Most websites run without active monitoring. They're looked at when something goes wrong — a client calling, an email bouncing. That's a firefighter logic that costs a lot. Here's what we continuously monitor on the 120+ sites we manage, and why a site without monitoring is a site at risk.
The three-hour rule
In our business, there's a simple empirical rule: a problem detected in under three hours rarely costs more than half a day to fix. Detected three days later, it can cost a week. Three weeks later, it's often a disaster.
As long as an outage is only known to the technical team, it stays small. As soon as it starts being seen by visitors, clients, or search engines, it turns into a reputation, ranking, or revenue problem.
Continuous monitoring is the tool that brings all problems back into the three-hour window.
What we concretely monitor
Availability and loading speed
Every minute, from several geographically distributed servers, we test whether your site responds and with what delay. If three consecutive tests fail or if loading time exceeds your threshold (usually three seconds), an alert goes out to our on-call team.
Why test from multiple locations? Because an outage can affect only one region of the world. A Moroccan site that goes down for European visitors but remains accessible from Asia is technically "down" for your real clients.
Performance isn't just about visitor comfort. Since 2021, Google has used it as an official ranking criterion. A site that goes from two to five seconds of load time can lose 30% of its organic traffic in a few weeks. Monitoring detects these degradations before they impact your SEO.
Critical configurations: SSL, DNS, mailboxes
Three invisible elements can break your business overnight.
The SSL certificate has a limited lifespan — typically ninety days for Let's Encrypt. When it expires, your site displays a warning that drives away 99% of visitors. We check the expiration date of all your certificates every day, and we alert at thirty, fifteen, and three days before the term if renewal hasn't happened automatically.
DNS records that make your professional emails work (MX, SPF, DKIM, DMARC) can be accidentally altered during a modification or become desynchronized. A blocked mailbox for a week means dozens of lost leads without anyone noticing.
The mailboxes themselves : we verify they send and receive correctly, that quotas don't saturate, and that your domain's reputation stays good with Google and Microsoft.
Restorable backups
Having backups is not enough. You also need to regularly verify that they are restaurables. Too many incidents have revealed that archives accumulated over years were actually corrupted.
Every week, we test a partial restoration of your backup in an isolated environment. If the restoration fails, or if the backup is incomplete, we know about it immediately.
Compromise signals
This is the most delicate category. An intrusion on a WordPress site can remain invisible for weeks, while the attacker prepares their exploitation. During this period, your site is compromised but appears normal.
We monitor the appearance of unexpected PHP files in the folder uploads, modifications to the file wp-config.php, the appearance of new administrator accounts, and abnormal login attempts. It's precisely this system that allowed us to detect within a few hours the twenty-one sites compromised in April 2026 via the Unlimited Elements vulnerability.
Google indexing and SEO
Beyond the site itself, we monitor its presence on Google. If an important page suddenly disappears from the results, or if organic traffic drops by more than 30%, it is a signal that needs to be addressed.
The causes can be multiple: Google penalty, broken indexing, accidentally noindexed content, robots.txt configuration error. The earlier the detection, the faster the recovery.
Three concrete questions about monitoring
How often do we check your site's availability?
Every minute, from several geographically distributed servers. If three consecutive checks fail, an alert goes to our on-call team. The average time between an actual outage and our first intervention is four minutes. This frequency is the same regardless of your host or site type.
When is your SSL certificate alerted before it expires?
Three successive alerts are triggered: at thirty days before the term, at fifteen days, then at three days. Most certificates renew automatically with modern hosts, but automation can fail — that's precisely what this system detects before your visitors see a security warning.
How do you know a backup will actually be restorable?
We test a partial restoration of your backup every week, in an environment isolated from the production site. This check is not optional. If the restoration fails, or if the archive is incomplete, we know immediately. It's the only honest method: an untested backup is just hope, not insurance.
What happens without monitoring
Three real cases encountered with prospects who had no system in place.
The expired certificate. A merchant who contacted us in 2025 had his SSL certificate expired for fifteen days. His online sales had dropped by 80% because visitors saw the Chrome warning and abandoned their carts. No one had alerted him.
The invisible backdoor. A medical practice had its site compromised for three months. A vulnerability in a third-party plugin had allowed the installation of a backdoor. The site was used to spread spam on other sites without regular visitors noticing. The practice discovered the problem when its domain was blacklisted by Google.
The lost emails. An industrial SME in the Casablanca region had modified its DNS to point to a new mailing provider. The modification had broken SPF records, and all emails sent from their professional mailboxes had been landing in spam at Gmail and Outlook for two weeks. No responses to prospects during that time.
In none of these cases had the client done anything wrong. Simply, no one was watching while they slept.
Why we do it systematically
Across all the sites we maintain, monitoring is not an option. It's included in every maintenance plan, at no extra cost, because it's what makes maintenance truly useful.
An agency that charges you for maintenance without monitoring is charging you for cleaning up problems you report to them. That's a reactive logic. Monitoring, on the other hand, is a logic of prevention.
To see the difference between the monitoring your host performs (infrastructure) and that of an agency (your application), our article What your host doesn't do details the boundary.
Frequently Asked Questions
If you monitor everything, why should a client still intervene?
You keep control over decisions. Monitoring detects issues, our teams diagnose them and propose actions. For critical interventions (structural changes, editorial choices, crisis communication), you remain the decision-maker. The goal isn't to replace your vigilance, but to save you from having to be vigilant 24/7.
How long does it take to set this up on an existing site?
One to two hours. We activate the probes, configure thresholds based on your activity, and test that everything comes back up. You see no service interruption.
Doesn't my host already do this?
Serious hosts monitor infrastructure (servers, disks, network). They don't monitor your application: your WordPress, your plugins, your content, your SEO, your emails. The host guarantees the house stands. We guarantee the interior works.
What if I'm on a host other than Infomaniak?
Monitoring is compatible with all WordPress hosts on the market. We mainly work on Infomaniak for sites we host, but we also monitor client sites on OVH, o2switch, WP Engine, or dedicated servers.
Does it create extra traffic to my site?
Very little. The probes consume the equivalent of about three visitors per day, spread over 24 hours. It's imperceptible for your stats and performance.
Want to know where your site stands today?
Our free audit includes a complete assessment of your current monitoring setup. Availability, certificate, performance, file integrity, restore capability. You leave with a clear report on what's in place and what's missing.
Request the audit on WhatsApp →