What to Monitor for Every Client: An Agency Starter Checklist

When you take on a new client, "we will monitor your site" sounds great until you have to decide what that actually means. The reliable answer is a small, repeatable bundle of monitors you stand up for every client — the same checklist, every time, so nothing falls through the cracks when you are onboarding three sites in a week.

Here is the starter checklist, organized by what you are protecting.

1. The Domain and the Certificate

• Domain expiry monitor — the domain itself lapsing is the single most catastrophic and preventable client outage there is. Watch it for every client, always.
• WHOIS change monitor — alert if registrar, nameservers, or status change unexpectedly (the signature of a hijack attempt).
• SSL certificate monitor — days remaining and validity. Catch the expiry that otherwise happens quietly at 2 a.m. on a Sunday.

2. The Website Itself

• HTTP monitor with a keyword assertion — up is not enough; assert that real content appears, so a broken-but-200 page still alerts.
• Security headers and mixed content — quick wins that catch configuration drift and injected HTTP resources.
• Content change monitor on the homepage and key pages — flags defacement or an unwanted edit fast.
• Broken links on marketing pages, and Lighthouse on the pages that matter for SEO and conversion.

For WordPress clients, add the checks from our WordPress monitoring guide and WordPress security monitoring; for WooCommerce stores, add checkout flow monitoring.

3. Email and DNS (Everyone Forgets This)

• DNS records monitor — alert on changes to MX, TXT (SPF/DKIM), A, and CNAME records. A broken MX record silently kills the client's email.
• Blacklist / DNSBL monitor — the domain or mail server landing on a spam blacklist kills deliverability invisibly.
• SMTP and IMAP checks — if the client relies on their own mail server, verify it is accepting connections and STARTTLS is on.

4. The Things That Are "Someone Else's Job"

Check the pieces outside your control too — payment gateways, payment providers, and API services the site depends on. Monitorion's third-party dependency tracking polls major providers and correlates them with your monitors, so a payment outage stops looking like a bug you caused.

5. The Deliverables

A monitoring setup without a deliverable is invisible value. For each client:

• A status page they can share (on your brand or theirs, on a custom domain with white-label).
• A monthly SLA report — uptime, response times, incidents — that becomes the proof point at renewal.

Both are exactly what turns this checklist from internal busywork into the service you charge for.

Stand It Up Per Project

Put each client in their own project so alerts, team access, and reports stay isolated. Most of the checklist above runs on the free plan (15 monitors: HTTP, ping, SSL, domain expiry, security headers, mixed content, multi-step); DNS, content change, blacklist, and SMS/Slack alerting start at Pro.

Create a free account and turn this into a template you reuse at every onboarding.