How to Run a Five-Minute Monthly Health Check on Your Website

Most website problems do not arrive with a warning. A certificate quietly expires, a server stops answering at 2 a.m., or mail starts landing in spam because an address on your shared server was listed somewhere you never look. By the time a customer tells you, the damage is already done. A short monthly check catches all three while they are still small, and it takes about five minutes once you know the order.

Minute one: was the site actually up?

Start with uptime, because a site that was down is the problem your visitors already noticed. Your own memory is a poor guide here. You probably visited the site when it was working, and nobody phones you to say it loaded fine at lunchtime.

Open the Uptime Monitor and add your web address if you have not already. It checks the site every five minutes and keeps 30 days of history on a status page you can bookmark, so this monthly minute is a review, not a guess. Look for gaps in the history, and for slow responses as well as outright failures. A site that answers, but takes far longer than usual, is often the early sign of a server under strain, and it is cheaper to investigate now than after it stops answering altogether.

If you find a gap, note the time it happened and how long it lasted before you do anything else. That note is what your host needs if you have to ask them what happened. Our post on knowing your website is down before your customers tell you explains how to set this up so the next outage reaches you first.

Minutes two and three: how long is left on the certificate?

Next, check the certificate. An expired certificate does not quietly degrade your site. Browsers replace it with a full-screen warning, and most visitors leave rather than click past it. Renewal is usually automatic, which is exactly why it is easy to stop thinking about it, until the one renewal that fails.

Run your domain through the SSL Checker. It reads the public Certificate Transparency logs, the same records browsers rely on, and shows who issued the certificate, exactly when it expires, and every name it covers. You are looking for three things. First, the expiry date, and how much time is left. Second, the names covered: the certificate must cover both the www version and the version without www, and every subdomain you actually use, or visitors to the uncovered name will see a warning even though the main site is fine. Third, whether the certificate has been revoked, which can happen after a key leak.

Act on what you find, not on a fixed number of days. If the expiry date is close and renewal is automatic, check that the renewal is actually scheduled and that your host or certificate provider has a working contact address for you. If renewal is manual, put the renewal date in your calendar now, with a reminder a week before it. The old habit of checking once a year no longer fits: since 15 March 2026 the maximum validity for a new public certificate has been 200 days, falling to 100 days in March 2027 and 47 days in March 2029, so certificates now turn over several times a year.

Minutes four and five: is your mail address listed anywhere?

Finally, check blacklists, even if you never send bulk email. A blacklist is a list of IP addresses or domains linked to spam, and mail providers check those lists before deciding where your mail goes. Being listed does not mean you sent spam. On shared hosting, another customer on the same server can cause the listing, and every sender sharing that IP address feels it.

Run both your domain and your sending IP through the Blacklist Checker. It checks an IP address against Spamhaus ZEN, SpamCop and Barracuda, and a domain against Spamhaus DBL and URIBL, and it first runs a control query so a list that is not responding is not trusted on anything else. A clean result takes seconds and is worth recording.

If you are listed, pause and find the cause before you ask any list to remove you. Check for a compromised mailbox, a sudden jump in outgoing mail, a form on your site being abused to send messages, or a neighbour on shared hosting doing the same. Fix that first, then follow the removal instructions on the list's own site. Asking for removal while the cause is still active usually ends with a fast relisting, and repeat requests get slower answers. Removal from the major lists is free, so ignore anyone offering paid delisting. If the listed IP belongs to your host or your email provider rather than to you, send them the listing details and ask them to handle it. Our post on fixing a blacklist listing caused by someone else on your server walks through that case in detail.

The five-minute checklist

Copy this into your notes and tick it off each month:

1. Uptime: no gaps in the last 30 days of history, and no long slow periods. Note the date and time of any gap.
2. Certificate: expiry date recorded, enough time left for renewal, both www and non-www covered, not revoked.
3. Blacklist: domain and sending IP both checked, result recorded. Any listing investigated for its cause before removal is requested.
4. Follow-up: anything that failed has a named next step, an owner, and a date. A failed check with no follow-up is just a worry you wrote down.

If everything passes, you are done, and the note you kept is the proof. If one check fails, fix it in the order above: restore uptime first, because visitors are affected now; renew or repair the certificate second, because browsers block the site without it; then work the blacklist, because mail reputation recovers more slowly and needs the cause fixed first.

What to do first

Do this month's check today, before the calendar reminder exists, and set the recurring reminder while you are here. Add your site to the Uptime Monitor so next month's first minute is a review of real history instead of a guess, run the SSL Checker and write down the expiry date, and run the Blacklist Checker on your domain. Five minutes now, on a quiet day you chose, is the difference between a fix you schedule and a failure your customers report.