Help center / Troubleshooting

Why was I alerted?

Reading an alert and finding the cause.

Start with the alert

Every alert says what failed and how. The most common reasons:

Alert saysWhat it usually means
Timed outThe server didn't answer in time: overloaded, crashed, or a firewall is silently dropping our requests.
Connection refusedThe server is up but nothing is listening on that port; the web server or app has stopped.
DNS lookup failedThe name doesn't resolve: DNS records changed or removed, or the domain expired.
SSL / TLS errorThe certificate is expired, untrusted or for another name. See SSL checks.
500, 502, 503, 504The server answered with an error: the app crashed (500), the server in front can't reach it (502/504), or it's overloaded or in maintenance (503).
403, 401Something is blocking us: bot protection, a firewall rule, a login wall. See below.
404The page moved or was deleted.
Keyword not foundThe page loaded but its content changed, or an error page was served with status 200.
SlowTwo responses in a row took longer than the limit you set.

Look at the incident

Open the incident from the alert. Its timeline shows each failed check, which regions failed, the response we got and when it recovered. If only one region ever failed, the problem may have been on the network between that region and your server.

"But the site works for me"

  • You may be seeing a cached copy, or reaching it from a network that's still fine. Try from your phone on mobile data.
  • It may have been down briefly and recovered; check the incident's duration.
  • Your host or a security plugin may be blocking our checks. See IP addresses and allowlisting.

Other kinds of alert

  • Expiring: an SSL certificate or domain is close to expiry. See SSL and domains.
  • DNS changed: a record changed; mark it expected if you made it. See DNS.
  • Email setup: SPF or DMARC is missing or broken. See email checks.
  • Heartbeat missed: a job didn't ping in time. See heartbeats.

Still stuck? Contact us and a person will reply.