Domains

Uptime monitoring and site-down alerts

How the five-minute probe decides a site is down, what a recovery looks like, which plans are probed, and the Lock Screen Live Activity.

Updated · 4 min read

Every watched domain is probed over HTTPS every five minutes. Free accounts have their three oldest domains probed (on Free the probe is the only domain check that runs on a schedule; there is no nightly re-scan); paid plans probe every domain inside their automated allowance. Each five-minute pass probes up to 84 domains across all accounts, longest-unprobed first.

Where to see it

  • Web: open a domain, Uptime tab; Monitoring, Uptime for the portfolio view.
  • iOS: the domain's Uptime module. When a site is down, the app shows a Live Activity on the Lock Screen and in the Dynamic Island.
  • API/MCP: GET /api/domains/uptime-snapshots, GET /api/domains/downtime-events, the tools get_uptime_snapshots and get_downtime_events.

How down is decided

  • Each probe has an eight-second timeout and records a snapshot: OK or not, the HTTP status, and the error.
  • A domain is marked down on the second consecutive stored failure, not the first. One failed request is a blip; two in a row is a state.
  • Before a failure that would confirm an outage counts, it is asked again with a longer timeout, and then against a second network: our own server outside Cloudflare, which also checks every watched site every five minutes. If the second network gets an answer, the probe records the site as up with the note "Reachable from elsewhere" and nobody is alerted.
  • A single success before the second failure clears the suspicion silently. Once a domain is down, it takes two successes in a row to close the downtime event as recovered with the outage length.
  • Failures that originate on our side (a probe run that could not reach anything at all, or a tick in which most sites fail together) store nothing against your site, so they can never mark it down.

The down event's detected_at is backdated to the first of the two failures, so the outage length in the recovery message is honest.

Alerts

A down alert and a back-up alert land in the alert feed and are pushed to the app, on every plan (Uptime, on by default). Down takes two failed checks in a row, and back up takes two good checks in a row, so one answer in the middle of an outage does not end it. The back-up alert says how long the site was down, and is sent only for an outage you were told about. A second outage within 24 hours gets one "going up and down" row instead of its own alert; an outage that then lasts 30 minutes is alerted on its own, and a site raises at most two down alerts in 24 hours.

With the morning summary on (the default), a site going down is one of the few things that pushes right away, and only between 8 a.m. and 5 p.m. Eastern; outside those hours, and for the back-up alert, the push waits for the 8 a.m. summary. The alert feed gets the row the moment it happens either way. See Push notifications and the morning summary.

The Live Activity (iOS)

When a watched domain goes down, opening the app starts a Live Activity on the Lock Screen and in the Dynamic Island (a push alone cannot start one while the app is in the background): how long it has been down, the server's own evidence line, the last eight checks, and when the next check is due. It ends itself with "Back online after n min" when the site recovers and stays visible for four hours after.

What the probe checks

The probe checks the domain's root.

Common questions

My site was down for three minutes and nothing fired. With a five-minute probe and a two-failure rule, an outage shorter than about ten minutes can pass between probes. That is deliberate: the probe exists to catch the outage that lasts, not to page you for a deploy.

The probe says down but the site opens for me. The probe runs from Cloudflare's network. A firewall rule that blocks Cloudflare, a geo-block, or a bot challenge can fail the probe while browsers succeed. When a connection fails outright, the second network usually catches this and the reading says "Reachable from elsewhere" instead of opening an outage; an HTTP error status (a 403 from a bot challenge, say) is still a failure. The evidence line on the event shows the status or error the probe saw.

Can I stop probing one domain? Yes. On the web, switch Uptime off on the domain's Daily scan & automatic checks card, or choose Pause monitoring from the domain's ⋯ menu to stop all automatic checks. In the app, pause it from the domain's Scan settings.

Still stuck?

Ask the people who run the scanner.

Send the domain and what you expected to see. We look at the same scan you are looking at and write back with what it means and what to change.