Question 1

What is WWT (Web Watch Tower)?

Accepted Answer

WWT is a multi-tenant website monitoring SaaS. It checks your sites for HTTP availability (uptime), TLS configuration, certificate expiry, domain (registrar) expiry, and email security records (SPF, DMARC, DKIM). When something breaks it sends notifications via Email, Slack, Telegram or a custom Webhook.

Each user account can belong to one or many organizations. Each organization owns its own list of monitored websites and notification channels.

Question 2

How do I create an account?

Accepted Answer

Go to the "Sign up" page, enter your email, name, password and pick a language. After submitting, an activation email is sent to the address you provided.

Click the activation link in that email. You will then be allowed to log in. The system does NOT issue a session token at the registration step - the activation click is required first. This is by design.

If the activation email did not arrive, you can request a new one from the public "Resend activation" form (it is throttled to prevent abuse).

Question 3

What happens after the first login?

Accepted Answer

On first login a personal organization is created automatically and you are made its owner. From there you can:

- Add your first website on the Dashboard
- Configure notification channels in Settings
- Invite team members from the Team page
- Or create additional organizations from the organization switcher in the top bar

Question 4

What is an organization?

Accepted Answer

An organization is the top-level container for everything you monitor: websites, notification channels, audit logs, settings (maintenance mode, website defaults). Members of an organization share access to all of its data scoped by their role.

Single-user accounts effectively have one personal organization. Teams use one shared organization. Power users can belong to many organizations and switch between them.

Question 5

Owner vs Member - what is the difference?

Accepted Answer

Owner can do everything: manage websites, invite/remove members, change organization settings, toggle maintenance mode, edit website defaults, configure notification channels, promote other members to owner.

Member can view and check websites and read audit logs but cannot change organization-wide settings, cannot invite/remove members, and cannot toggle maintenance mode.

An organization can have multiple owners (multi-owner support). At least one owner is always required - the system prevents demoting the last remaining owner.

Question 6

How do I switch between organizations?

Accepted Answer

Click the organization name in the top-left of the header (next to the WWT logo). A dropdown appears listing every organization you belong to with a role badge (Owner / Member). Click a different organization to switch.

The switch reloads the dashboard with the new organization's websites. Your last-active organization is remembered between sessions.

Question 7

How do I create a new organization?

Accepted Answer

From the same organization-switcher dropdown, click "Create new organization" at the bottom. Provide a name (2–100 characters). The slug is generated automatically.

You become the owner of the newly created organization.

Question 8

Can the same email be in multiple organizations?

Accepted Answer

Yes. WWT uses a single user record per email and tracks organization membership through a pivot table. There is no need to register a separate account per organization. Inviting an email that already exists adds the existing user to your organization.

Question 9

Are there limits on how much I can monitor?

Accepted Answer

Yes. Sensible defaults keep the platform fair for everyone:

- Organizations per user: 10 (organizations you own)
- Domains per organization: 100
- Members per organization: 10
- CSV import: 100 rows per import

You can see your current usage against these limits any time under Settings > Limits. Need higher limits? Contact us and we will raise them for your account or a specific organization.

Question 10

How do I invite a new member?

Accepted Answer

Go to the Team page (visible only to owners). Click "Invite member", enter the email and choose the role (Member or Owner). An invitation email with a one-time link is sent.

The invitee clicks the link and either logs in to their existing account or registers a new one. The pending invitation is then auto-accepted on their next login.

Question 11

How do I promote or demote members?

Accepted Answer

On the Team page, click the role badge next to a member. You can promote a Member to Owner or demote an Owner back to Member. The system blocks demoting the last remaining owner.

Question 12

How do I remove a member?

Accepted Answer

Click the trash icon next to the member on the Team page. You will be asked to confirm. Removing a member revokes their access to this organization but does NOT delete their user account - they may still belong to other organizations.

Question 13

How do I add a website to monitor?

Accepted Answer

On the Dashboard, click "Add Domain". Provide:

- Name - display name shown in lists and notifications
- URL - must be a publicly resolvable HTTP or HTTPS URL
- Comment (optional) - free-text note shown on the dashboard and in CSV export

All other fields (uptime check, intervals, daily check toggles, accepted HTTP codes) come pre-filled from the organization's "Website Defaults" (see Settings → Website Defaults). You can override any of them per-website at creation time or later via the website's settings modal.

Question 14

Why does it reject some URLs?

Accepted Answer

WWT validates URLs to prevent SSRF (Server-Side Request Forgery). Rejected:

- Localhost / loopback names (localhost, localtest, local, localtunnel)
- Private IP ranges (10/8, 172.16/12, 192.168/16, 127/8, 169.254/16, ::1, fc00::/7)
- Cloud metadata endpoints (e.g. 169.254.169.254)
- Tunnel suffixes used for SSRF bypass (.nip.io, .xip.io, .ngrok.io, .ngrok-free.app, .tunnelto.dev, .burpcollaborator.net)

The check is label-based, so legitimate domains containing substrings like "local" (e.g. localzen.com) are NOT blocked.

Question 15

What is the comment field for?

Accepted Answer

Free-text annotation. Useful for: ticket numbers, owner team, "scheduled migration on 2026-06-01", or any context another team member should see when looking at the website list. The comment is included in CSV export.

Question 16

How does uptime monitoring work?

Accepted Answer

The scheduler runs every minute. On each tick, an orchestrator process selects the websites that are due for a check, splits them across up to 15 parallel worker processes, and each worker performs an HTTP GET against its assigned websites.

If the response status code matches the website's "accepted HTTP codes" rule, the check is a success. Otherwise it is a failure (also: connection errors, DNS failures, timeouts).

Question 17

What status values can a website have?

Accepted Answer

- UP - last check succeeded, or recovered from DOWN
- DOWN - failure threshold reached (see below); this is the public, alerted state
- pending - added but never checked yet (very short-lived)
- DISABLED - uptime checking is turned off for this website (check_uptime = false); the row is shown in red on the dashboard

Question 18

What is "failure count threshold" and why does it matter?

Accepted Answer

Each website has a per-website setting "failure count threshold" (default 2 or 3). The website is only marked DOWN - and only triggers a DOWN notification - after that many consecutive failed checks. This filters out short transient glitches.

Concretely: with threshold = 3, the site needs three consecutive failures in a row before any alert fires. A single intermittent timeout that recovers on the next check produces no alert and no status change in the database.

Once the threshold is reached, the status flips to DOWN and the timestamp last_down_at is recorded. Any subsequent failure within the same outage does NOT re-alert.

Question 19

How fast is a recovery detected?

Accepted Answer

Sites currently in DOWN status are re-checked every minute (regardless of their per-site status_check_interval). As soon as a successful check comes back, a "RECOVERED" notification is sent showing the precise downtime computed from last_down_at to the recovery timestamp.

Sites in the "flaky phase" (one or more failures, but threshold not yet reached) are also re-checked every minute, so a real outage is confirmed quickly instead of waiting a full interval for the next failure.

Question 20

What is "Status check interval"?

Accepted Answer

How often to check the website when it is healthy (UP). Available values: 1, 5, 10, 15, 30, 60 minutes. Default 5.

This interval is bypassed for sites currently DOWN or with at least one consecutive failure recorded - those are checked every minute.

Question 21

What is "Timeout threshold"?

Accepted Answer

Maximum number of seconds to wait for the HTTP response before treating the check as a failure. Common values: 5, 10, 15, 30 seconds. Default 15.

Question 22

Which HTTP status codes are considered a success?

Accepted Answer

Per website, you choose which response code classes count as success: 2xx, 3xx, 4xx, 5xx. Defaults: 2xx + 3xx + 4xx accepted, 5xx rejected.

Some sites legitimately return 401 or 403 to unauthenticated probes - leaving 4xx accepted prevents false positives. Disable 4xx if your monitored URL should always return 200.

Question 23

Can I check a single website on demand?

Accepted Answer

Yes. On the dashboard or website-details page, click "Check now". This runs the same check pipeline immediately for that one website without waiting for the next scheduled tick.

Question 24

What are "daily checks"?

Accepted Answer

In addition to per-minute uptime checks, WWT runs slower checks once per day (around 01:00 UTC) for each website. Each check has its own enable toggle on the website's settings:

- Domain expiry - RDAP query to the registrar for the domain registration expiry date
- TLS version - what TLS protocol versions the server supports
- Certificate expiry - when the X.509 certificate expires
- SPF / DMARC / DKIM - DNS-based email security records

Daily checks are run system-wide once per day; there is no per-website cadence selector for them - only on/off.

Question 25

My domain shows expiry "Unknown" - why?

Accepted Answer

Some TLDs do not expose RDAP (e.g. some country-code TLDs like .eu had no public RDAP for a long time), or the registrar's RDAP server is unreachable, or the response did not include a registration-expiry event.

In those cases, the failure is recorded in the audit log with action rdap_failure and the reason (tld_not_supported, http_error, no_expiry_event, exception). You can then enter the expiry date manually - see below.

Question 26

How do I set the domain expiry date manually?

Accepted Answer

Open the website's details page. In the "Registrar Status" panel you will see a date picker for "Manual expiry override". Pick the date and click Save. The website is then marked as having a manual expiry, and RDAP checks for it are skipped (the manual value is used instead).

Click "Clear" to remove the override and let RDAP take over again. Both actions are recorded in the audit log (domain_expiry_manual_set / domain_expiry_manual_clear).

Question 27

What does the TLS check look at?

Accepted Answer

It connects to the host on port 443 and reports which TLS protocol versions the server negotiates: TLS 1.0, 1.1, 1.2, 1.3. Modern best practice is to support 1.2 and 1.3 only; older protocols are flagged as warnings.

Question 28

What does the certificate check look at?

Accepted Answer

It reads the server's X.509 certificate and reports the expiry date plus the number of days remaining. Notifications are sent at 30, 14, 7, 3 and 1 day before expiry (configurable per channel).

Question 29

What is SPF / DMARC / DKIM?

Accepted Answer

These are DNS records that protect against email spoofing. - SPF (TXT record at the apex): which servers are authorized to send mail for the domain - DMARC (TXT record at _dmarc.): policy for handling unauthenticated mail (none / quarantine / reject) and reporting addresses - DKIM (TXT record at ._domainkey.): public key used to verify outbound mail signatures WWT inspects each record and reports issues such as: missing record, multiple SPF records, syntax errors, weak DMARC policy. DKIM additionally requires you to specify a selector - it is not auto-discovered.

Question 30

What notification channels are supported?

Accepted Answer

Nine channels can be configured per organization:

- Email - uses the system mail transport
- Slack - incoming webhook URL
- Microsoft Teams - incoming webhook (legacy connector or Power Automate Workflow URL)
- Discord - incoming webhook URL
- Mattermost - incoming webhook URL (works with self-hosted instances)
- Telegram - bot token + chat ID
- PagerDuty - Events API v2 routing key (auto-resolves on UP)
- Pushover - application token + user/group key
- Webhook - POST a JSON payload to your own URL

You can configure as many channels as you need, of any combination of types - for example two Slack channels pointing at different teams, plus PagerDuty for on-call escalation, plus an Email channel for the customer.

Question 31

Can each channel be in a different language?

Accepted Answer

Yes. Every notification channel has its own language setting (English by default). The same DOWN incident can be routed in Polish to one Slack channel, in English to another, and as a German email to a customer - all simultaneously, with the message content written in the language you picked per channel.

This is designed for international teams where different stakeholders prefer different languages. Change a channel's language at any time from Settings → Notification Channels.

Question 32

How do I add a notification channel?

Accepted Answer

Go to Settings → Notification Channels (owner only). Click "Add channel", pick the type, choose the notification language, fill the channel-specific fields and save. You can disable a channel without deleting it via the toggle next to its name. Each channel has a "Test" button that fires a sample notification to verify the configuration.

Question 33

Can I send certain alerts to certain channels only?

Accepted Answer

Yes. When you assign a channel to a website you can pick which event types it receives: uptime incidents (DOWN/UP), domain-expiry alerts, certificate-expiry alerts. A common setup: PagerDuty + Slack for uptime (so the on-call gets paged), and email + a different Slack channel for expiry warnings (so the office knows about renewals without paging anyone at 3am).

Question 34

When does WWT send notifications?

Accepted Answer

- DOWN alert - when a website's failure count reaches its threshold
- RECOVERED alert - when a website that was DOWN returns to UP
- Domain expiry / TLS / Certificate expiry - when a daily check detects an upcoming expiry within the warning window

A single transient failure that recovers before reaching the failure-count threshold does NOT generate any notification - only confirmed outages alert.

Question 35

I am receiving notifications but want to silence them temporarily - what do I do?

Accepted Answer

Use Maintenance Mode (Settings → Maintenance Mode, owner only). When enabled, all notification dispatch (DOWN, UP, expiry) is short-circuited for that organization until you disable it again. Suppressed events are still recorded in the audit log with action notification_suppressed_maintenance so you can see what would have fired.

Question 36

Can I see which notifications were sent?

Accepted Answer

Yes - the Audit Logs page in Settings lists every dispatched notification with the channel, target website and outcome. Filter by action notification_sent to narrow it down.

Question 37

What is Maintenance Mode?

Accepted Answer

An organization-wide kill switch for notifications. While enabled, WWT continues to perform every check and record every state change, but no DOWN, UP or expiry notification is dispatched on any channel.

Use it during planned downtime, deployments, or any time you want silence without disabling individual channels.

Question 38

How do I enable it?

Accepted Answer

Settings → Maintenance Mode (owner only). Click the big toggle, optionally provide a reason. The page records who enabled it and when. Toggle again to disable.

Question 39

What stays visible while in maintenance?

Accepted Answer

- The dashboard, status badges and charts continue to update normally
- Audit log keeps a row for every check
- Each suppressed notification is logged with action notification_suppressed_maintenance so nothing is lost - you can audit what would have fired

Recovery notifications that would have fired during the window are also suppressed, so you do not get a single huge "recovered" burst when you turn maintenance off.

Question 40

What are Website Defaults?

Accepted Answer

An organization-level template for new websites. When you click "Add Domain", every field is pre-filled from these defaults. You can override any value per-website. Existing websites are NEVER modified when you change defaults - they apply only to new ones.

Question 41

Where are they configured?

Accepted Answer

Settings → Website Defaults (owner only). Available defaults:

- Uptime check on/off
- Status check interval (1 / 5 / 10 / 15 / 30 / 60 min)
- Timeout threshold (5 / 10 / 15 / 30 s)
- Failure count threshold (1 / 2 / 3 / 5 / 10)
- Accepted HTTP code classes (2xx / 3xx / 4xx / 5xx)
- Daily checks: Domain expiry / TLS / Certificate expiry on/off
- SPF check on/off
- DMARC check on/off

DKIM is intentionally not in the defaults because it requires a per-domain selector.

Question 42

What if I never customize the defaults?

Accepted Answer

Then the system-wide built-in defaults apply: uptime on, 5-min interval, 15s timeout, threshold 2, 2xx/3xx/4xx accepted, all daily checks on, SPF/DMARC off.

Question 43

What do the stat cards on the Dashboard show?

Accepted Answer

The cards summarize the current organization:

- Total websites - count of all websites, with breakdown badges: UP / DOWN / OFF (DISABLED)
- Overall Uptime (7d) - average uptime across all websites for the last 7 days
- Incidents (7d) - number of distinct DOWN incidents in the last 7 days

The Overall Uptime and Incidents cards are clickable filters: clicking activates a filter that narrows the website list to only the relevant rows (sites under 100% uptime, or sites with incidents). Click again to clear.

Question 44

How do I sort and filter the website list?

Accepted Answer

Click any column header to sort by that column. Use the search box to filter by name, URL or comment. The status, TLS, certificate expiry and domain expiry columns each show pill-style badges with color-coded severity.

If the uptime check is disabled for a website, all of those columns show a red "DISABLED" pill.

Question 45

How do I export the list?

Accepted Answer

Click "Export CSV" on the dashboard. The file contains every website in your current organization with: name, url, status, check_uptime, response_time_ms, status_code, tls_version, tls_check_enabled, cert_expires_at, cert_days_until_expiry, cert_check_enabled, domain_expires_at, domain_days_until_expiry, domain_registrar, domain_check_enabled, last_checked_at, comment.

The file is UTF-8 with BOM so Excel opens it correctly with non-ASCII characters.

Question 46

How do I import websites in bulk?

Accepted Answer

Settings → CSV Import (or the import button on the dashboard). Upload a CSV with at minimum the URL column. Optional columns control per-website settings - see the in-app schema help for the full list.

Validation errors are reported per row; valid rows are imported, invalid rows are skipped and shown in the result summary.

Question 47

What is on the Website Details page?

Accepted Answer

Open it by clicking a website name on the dashboard. It shows:

- Status badge in the header (UP / DOWN / pending / DISABLED)
- Uptime percentage and response time charts (configurable period)
- Recent checks history with timestamps, status codes and error messages
- Registrar / Domain panel - current registrar, expiry date, manual override controls
- TLS panel - supported protocol versions, certificate details
- SPF / DMARC / DKIM panels - record contents and detected issues
- Per-website settings button (opens settings modal)
- "Check now" button
- Link to the Domain Health Report

Question 48

What is the Domain Health Report?

Accepted Answer

A printable summary view aggregating uptime, response times, incidents and security checks for one website over a chosen period. Useful for sharing a status snapshot with non-technical stakeholders.

Question 49

What is recorded in the audit log?

Accepted Answer

Every notable action is recorded with timestamp, actor (user or "system"), entity affected, and structured metadata. Examples:

- notification_sent (DOWN, UP, certificate_expiry, domain_expiry, etc.)
- notification_suppressed_maintenance
- maintenance_mode_enable / maintenance_mode_disable
- website_defaults_update
- rdap_failure
- domain_expiry_manual_set / domain_expiry_manual_clear
- member_invited / member_promoted / member_demoted / member_removed

The log is the source of truth when investigating "did the alert actually go out?" or "who changed this setting?".

Question 50

How long is the audit log kept?

Accepted Answer

Indefinitely. There is currently no retention cap. You can export filtered slices via the audit-log table's controls.

Question 51

How do I change my password?

Accepted Answer

Settings → Profile → Change password. Provide your current password and the new one (twice). Strong-password rules are enforced.

Question 52

How do I enable 2FA?

Accepted Answer

Settings → Profile → Two-factor authentication. Scan the QR code with an authenticator app (Google Authenticator, 1Password, Bitwarden, Authy, etc.), then enter the 6-digit code to confirm. Recovery codes are generated - store them safely, they are the only way back in if you lose the authenticator.

Once enabled, every login asks for the 6-digit code in addition to email + password.

Question 53

I forgot my password. What now?

Accepted Answer

Click "Forgot password" on the login page, enter your email and submit. A reset link is sent to your address (throttled to prevent abuse). Open the link, choose a new password, then log in.

Question 54

How do I change my interface and email language?

Accepted Answer

Two ways:

- Quick toggle: language switcher in the top header - applies immediately to the interface and is saved to your profile
- Full form: Settings → Profile → Language

Notification emails are sent in your preferred language. The system implements Laravel's HasLocalePreference interface, so notifications and most mailables honor your saved locale automatically.

Question 55

How is account access protected?

Accepted Answer

- Email verification is mandatory before login (activation link)
- Optional two-factor authentication (TOTP)
- Throttled login, password reset, and resend-verification endpoints
- Session tokens are scoped per device; logging out revokes the current session
- Owner-only access to organization-wide controls (notification channels, defaults, maintenance, team management)

Question 56

How are monitored URLs protected against SSRF?

Accepted Answer

The DomainValidator service rejects any URL that resolves to a private network, loopback, link-local or cloud-metadata address. Public DNS labels matching known local-development indicators are also blocked. The check runs at add-time and again at check-time against the resolved IP - DNS rebinding tricks are rejected.

Question 57

My website shows DISABLED but I want to monitor it

Accepted Answer

Open the website's settings modal and turn "Uptime check" back on. The DISABLED pill disappears on the next dashboard refresh and the next scheduler tick will check the site.

Question 58

Notifications are not arriving - checklist

Accepted Answer

- Is Maintenance Mode enabled for the organization? Check Settings → Maintenance Mode
- Is the relevant notification channel toggled on? Check Settings → Notification Channels
- Did the channel's "Test" button succeed? If not, the credentials are wrong
- For Slack/Telegram/Webhook: did the third party return a non-2xx? Check the audit log entry for the notification - failures include the response status
- Email: check spam, and that the From-domain has SPF/DMARC aligned

Question 59

A check is failing intermittently and I do not want noise - what knobs help?

Accepted Answer

Open the website's settings modal and increase the failure count threshold (e.g. from 2 to 5). The site must then fail that many consecutive checks before any DOWN alert fires. Combine with a longer "Status check interval" if the site is slow but not actually unhealthy.

Question 60

How do I delete a website I no longer monitor?

Accepted Answer

On the dashboard, click the trash icon on the row (or use the "Delete" button on the website's details page). You will be asked to confirm. Deletion is permanent and removes the website along with its uptime history.

Frequently Asked Questions

Getting started

Organizations & multi-tenancy

Team management (owner only)

Adding & configuring websites

Uptime monitoring

Daily checks (domain, TLS, certificate, email)

Notifications

Maintenance mode

Per-organization website defaults

Dashboard

Website details page

Audit logs

Profile, security & 2FA

Security model

Troubleshooting