Uptime monitoring and health checks
Know it's downbefore they do.
Uptime, SSL, domain and vulnerability monitoring for your websites, APIs, servers and code, checked from six regions and confirmed before anyone is woken up.
Monitoring that removes doubt.
UpHeron confirms outages from every region, checks for more than a 200, sends alerts with context, publishes status without spin, watches the quiet jobs and guards your attack surface.
Require agreement across regions before an incident opens. One noisy datacenter never wakes the whole team.
Your attack surface, watched.
Everything the internet can see of your systems, and everything that quietly expires or turns vulnerable.
- Pro
Software and CVEs on your websites
A weekly scan finds the CMS and plugins, frameworks, web server and runtime a website shows; lockfiles and lists add what it cannot see. Newly published and actively exploited vulnerabilities alert the day they appear, with the version that fixes them.
- Every plan
Code repositories
Point a monitor at a GitHub or GitLab repository: its package.json, lockfiles, Dockerfiles and other manifests are read every day, every hour on Pro, and checked for vulnerable dependencies. Private repositories on Pro.
- Every plan
Certificates and domains
SSL/TLS certificates that fail to renew, and domain registrations about to lapse, read from the certificate and the registry every day, without an extra monitor.
- Every plan
DNS and email authentication
DNS records that change unexpectedly, and SPF, DKIM and DMARC records that stop protecting your domain from spoofing.
- Every plan
Open ports and services
TCP, SSH, SMTP, IMAP, POP, FTPS, NTP, UDP and ping checks show which services answer, and alert when they stop.
- Every plan
Reputation
DNS blocklists for your domain and mail servers, and Google Web Risk for malware and phishing flags.
Vulnerability data from OSV.dev, the GitHub Advisory Database, NVD, the CVE Program, CISA's Known Exploited Vulnerabilities catalog and endoflife.date. How it works
From check to clarity.
- 01
Schedule
The control plane creates durable, idempotent location leases.
- 02
Observe
Agents run checks concurrently and retain results through network loss.
- 03
Confirm
Location quorum and consecutive failures filter transient noise.
- 04
Respond
One incident opens, alerts fire, and recovery closes the loop.
Built for AI agents, too.
Agents read every monitor's status for free over the HTTP API and the MCP server, sign up on their own or for their user with auth.md, and pay for extra monitors with the Machine Payments Protocol, no account needed.
Questions, answered.
What does UpHeron check?
Websites and APIs (status, content, latency and JSON responses), multi-step transactions, SSL certificates, domain expiry, DNS, SPF/DKIM/DMARC, blocklists, TCP and UDP ports, SSH, mail and FTP servers, ping, NTP, cron jobs through heartbeats and webhooks, and code repositories, from up to six regions.
What is external attack surface monitoring?
It is watching what anyone on the internet can see of your systems: websites and the software they expose, certificates, domains, DNS, mail authentication and open services. UpHeron checks each of these continuously and alerts when one breaks, expires or becomes vulnerable.
How do vulnerability alerts work?
We learn the software a website runs from a weekly scan and from the lockfiles, Dockerfiles or lists you import, and the dependencies of a repository from its manifests. Every day it is compared with OSV.dev, the GitHub Advisory Database, NVD, new CVE records and CISA's list of exploited vulnerabilities. A new vulnerability at your chosen severity, an exploited one, or a release losing support sends an alert.
Can I monitor a GitHub or GitLab repository for CVEs?
Yes. Add a Code repository monitor with the repository's URL, or a branch or folder of a monorepo. Public repositories work on the free plan; private ones take a read-only access token on Pro.
How are false alarms avoided?
A failed website check is retried once before it counts, an outage can require agreement from several regions, and alerts go out only after the number of failed checks you choose.
Can AI agents use it?
Yes. Agents read status for free through the HTTP API and the MCP server, can sign up by themselves with auth.md, and can pay for monitors beyond a plan with the Machine Payments Protocol, without an account.
Is there a free plan?
Yes: 5 monitors checked every 5 minutes, uptime history since your first check (errors in detail for 30 days), 10 public status pages, email alerts and repository vulnerability alerts. Pro adds 100 monitors, 10-second checks, six regions, every alert channel and vulnerability alerts for websites.