How do I know whether my website is down or has been altered?
By checking two things at every interval: whether the website answers, and whether the page is still the one you approved. In Monitor, a website is added with just its address. 2N5’s servers visit it from the outside, as a visitor would, and a confirmed failure opens an incident and climbs the same escalation ladder as the voice circuits.
How does Monitor know the website is down?
Every five minutes by default, Monitor visits the address and waits for the page to answer. Each result has a state.
| Result | What Monitor does |
|---|---|
| The website answers normally | Records the response time and moves on |
| The website answers slowly, or the certificate expires in a few days | Marks it degraded: a warning that does not count as downtime |
| The address does not exist, the connection is refused, the secure connection fails, the server does not answer in time, or it returns an error | Repeats the check; consecutive failures open a downtime incident |
| The certificate has expired | Counts as an outage |
The interval, the number of retries, and the slowness limit can be adjusted per website. Two weeks before a certificate expires, your company’s contacts already get a notice.
If the problem is on 2N5’s own side, for example the checker having no internet access, the result is recorded as not judged: it does not count against your website, and 2N5 is the one notified.
What if the website stays up but has been altered?
That is the hacked or tampered website: the page opens normally, but it is no longer yours. An availability check does not notice, because the server answers. That is why Monitor offers, for each website, the content check: one switch, Also check this website’s content, when you add or edit the website.
When you switch it on, Monitor reads the live page three times and keeps the result as the reference. There is nothing to upload and no rules to write: the reference is always the page that is live at that moment, and the check follows the same schedule as the website’s own test. At every check, it reads the website again and compares:
- Defacement or error phrases, from a default list kept by 2N5.
- Text and structure: how much of the text changed and how much of the page structure stays the same, within fixed limits.
- Unexpected scripts: a script from an address that was not in the reference, a new file, code written into the page that changed, or a new event handler. The alert says “possible code injection”.
- Redirects: the website now ends up at another address.
A small change within the limit raises no alert: the reference follows the page. Parts that change by themselves, such as a clock or a visitor counter, are already ignored. A page built entirely by JavaScript cannot be content-checked: it reads as unreadable.
What does your team receive when the content changes?
The website shows as Content changed, a state worse than Up and better than Down, and an incident of its own, which Monitor handles like any other: it alerts the first tier by email, with a link to acknowledge in one tap, moves up a tier if nobody takes ownership, and tells your company’s contacts when the page is back to normal. Maintenance windows silence the alerts during planned work.
If the website goes down at the same time, there is a single incident, the outage, and the content change stays as a line in the observation log. A slow website plus a content change are two incidents. The website’s page has two content sections, under Answers and Certificate: the state and what changed, and the checks. The incident page shows where on the site the text changed, what was removed and what was added, and which scripts are new. There is a single question: was this change made on purpose? If it was, This change is expected replaces the reference and closes the incident.
How does the website appear in the report?
The monthly report has an online services page with each website’s availability, calculated like the data circuits’: an outage is downtime, degraded is shown but does not count, and time when 2N5 could not check is left out of the calculation. It also shows the average response time.
Content changes have a section of their own. They never enter availability, because an altered website is up, and they appear with the number of incidents, how long the page differed from the reference, how many changes were accepted, and the date of the last one. The availability calculation follows the SLA concept.
How does this fit with the rest of Monitor?
The website is one more item on the same account, beside the voice circuits and the internet links: the same contacts, the same ladder, the same maintenance windows, the same report. For the company’s mailbox, see email monitoring. How 2N5 runs the service for you is described in How it works.
Frequently asked questions
What happens if my website is altered?
The website shows as Content changed and Monitor opens a content incident, which alerts the first tier of your ladder by email. If nobody acknowledges in time, the alert moves up tier by tier. The incident shows what changed on the page, in which part of it, and which scripts appeared.
How does Monitor know the website was hacked?
It does not guess: it compares. The page it reads now is checked against the stored reference, and Monitor alerts you when the text or structure changes beyond the limit, a defacement or error phrase appears, the website ends up at another address, or a script appears that was not in the reference. The limits are fixed: there is nothing to configure.
Can I accept an expected change?
Yes. On the incident, the “This change is expected” button makes today's page the new reference and closes the incident, with your name recorded. There is no approval queue: whoever has access decides on the spot, and small changes within the limit are followed automatically.
Does a content change count as the website being down?
No. An altered website is still up, so a content incident never enters the downtime calculation. It appears in its own section of the monthly report. If the website goes down while its content is changed, there is a single incident, the outage, and the change stays noted in the observation log.
Does a slowdown or a brief error trigger an alert?
No. A check that fails is repeated, and only consecutive failures open an incident. A slow website, or one whose certificate is close to expiring, shows as degraded, a warning that does not count as downtime. If the failure is on 2N5's own side, the result is recorded as not judged and does not count against your website.
How do I detect website defacement?
By comparing the live page with a saved reference on every check. Monitor by 2N5 alerts when the text or structure changes beyond the limit, a defacement or error phrase appears, the website ends up at another address or a new script shows up, and it opens a content incident. Defacement is caught even while the site stays online.
How do I monitor whether my website is down and get an alert?
With automatic checks run from outside your company at a fixed interval. Monitor by 2N5 loads the site, repeats a failed check and opens an incident only after consecutive failures, which avoids false alarms. The alert reaches the first layer of your contact ladder by email and moves up a layer if nobody acknowledges in time.