How we tell if a website is down

From our server in EU (Falkenstein), we:

1. look up the domain's IP address, falling back to the www. address if the bare domain has none,
2. open a connection on port 443, or port 80 if the site has no HTTPS,
3. complete the TLS handshake and verify the certificate,
4. request the homepage and follow up to four redirects within the same site,
5. read the first few kilobytes of the answer and stop.

We give up on connecting after 6 seconds and on an answer after 10 seconds. "Response time" is the time until the server sent its first byte, including the connection and handshake.

Up means the server answered. That includes answers like 403 Forbidden or 429 Too Many Requests: many large sites block automated checks like ours, but answering at all proves the server is reachable. We say so on the page when it happens.

Problems means the server answered, but with 503 Service Unavailable, an invalid certificate, or only after more than 5 seconds. It also means our check worked but people reported problems at a much higher rate than usual.

Down means the domain didn't resolve, the connection was refused or timed out, the secure connection failed, or the server answered with a server error such as 500, 502 or 504.

A failed check is repeated 2 seconds later before it is logged as an outage.

Checks run from one location: EU (Falkenstein). The first is our primary location: its results decide a site's status, uptime and outage log. Results from the others are shown per location on each status page and its map, so you can see when a site fails only in part of the world.

Many services publish their own status page. Where it can be read by a machine (the common status page platforms, or the feeds Google, Apple, AWS, Azure, Slack and others publish) we read it every few minutes and show it separately, clearly labelled as the service's own statement. Pages shared by many services, like Google Workspace's, are narrowed to the service you're looking at. If a service declares a major outage while our check still works, the page says the service is reporting a problem.

On every status page you can ask your own browser to contact the site. Browsers allow this between websites in a limited way: the test succeeds if the site's server answered anything at all, and fails if the name doesn't resolve or the connection or secure handshake fails. We compare that with our own check to tell whether the problem is the site or your connection.

We record only whether the test worked, how long it took and your country. Ad blockers can make the test fail for some sites.

We look up which network answered each check (for example Cloudflare or Amazon Web Services) using the DB-IP database. When three or more monitored sites on the same network fail at once, we point out a possible network-wide outage.

The services in our directory are checked every 5 minutes, around the clock. Their uptime numbers come only from these scheduled checks, because checks people start themselves cluster around outages and would skew the result.

Any other site is checked when someone looks it up, at most once a minute no matter how many people ask. Those pages are not listed in search engines until a site has a proper monitoring history.

Anyone can report a problem on a status page. Each person can report a site once an hour. We say a site "may be having problems" only when it received at least 5 reports in the last hour and at least four times its usual hourly rate. The numbers you see are the real counts.

Comments are plain text: links, email addresses and other websites can't be posted, so there is nothing to gain from spam. New comments are reviewed by a person before they appear. Anyone can flag a comment; after three people flag it, it's hidden until we review it.

We check from a few locations, not every country and provider. A site can work for us and fail where you are, and a working homepage doesn't guarantee that logins, apps or payments work. That is what visitor reports are for. We are not affiliated with any of the services listed, and our results are not official statements from them.

Our requests identify themselves with this user agent:

Mozilla/5.0 (compatible; UpOrDownChecker/1.0; +https://upordown.online/how-it-works)

We only request your homepage, read a few kilobytes and stop. A monitored site gets one request every few minutes; any other site at most one per minute, and only when people ask.

For monitored sites we also read your homepage about once a month to find the icon it declares (touch icon, favicon or web app manifest), download that one file and show it next to your name. If we're blocked, we show a letter instead.