# HarpyWatch > Every check on every site, in one grid. This file is maintained automatically from the same database that serves the pages it lists, so it does not go stale. It describes HarpyWatch only; other products served by this deployment publish their own at their own domains. ## Product - [Pricing](https://harpywatch.com/pricing): plans, limits and what each one includes. - [What we check](https://harpywatch.com/checks): every kind of check the engine runs. - [Docs](https://harpywatch.com/docs): concepts, how checks run, and what the API serves. - [Contact](https://harpywatch.com/contact) - [The front page, as Markdown](https://harpywatch.com/index.md): what the product is, what it checks and what it costs, in one document. ## Checks One page per check: what it measures and what it reports. - [HTTP](https://harpywatch.com/checks/http-uptime) - [Headers](https://harpywatch.com/checks/http-headers) - [JSON](https://harpywatch.com/checks/json-api) - [Schema](https://harpywatch.com/checks/json-schema) - [TLS](https://harpywatch.com/checks/ssl-cert-expiry) - [Chain](https://harpywatch.com/checks/cert-chain-trust) - [DNS](https://harpywatch.com/checks/dns-resolution) - [Port](https://harpywatch.com/checks/tcp-port) - [Domain](https://harpywatch.com/checks/domain-expiry) - [DOM](https://harpywatch.com/checks/dom-content) - [Render](https://harpywatch.com/checks/browser-render) - [Protections](https://harpywatch.com/checks/security-headers) - [Compression](https://harpywatch.com/checks/compression) - [Route](https://harpywatch.com/checks/redirect-chain) - [Links](https://harpywatch.com/checks/broken-links) - [Handshake](https://harpywatch.com/checks/tls-handshake) - [Cookies](https://harpywatch.com/checks/cookie-flags) - [Sitemap](https://harpywatch.com/checks/sitemap-health) - [Robots](https://harpywatch.com/checks/robots-policy) - [Cache](https://harpywatch.com/checks/cache-policy) - [CSP](https://harpywatch.com/checks/csp-policy) - [Sampling](https://harpywatch.com/checks/availability-sample) - [Feed](https://harpywatch.com/checks/feed-freshness) - [Socket](https://harpywatch.com/checks/websocket-handshake) - [Mixed content](https://harpywatch.com/checks/mixed-content) - [TTFB](https://harpywatch.com/checks/ttfb-budget) - [Open redirect](https://harpywatch.com/checks/open-redirect) - [CORS](https://harpywatch.com/checks/cors-policy) - [Weight](https://harpywatch.com/checks/page-weight) - [Vitals](https://harpywatch.com/checks/core-web-vitals) - [Third parties](https://harpywatch.com/checks/third-party-data-flow) ## The Nest HarpyWatch's writing on monitoring, uptime and the things that break quietly. Every post is available as Markdown at the same address with a `.md` suffix. - [Staging configuration travels, and agents help it](https://harpywatch.com/blog/staging-configuration-travels.md): A canonical tag pointing at staging, a noindex that shipped, a test API key in production. Each is invisible on a developer's machine and expensive live, and copying config between environments is the fastest way to make something work., 2026-10-01 - [Monitor the site nobody is looking at yet](https://harpywatch.com/blog/monitoring-before-you-have-users.md): The instinct is to add monitoring once a site has traffic worth protecting. That gets it backwards: an empty site is the one failure mode nobody reports, because your first hundred visitors leave instead., 2026-09-29 - [The API contract changed underneath the frontend and nothing failed](https://harpywatch.com/blog/the-contract-changed-underneath.md): One agent edits the backend, another edits the frontend, a field quietly changes type, and every build stays green. The screen renders blank where a number belongs, and only something watching the deployed endpoint will tell you., 2026-09-24 - [Four hops to nowhere: what refactors do to your redirects](https://harpywatch.com/blog/four-hops-to-nowhere.md): Every restructure moves URLs, and every move adds a redirect. Nobody ever removes one. The result is a chain a crawler stops following and a browser spends a second on before it sees a single byte of content., 2026-09-22 - [Eleven domains nobody approved](https://harpywatch.com/blog/eleven-domains-nobody-approved.md): Ask an agent to add analytics and it adds a tag. Do that four times over six months and your page is executing code from hosts no one on the team chose, on your origin, with your users' data., 2026-09-17 - [Reading a site the way a machine does](https://harpywatch.com/blog/reading-a-site-the-way-a-machine-does.md): Your browser smooths over a great deal of what your site actually sends. Here are the terminal commands that show you what a crawler, a link checker or a monitoring probe gets instead., 2026-09-15 - [The outages that live beneath your application](https://harpywatch.com/blog/beneath-the-application.md): Between a visitor typing your name and a request reaching your server sits a system you did not write and cannot review: a registration, a delegation, a zone, and a chain of caches. Here is how each of them fails., 2026-09-10 - [A status page is a sales asset, if it is honest](https://harpywatch.com/blog/a-status-page-is-a-sales-asset.md): Uptime nobody can see is an internal fact. Published with real history, it answers a question buyers were going to ask anyway — and an always-green page nobody believes is worth less than an honest one with incidents on it., 2026-09-08 - [The agent will make the check pass](https://harpywatch.com/blog/the-agent-that-fixed-the-symptom.md): Given a red signal, an agent optimises for the signal. That is not a flaw in any particular tool — it is what optimisation means, and it changes which signals are worth having., 2026-09-03 - [Your monitor cannot live in the thing it monitors](https://harpywatch.com/blog/your-monitor-cannot-live-in-the-thing-it-monitors.md): A health check inside your own stack goes silent at exactly the moment it had something to say. Here are the failure domains an internal check shares with the site, and what an external one sees instead., 2026-09-02 - [The deploy succeeded. That is not the same as the deploy working](https://harpywatch.com/blog/the-deploy-succeeded-and-the-site-is-down.md): A green pipeline reports that a process started. It is compatible with an empty database, a missing environment variable, a stale CDN and every real route returning 500. Only a request from outside settles it., 2026-09-02 - [The agent shipped it and nobody read it](https://harpywatch.com/blog/the-agent-shipped-it-and-nobody-read-it.md): An AI agent can produce a working-looking site faster than any human can review it. The defects live in the gap between the agent saying it is done and a stranger being able to use it., 2026-09-02 - [Knowing before your customers do is the whole product](https://harpywatch.com/blog/knowing-before-your-customers-do.md): Monitoring is usually justified as insurance against downtime. The better argument is commercial: the gap between a customer telling you your site is broken and you telling them is a gap they can feel., 2026-09-02 - [Diagnose before you deploy, not after](https://harpywatch.com/blog/diagnose-before-you-deploy.md): Redirect chains, headers, certificate chains, robots policy and sitemap validity are all observable on a staging hostname, before DNS points anywhere. That is where the checks should run first., 2026-09-02 - [Your agent built a single-page app and the AI crawlers see an empty div](https://harpywatch.com/blog/an-empty-div-to-the-crawler.md): Ask an agent for a website and you will usually get a client-rendered one. The AI crawlers largely do not execute JavaScript, so what they store is an empty div — and one curl command will tell you whether that is your page., 2026-09-02 - [Why certificates still lapse, twelve years after Let's Encrypt](https://harpywatch.com/blog/why-certificates-still-lapse.md): Renewal is automated almost everywhere and certificates still expire in production. The failure has moved: it is no longer the renewal that breaks, it is everything between the renewal and the socket a browser actually connects to., 2026-09-02 - [Two nulls are not zero](https://harpywatch.com/blog/two-nulls-are-not-zero.md): A monitoring dashboard has three ways of not knowing something, and every one of them has been drawn as a confident zero at least once. Here is why that is the most expensive bug a status screen can have., 2026-09-02 - [Thirty-one checks, one grid](https://harpywatch.com/blog/thirty-one-checks-one-grid.md): HarpyWatch runs thirty-one distinct kinds of check against a site — not thirty-one variations on an HTTP request. Here is the full list, what each one is actually for, and why they share a single screen., 2026-09-02 ## Optional - [Full text of every post](https://harpywatch.com/llms-full.txt) - [Feed](https://harpywatch.com/blog/feed.xml) - [Sitemap](https://harpywatch.com/sitemap.xml)