Monitoring

Scheduled Checks for People Who Ship

You verify things at the moment you build them. The stylesheet loads, the share card renders, the API returns the right shape, the certificate is valid. All of that is true on the day you deploy and none of it is guaranteed a month later — not because anyone broke it deliberately, but because a dependency updated, a header moved, a third party changed a response, or something expired that you had no reason to think about again. Scheduled checking is how you find out on the day rather than from a user.

Correct on Tuesday is not a property that persists

Front-end work has an unusual amount of surface that is verified once and then never again. Nobody re-opens a share preview for a page they shipped last year. Nobody re-reads the caching headers on a build asset. Nobody checks whether the CSP still covers the analytics script that was swapped out two sprints ago. Each of those is fine until it silently is not, and none of them produce an error when they change.

That is the category scheduled checking is for. It is not about outages — you will hear about an outage. It is about the long tail of things that degrade without failing, where the only difference between working and broken is that nobody has looked.

The change is the signal, not the value

A check that returns the same answer every day for six months is not wasted; it is establishing that the answer is stable, so that the day it differs means something. That is why the checks worth scheduling include the boring ones. A meta description that has never changed is not interesting until the deploy that blanks it, and at that moment a stored history turns "something is wrong with our search results" into "this changed on the 14th, in that release".

In practice the recurring categories for a front-end team are: response shape changing on an API you consume, caching headers changing underneath a build asset, third-party scripts appearing or updating, security headers being dropped, and anything with an expiry date. None of them fail loudly.

What to check, roughly in order of return

Start with the things whose failure is both silent and expensive. A robots file that arrives from staging with a blanket disallow will remove you from search entirely while the site works perfectly — that is the single highest return check on the list, and it is one HTTP request. Certificate expiry is next, for the same reason: certain, dated, and a complete outage.

After that, the ones tied to what you ship: page weight and the resource waterfall per deploy, so a regression is attributable while it is still cheap to reverse; the shape of API responses you depend on; and the headers you rely on for caching and security. None of these need to run often — daily is generous for most — because you are watching for a diff rather than racing a clock.

The part people get wrong

Checking too much, too often, with an alert on each. A team that receives forty notifications a week stops reading them, and the one that mattered arrives in the same inbox as thirty-nine that did not. A report that lands on a predictable cadence and can be scanned in a minute is more useful than a stream of alerts, for everything except the small number of failures that genuinely need waking someone.

It is also worth choosing something that tells you when it has not run. A scheduled check that stopped and a scheduled check that is passing look identical from the outside, and silence is the one signal you cannot interpret.

Related reading