
  "monitor_id": 456,
  "monitor_name": "api.example.com",
  "monitor_url": "https://api.example.com",
  "status": "ongoing",
  "started_at": "2026-02-08T14:30:00.000Z",
  "resolved_at": null
}

For Business plan incidents with escalation, acknowledge_url may be included. Use this to integrate with PagerDuty, OpsGenie, or custom systems.

SMS

Enter phone number with country code. Verification may be required. Available on Starter and Business.

Verification and logs

Each channel can send a test notification to verify setup. Use Notification logs (in the dashboard or channel settings) to see delivery history, success/failure status, and error messages.

Status Pages

Status pages show your monitors' uptime and recent incidents to your customers. Create one from Status Pages → New status page.

Creating a status page

• Subdomain — 3–63 characters, lowercase letters, numbers, hyphens. No consecutive hyphens. Becomes yourapp.status.web-alert.io or use path /s/yourapp.
• Title — 1–100 characters. Displayed at the top.
• Description — Optional, max 500 characters.
• Visibility — Public (anyone with URL), Link-only (unguessable URL), or Private (disabled).
• Monitors — Select which monitors to display. Optional display names and descriptions per monitor.

Branding

Primary color, accent color, logo URL, favicon URL. Background style: light, gradient, or glass. Layout density: comfortable or compact. Toggle "Show powered by Webalert".

Service groups

Group monitors under named sections (e.g. "API", "Website"). Add groups, assign monitors, reorder. Improves scanability on large status pages.

Custom domains (Business)

Add a custom domain (e.g. status.yourcompany.com). Verify ownership via DNS (CNAME or TXT record). Once verified, the status page is served at your domain.

Subscribers (Business)

Enable the subscribe box on the status page. Visitors enter email and verify. Subscribers receive updates when you post incident updates or when monitors change status.

Sharing

Public URL format: https://app.web-alert.io/s/{subdomain}. For link-only visibility, use the share URL shown in settings. Status pages stay in sync with monitor state and incidents automatically.

Incident Management Starter

Incidents are created automatically when a monitor goes down, or manually from the Incidents page or monitor detail. Manage severity, status updates, and postmortem notes.

Creating incidents

Manual: Incidents → New incident, or Monitor detail → Report incident. Fields: title (required), severity (critical/high/medium/low, default medium), monitor link (optional; omit for system-wide), initial message, notify subscribers toggle.

Incident statuses

Adding updates: choose status (investigating, identified, monitoring, resolved), optional message, notify subscribers checkbox. Timeline shows all updates on the incident and on linked status pages.

Postmortem notes

Editable text field for post-incident documentation. Use for root cause, timeline, and follow-up actions.

Acknowledgment (Business)

When escalation is used, incidents can be acknowledged via email link or UI. Acknowledgment stops further escalation and records who responded and when.

Filtering

Filter by status (ongoing, resolved), severity (critical, high, medium, low), and time range (7, 30, 90 days).

Scheduled Maintenance Starter

Schedule maintenance windows so downtime during deployments doesn't trigger alerts. Linked monitors are treated as "in maintenance" during the window.

Creating a window

• Title — 1–255 characters.
• Description — Optional. Shown on status pages.
• Start and end time — Scheduled window. End must be after start.
• Linked monitors — Select monitors to include. Downtime during the window does not trigger alerts.
• Auto-start — Window status becomes "in progress" at start time (default on).
• Auto-complete — Window completes at end time (default on).
• Notify subscribers — Send advance notice to status page subscribers.

Statuses

scheduled → in_progress → completed (or cancelled). Status pages show upcoming and in-progress maintenance.

On-Call Schedules Business

On-call schedules define who is responsible when. Create schedules in On-Call → Schedules. The current on-call person is shown in the dashboard and used by escalation policies.

Creating a schedule

• Name — 1–255 characters.
• Description — Optional.
• Timezone — Default UTC. Affects handoff times.

Layers

Each layer defines a rotation. Add one or more layers:

• Layer name — Internal label.
• Rotation type — Daily (handoff every day), Weekly (handoff day + time), or Custom (handoff every N days, 1–365).
• Handoff time — When the rotation advances (e.g. 09:00).
• Handoff day — For weekly: 0=Monday … 6=Sunday.
• Start date — When the rotation begins.
• Participants — Team members in order. First person is on call initially; order defines rotation.

Multiple layers stack: higher layers override lower. Use for backup or escalation within the schedule.

Overrides

Temporarily assign someone else (e.g. vacation): add an override with substitute user, start time, and end time. Overrides take precedence over the rotation.

Timeline and coverage

Timeline view shows who is on call when. Coverage analysis detects gaps (periods with no one on call) and warns you.

Handoff notifications

Per-user preference: receive an email when the on-call person changes. Configure in Settings → Preferences.

Escalation Policies Business

Escalation policies define multi-step alerting: if step 1 doesn't acknowledge or resolve, step 2 is notified after a delay, and so on. Link a policy to a monitor so when the monitor goes down, the policy runs.

Creating a policy

• Name — 1–255 characters.
• Description — Optional.
• Repeat count — 0–10. How many times to loop through all steps before stopping. 0 = run once.

Steps

Add one or more steps in order. Each step:

• Target type — On-call schedule, User, or Notification channel.
• Target — Select the schedule, user, or channel.
• Delay (minutes) — 0–1440 (0–24 hours). Wait before notifying this step.

How escalation runs

Monitor goes down → step 1 notified immediately (or after its delay). If incident is not acknowledged or resolved when the next step's delay elapses, step 2 is notified. Continues until acknowledged/resolved or all steps complete. If repeat count > 0, the policy loops back to step 1. Acknowledgment stops further escalation.

Linking to monitors

In monitor create/edit, select an escalation policy. Only one policy per monitor.

SLA Tracking Business

Set an SLA target per account. Webalert calculates a 30-day rolling uptime and error budget: how much downtime is "allowed" before you breach the SLA. Use this to prioritize incidents and decide when to deploy vs when to focus on stability.

Setting a target

Configure in Settings (Account section). Common presets: 90%, 95%, 99%, 99.5%, 99.9%, 99.95%, 99.99%. Custom values 90–100% allowed.

Error budget

Error budget = (100 − target) / 100 × total minutes in 30-day period. Example: 99.9% target → 43.2 minutes allowed downtime per 30 days. Used budget = sum of incident durations in the period. Remaining = budget − used.

Dashboard widget

Shows: current uptime %, target %, budget used %, remaining minutes, days until 30-day window resets, and within/over budget status.

Team Management

Webalert supports multiple accounts. You can belong to several accounts and switch between them via the account switcher in the sidebar.

Roles

• Owner — Full control. Manage billing, delete account, transfer ownership. Cannot be removed.
• Admin — Manage members, invitations, account settings. Can edit monitors and channels.
• Member — Create and edit monitors, notification channels, status pages, incidents, maintenance.
• Viewer — Read-only access. Can view dashboard, monitors, incidents. Cannot make changes.

Inviting members

Settings → Team → Invite. Enter email and role. Invitee receives an email and must accept to join. Invites can expire.

Preferences

Per account: weekly report email toggle, on-call handoff notification toggle. Configure in Settings → Preferences.

Other actions

Owners can transfer ownership to another member. Members can leave an account. Owners can delete the account (danger zone in Settings).

Billing & Plans

Manage your plan and subscription in Billing. Stripe handles payment; use the Billing Portal to update payment method and view invoices.

Free

• 3 monitors, 10-minute minimum check interval
• Email and Slack notifications
• 1 status page
• 30-day data retention
• No credit card required

Starter — €9/month

• 10 monitors, 1-minute minimum check interval
• All notification channels (Email, Slack, SMS, Webhooks, Discord, Teams)
• 2 status pages
• Incident management and scheduled maintenance
• Content change detection, response time alerts
• 60-day data retention
• 7-day free trial

Business — €29/month

• 50 monitors, 5 status pages
• All Starter features plus DOM structure monitoring, SEO cloaking detection
• SLA tracking and error budgets
• On-call schedules and escalation policies
• Custom domains for status pages, subscriber notifications
• 1-year data retention, priority support
• 7-day free trial
• Responder add-on: €25/responder/month

Managing your subscription

• Upgrade — Choose a plan and start a trial or pay immediately.
• Downgrade — Change to a lower plan. Takes effect at end of billing period.
• Cancel — Immediate or at end of period. Access continues until period end.
• Resume — If cancelled at period end, you can resume before the period ends.
• Stripe portal — Manage payment method, view invoices, update billing details. Click "Manage in Billing Portal" on the Billing page.