Eleven domains nobody approved
Ask an agent to add analytics and it adds a tag. Do that four times over six months and your page is executing code from hosts no one on the team chose, on your origin, with your users' data.
The Nest
HarpyWatch's writing on monitoring, uptime, and the things that break quietly.
Reading a site the way a machine does
Your browser smooths over a great deal of what your site actually sends. Here are the terminal commands that show you what a crawler, a link checker or a monitoring probe gets instead.
The outages that live beneath your application
Between a visitor typing your name and a request reaching your server sits a system you did not write and cannot review: a registration, a delegation, a zone, and a chain of caches. Here is how each of them fails.
A status page is a sales asset, if it is honest
Uptime nobody can see is an internal fact. Published with real history, it answers a question buyers were going to ask anyway — and an always-green page nobody believes is worth less than an honest one with incidents on it.
The agent will make the check pass
Given a red signal, an agent optimises for the signal. That is not a flaw in any particular tool — it is what optimisation means, and it changes which signals are worth having.
Your monitor cannot live in the thing it monitors
A health check inside your own stack goes silent at exactly the moment it had something to say. Here are the failure domains an internal check shares with the site, and what an external one sees instead.
The deploy succeeded. That is not the same as the deploy working
A green pipeline reports that a process started. It is compatible with an empty database, a missing environment variable, a stale CDN and every real route returning 500. Only a request from outside settles it.
The agent shipped it and nobody read it
An AI agent can produce a working-looking site faster than any human can review it. The defects live in the gap between the agent saying it is done and a stranger being able to use it.
Knowing before your customers do is the whole product
Monitoring is usually justified as insurance against downtime. The better argument is commercial: the gap between a customer telling you your site is broken and you telling them is a gap they can feel.
Diagnose before you deploy, not after
Redirect chains, headers, certificate chains, robots policy and sitemap validity are all observable on a staging hostname, before DNS points anywhere. That is where the checks should run first.
Your agent built a single-page app and the AI crawlers see an empty div
Ask an agent for a website and you will usually get a client-rendered one. The AI crawlers largely do not execute JavaScript, so what they store is an empty div — and one curl command will tell you whether that is your page.
Why certificates still lapse, twelve years after Let's Encrypt
Renewal is automated almost everywhere and certificates still expire in production. The failure has moved: it is no longer the renewal that breaks, it is everything between the renewal and the socket a browser actually connects to.