Website security monitoring that reports vulnerabilities on your site.

An automated service that checks your website for malware and for weak security settings, and reports each problem with a severity and a fix. Uptimia checks Google Web Risk on every scheduled scan and, once a day, the site's software versions, TLS settings, security headers, page scripts, DNS records and mail settings.

9 groups on every monitor. Malware and phishing: Google Web Risk lists for malware, social engineering and unwanted software. Software versions: PHP, nginx, Apache, OpenSSL, IIS, WordPress, Drupal and Joomla, as shown in response headers or the generator tag. Security headers: a grade, HSTS and cookie flags. TLS settings: SSL 3.0, TLS 1.0, TLS 1.1, weak cipher suites and the redirect from http:// to HTTPS. Email authentication: SPF and DMARC on your domain. Page content: insecure scripts, frames and stylesheets on an HTTPS page, scripts from a new source and JavaScript libraries with known flaws. DNS records: CAA and DNSSEC. Mail encryption: STARTTLS on your mail servers. MTA-STS: whether your domain publishes a policy record.

You choose per monitor, from every hour to every 7 days; the default is once a day. Malware and phishing are checked on every scheduled scan. The other 8 checks run at most once a day, inside your scans, so a weekly monitor runs them weekly. While an issue alerts, Uptimia reruns the check behind it every hour, so an upgrade or settings fix closes the incident within the hour; a malware or phishing listing closes once Google clears it.

You set it per monitor. Critical issues only is the default; High and critical adds the high ones. Critical covers malware, phishing, unwanted software and end-of-life software. High covers unpatched software, TLS 1.0 or 1.1 and an SPF record that lets any server send mail as your domain. Medium and low issues never alert; they are listed on the monitor page. Results from the page content and mail encryption checks and the checks on verified domains do not send alerts, whatever their severity; they are listed there too.

The alert names the monitor and reads WARNING, or INFECTED when Google Web Risk lists the site. The email alert also names the issue. The monitor page lists every open issue, worst first, with what was found and how to fix it.

Through the same contacts and channels as your other monitors (email, SMS, Slack, Microsoft Teams, Discord, Telegram, WhatsApp, PagerDuty, webhooks and more), with your escalation policies. You can hold an alert for up to 30 minutes before it goes out, 5 by default. A recovery notice is sent when the issues are resolved, unless you turn it off.

No. Uptimia finds and ranks the issues and shows the fix for each one; you or your host make the change. Clearing a Google Safe Browsing warning is Google's process, after you have removed the malware and requested a review.

No. It reads what your site shows in public, with read-only requests, lookups and handshakes. Uptimia does not log in, submit forms, test for exploits or inspect plugins and themes, so it does not replace a penetration test and does not find every weakness.

Uptimia judges the versions the site shows — in the Server, X-Powered-By and X-AspNet-Version headers and the page's generator tag. A server that hides its version, or a CDN in front of it, leaves no version to judge. Debian, Ubuntu and RHEL builds rank one level lower, because those distributions patch old version numbers.

Each monitor starts from one URL and reads that page. Add a monitor for each subdomain or page you want watched. The email, DNS and mail checks cover the domain the URL belongs to. On a verified domain, Uptimia also reads up to 4 pages linked from that URL.

No. Blacklist monitoring checks whether your domain or server IP is listed on DNS blocklists, which affects whether your email is delivered. Security monitoring checks the site itself — Google Web Risk plus the daily checks.

Every paid plan includes security monitors, and the 30-day trial includes them in full. The checks on verified domains need the Professional plan or higher; the trial includes them too. The free plan does not include security monitors.

You add a DNS record or a file to prove you own the domain. The proof covers its subdomains, and Uptimia re-checks it once a day. 5 more checks then run on that domain: open ports, subdomains pointing at unclaimed hosted services, folders of your page's files that list their contents, cross-origin settings and TRACE requests, and insecure forms or content on up to 4 pages linked from the monitored URL. Each run covers up to 20 subdomains, 4 folders and 4 pages; on larger sites the next runs move on to the rest. Sites behind a CDN skip the port check, because it would only reach the CDN. Every one of these checks is read-only.

The page checks read the HTML the server sends, up to the first 2 MB, without running scripts. A script a tag manager adds after the page loads, or code inserted into a file the page already uses, does not show. Libraries are judged from the version in the script's address, so a bundled or renamed copy does not show either. Scripts present at the first scan form the starting list and are not reported. A check that cannot finish keeps its earlier results open and runs again on a later scan; it shows as Unknown and never counts as clear.