What to Monitor on a Client Website: The Complete List

Availability and performance

This is the layer most people already cover, and it's the table stakes. If the site is down or crawling, everything downstream is moot.

• Uptime — HTTP status checks from multiple regions so you catch geographic and CDN-level failures, not just a single vantage point.
• Response time and page load — a site that's technically up but takes eight seconds is failing the visitor.
• Core Web Vitals — LCP, CLS, and INP, which affect both user experience and search ranking.
• Broken links and 404s on key pages — especially after a deploy or CMS update.
• Critical user flows — checkout, contact forms, login — because a working homepage tells you nothing about whether the form actually sends.

Certificates and domains

This is the category that causes the most avoidable, high-embarrassment outages, and it's the one uptime tools tend to miss until the site is already throwing browser warnings.

Monitor SSL/TLS certificate expiry for every certificate — and validate the full chain, not just the leaf, because an expired intermediate breaks trust even when your cert is valid. Separately, monitor domain registration expiry, which is a completely different clock: auto-renewal fails silently, and a lapsed domain takes down the site and email at once. You can spot-check a certificate with the free SSL checker, but for a portfolio of clients you want these tracked continuously rather than remembered.

DNS and email authentication

DNS is the plumbing everything else runs through, and it changes in ways that are easy to miss — a contractor updates a record, a migration leaves a dangling entry, a TTL change causes intermittent resolution. Monitoring for DNS drift means being alerted when a record changes unexpectedly, which is both an outage safeguard and a security one (dangling records get hijacked).

Email authentication belongs here too, because for most clients email deliverability matters as much as the website. Watch SPF, DKIM, and DMARC records for validity and for drift — a broken SPF record or a DMARC policy misconfiguration quietly sends legitimate mail to spam. You can audit a domain's setup with the DMARC checker and use the result as a monitoring baseline.

Security and content integrity

These are the checks that catch a site that's still up and serving — just serving the wrong thing, or serving it insecurely.

• Blocklist and reputation — is the domain flagged by Google Safe Browsing or an email blocklist? That silently kills traffic and deliverability.
• Defacement and content change — unexpected changes to key pages can signal a compromise.
• Mixed content — HTTP assets on an HTTPS page trigger browser warnings and break the padlock.
• Security headers — HSTS, CSP, and related headers; their absence or removal is worth flagging.
• Malware and injected scripts — third-party or injected code that shouldn't be there.

How to prioritize it without drowning in noise

You don't need every check on every client from day one, and a monitor that cries wolf gets muted — which is worse than no monitor. Start with the failures that are silent, preventable, and high-impact: SSL expiry, domain expiry, DNS drift, and email auth. Those four cause outages that are entirely foreseeable yet routinely missed, and they're the ones that make you look unprofessional when the client catches them first. Layer uptime and performance on top, and reserve loud, escalating alerts for genuinely urgent conditions.

For agencies, the real multiplier is consolidation and white-labeled reporting — one dashboard across every client, with reports that carry your brand instead of a patchwork of tools. Our guide on domain monitoring for agencies goes deeper on that workflow.

This is exactly what VigilDog monitoring is built for: SSL, domain expiry, DNS and drift, and email deliverability across your whole client portfolio, with white-label reports — so you're the one who catches the problem, every time.