WordPress fails in ways a basic uptime check does not see. The classic example: the database goes away, WordPress renders a tidy page that says “Error establishing a database connection”, and returns it with HTTP 200. Your monitor says everything is fine. Your client’s customers see an error.
Here are the five external checks we set up on every WordPress site, why each exists, and how to configure them. Together they make a standard set you can create in Tenium by hand or from a CSV; there is no one-click template.
1. Home page: status code plus keyword
The home page check should require two things: a 2xx status and the presence of a phrase that only appears when the site rendered properly.
The phrase does not have to be visible text. wp-content is a good default because every properly rendered WordPress page references assets under that path, while the database error page and most PHP fatal error pages do not. For shops, use a phrase from the real page: the store name in the footer, or the first product title.
Also add a must not contain rule for Error establishing a database connection and Fatal error. That turns the common failure modes into explicit alerts with a useful message, instead of “keyword missing”.
Interval: 30 or 60 seconds. This is the one that pages you.
2. The login page
/wp-login.php is where security plugins and WAFs misbehave. Wordfence rate-limits, a Cloudflare rule challenges everyone, a plugin update renames the login URL, or a hosting firewall blocks a country that includes your office. The site is up, but nobody can log in, including you, and the client’s editor is the one who finds out.
Monitor https://example.com/wp-login.php and expect a 200 with the keyword user_login. If you have moved the login URL, monitor the new one. Interval: 5 minutes is plenty.
Caveat: a security plugin may block repeated requests to the login page. Allow-list the monitor’s IPs or User-Agent in the plugin; see the Cloudflare guide for the pattern.
3. wp-cron heartbeat
WordPress has no real cron. Scheduled posts, backups, WooCommerce stock syncs and plugin housekeeping all run from wp-cron.php, which is triggered by page visits. On a quiet site, or one where a developer disabled wp-cron without replacing it, scheduled jobs silently stop. The site looks healthy. Backups have not run for three months.
The fix is a heartbeat monitor: a unique URL that expects a ping at least every N minutes. Heartbeat monitors start on the Starter plan. Create one in Tenium with a period of 15 minutes and a grace of 15 minutes, then drop this must-use plugin into wp-content/mu-plugins/tenium-heartbeat.php:
<?php
/* Plugin Name: Tenium heartbeat */
add_action('init', function () {
if (!wp_next_scheduled('tenium_heartbeat')) {
wp_schedule_event(time(), 'hourly', 'tenium_heartbeat');
}
});
add_filter('cron_schedules', function ($s) {
$s['tenium_15'] = ['interval' => 900, 'display' => 'Every 15 minutes'];
return $s;
});
add_action('tenium_heartbeat', function () {
wp_remote_get('https://ping.tenium.app/h/YOUR_HEARTBEAT_ID', ['timeout' => 5, 'blocking' => false]);
});Change 'hourly' to 'tenium_15' once the schedule is registered, or just leave it hourly with a 90-minute period. If wp-cron stops, the heartbeat goes quiet and you get an alert that says exactly that.
Bonus: if you have replaced wp-cron with a real system cron (*/5 * * * * wp cron event run --due-now), append && curl -fsS https://ping.tenium.app/h/YOUR_ID to that line instead.
4. SSL certificate expiry
Let’s Encrypt renews automatically until the day it does not: a changed DNS record, a closed port 80, a rate limit, a hosting migration. An external SSL monitor reads the certificate visitors actually see and alerts at 30, 14 and 3 days before expiry, plus immediately if the chain breaks or the hostname does not match.
Every https monitor in Tenium records expiry as a side effect, so your home-page check already does this. A dedicated SSL monitor adds chain and issuer checks and shows a clear “61 days left” on the client’s status page and monthly report. If you have ever had to recover an expired certificate on a Monday morning, you will not skip this one.
5. Domain expiry
The domain is usually registered in the client’s name, on a card that expired two years ago, with renewal emails going to a former employee. You find out when the home page is a parking page full of ads, and that is 100% downtime with reputational damage on top.
A domain monitor checks the registry via RDAP or WHOIS weekly and alerts 60, 30, 14 and 7 days before expiry. It also flags nameserver changes and clientHold statuses. For an agency with forty client domains, the monitor list doubles as the renewal calendar, and the expiry date appears on each client’s report, which tends to prompt the renewal conversation at the right time.
The plugin that cannot do this
Management plugins and services (ManageWP, MainWP, WP Umbrella and friends) are excellent at updates, backups and security scans from inside WordPress. They cannot tell you the site is down, because when the site is down the plugin is down with it. External monitoring and in-site management are complementary; use both, and put both on the care plan.
Setting it up for forty sites
In Tenium, paste the site URLs one per line or upload a CSV: each URL becomes an HTTP monitor, and you add the keyword, certificate and domain checks per site (or list them as extra CSV rows with a type and keyword). Forty sites is about 200 monitors, which fits the Pro plan at $29 a month. If you also want each site in its own client workspace, with a client login and a branded report sent on the 1st, that is the Agency plan at $59, which has room for 1,000 monitors.
See WordPress monitoring for the details of each check.
Related
Each of the five checks has a page of its own: website monitoring, keyword monitoring, cron job monitoring, SSL monitoring and domain expiry monitoring. For the audience view, see monitoring for WordPress sites, and test any URL with the HTTP headers tool. Agencies can see how this scales in for agencies.
Related
Related Tenium pages
Monitor your first site free
30 monitors free, checks from 2 regions, no card. SSL and domain expiry from $7 a month.