Keep SpinupWP’s site monitor running, then add checks for the page content, the public certificate, and any scheduled task you cannot afford to miss.
SpinupWP checks the uncached homepage every minute. It expects a 200 response, verifies an apparent outage from a second server, and emails you after the site has been down for more than two minutes.
That’s a useful check. It also answers one fairly narrow question: can WordPress and PHP return the homepage?
A site can return 200 with the wrong template. Your origin certificate can be fine while Cloudflare serves a broken one. WP-Cron can wake up every five minutes while a particular import never finishes.
The obvious setup is to point a second uptime monitor at the same homepage and leave every default enabled. That mostly gives you two alerts for the same failure.
A better approach is to give each check one job.
- SpinupWP site monitoring asks: Can the uncached homepage return
200? - Content verification asks: Does the public page contain the content you expect?
- Certificate monitoring asks: Does the public hostname serve a valid certificate and chain?
- Scheduled-task monitoring asks: Did this particular job reach its heartbeat on time? You do not need to install another agent on the server. You need an Oh Dear account, a live site managed through SpinupWP, and access to the code or cron command for any task you want to monitor.
1. Check the Content, Not Only the Response Code
A 200 response tells you the web server returned something successfully. It does not tell you whether it returned the right thing.
A theme error, plugin conflict, or badly configured maintenance page can still return 200. The same is true for a nearly empty template.
Start by adding the public HTTPS URL to Oh Dear. Use the hostname that visitors use.
Since SpinupWP already checks the homepage, pick a different important page here:
- The shop page on a WooCommerce site
- A product category that should always exist
- The main contact page on a lead-generation site
- A small health endpoint you control Do not use the server IP, a temporary SpinupWP domain, or an origin hostname hidden behind your CDN. You want this request to take the same route as a visitor.
Open the monitor settings and find Verify text on response. Add a string that should always appear in the response body.
A footer company name can work. So can a stable heading or HTML comment:
<!-- monitoring: storefront-ok -->
Avoid prices, stock counts, recent post titles, rotating testimonials, and anything else that an editor might remove on an ordinary Tuesday.
Save the setting and run the check. Then replace the expected string with something that does not exist and run it again.
It should fail.
Restore the real string once you have seen the failure. If you have only seen the green state, you have not tested the check yet.
SpinupWP can now keep checking the uncached homepage and PHP process. Oh Dear checks whether the public page still looks like your site.
2. Check the Certificate Visitors Receive
SpinupWP installs and renews Let’s Encrypt certificates. If a renewal fails, it emails the error and the command output.
That covers the certificate SpinupWP manages on the server. It may not be the certificate a visitor receives.
Cloudflare and other CDNs terminate TLS before the request reaches your server. The origin certificate can be valid while the certificate at the CDN edge has expired, covers the wrong hostname, or serves an incomplete chain.
Open the certificate health screen for the public monitor and check:
- The certificate covers the hostname you added
- The intermediate certificate chain validates
- Expiry notifications reach someone who can act
- Certificate-change notifications go to the right place Oh Dear runs its certificate check every 30 minutes. It also records certificate changes and shows which fields changed.
A change is not automatically an incident. Let’s Encrypt replaces certificates during normal renewal. The history is useful because it lets you check that the replacement still covers the right hostnames and came from the authority you expected.
When an alert arrives, start with the public hostname. Then work backward through the CDN and SpinupWP.
Do not start by replacing the origin certificate just because that is the server you can log into. It might not be the certificate that failed.
3. Add a Heartbeat to One Important Scheduled Task
SpinupWP uses a server cron and WP-CLI to process scheduled WordPress events. The default interval is five minutes, with a small offset so every site on the server does not fire at once.
This is much better than waiting for a visitor to trigger WP-Cron.
It still tells you that WordPress checked for due events. It does not tell you whether one particular subscription renewal, backup, stock import, or report reached the end of its code path.
Pick one job where a missed run would cause a real problem. Do not start by adding heartbeats to every mundane WordPress event.
Create a scheduled task in Oh Dear and give it a name that will make sense inside an alert:
- Nightly subscription renewals
- Supplier stock import
- Off-site database backup
- Daily client report Set the real schedule. Use its cron expression if the job runs at a particular time, or a fixed frequency if it runs at an interval.
Check the server timezone. A task scheduled for 02:00 is not useful if the two systems disagree about what 02:00 means.
Then add a grace period. If the task usually finishes in under two minutes, a three-minute grace period gives it room to finish without hiding a genuinely late run.
Oh Dear generates a unique ping URL for the task. Treat that URL as a secret. Anyone who calls it can create a false successful heartbeat.
Ping from a WordPress Task
For code you control, call the ping URL after the task has finished:
add_action( 'my_client_nightly_sync', function () {
my_client_run_nightly_sync();
wp_remote_get( 'https://ping.ohdear.app/replace-me' );
} );
Replace the example URL with the task’s ping URL.
The position of the call matters. If the job fails, execution must stop before reaching wp_remote_get().
The example assumes my_client_run_nightly_sync() throws or stops on failure. If your function catches errors and returns a failure value instead, put the ping inside its confirmed-success branch.
WordPress gives wp_remote_get() a five-second timeout by default, which is fine for this basic request.
Do not attach a second callback at an arbitrary priority and assume another plugin has finished first. Put the ping inside code you own, at the point where that code knows the work completed.
Ping from a Linux Cron Job
For a server-side task, ping only after the command exits successfully:
0 2 * * * /path/to/nightly-job.sh && curl -fsS --retry 3 -o /dev/null https://ping.ohdear.app/replace-me
The && is doing useful work here. The ping only runs when nightly-job.sh exits with status 0.
Make sure the script returns a non-zero status when it fails. Otherwise the shell cannot tell the difference.
Do not edit SpinupWP’s managed WordPress cron command. SpinupWP warns that the line below its #Ansible: <your_domain> comment will be overwritten when you change the site’s cron settings.
Add a separate cron entry or keep the heartbeat inside the WordPress task.
Run the job once and confirm that Oh Dear records the ping.
What the Heartbeat Does Not Prove
A heartbeat proves that your code reached the ping URL within the configured time.
It does not prove that a backup can be restored. It does not inspect the amounts on generated invoices. It does not know whether an email reached the recipient or whether imported stock values were correct.
Those outcomes need separate checks.
This is also why you shouldn’t send one heartbeat after a group of unrelated tasks. A successful backup ping says nothing about subscription renewals. Give each important job its own callback.
Start with One Site
Keep SpinupWP’s built-in monitoring enabled. It already gives you a useful uncached check of the homepage and PHP process.
Add one stable content check, inspect the public certificate, and wire up one important scheduled task. Make the content check fail on purpose. Let a temporary heartbeat miss once so you can confirm the alert reaches the right person.
Only then copy the setup to the next site.
You can create the monitor at ohdear.app.
