Uptime monitoring for a site on Cloudflare

The problem with checking a cached page

If your homepage is cached at the edge, a monitor pointed at it is checking Cloudflare's copy — not your server. The origin can be down for twenty minutes and the check stays green until the cache expires. The response time is measuring a cache hit, which is a real number that answers a question you did not ask.

Look at cf-cache-status on the response. HIT means you learned nothing about your origin.

Monitor both layers, deliberately

1. The edge: your homepage, as a visitor sees it. This is the one that matters for "is the site up for customers", cache and all.
2. The origin: a path you have excluded from the cache — a /health endpoint with a cache rule set to bypass — so the check has to reach your server. Add a required keyword that only appears when the database answered.

Two monitors, and the difference between them is the diagnosis. Edge green plus origin red means Cloudflare is serving stale content over a broken backend — and that is exactly the situation where a single monitor lies to you.

Reading Cloudflare's own error codes

When the edge cannot reach your origin, it answers with a 5xx of its own. These are not your application's errors, and knowing which is which saves an hour:

• 520 — the origin returned something Cloudflare could not parse. Usually an empty response or a crash.
• 521 — the origin refused the connection. The server is down, or the firewall is blocking Cloudflare's addresses.
• 522 — the connection timed out. Packets are going nowhere; check the firewall and the server's load.
• 523 — the origin is unreachable. Often a DNS record pointing at an address that no longer exists.
• 524 — connected, but the origin took longer than 100 seconds to answer. A slow query, not a dead server.
• 525 / 526 — the TLS handshake with your origin failed, typically an expired or mismatched certificate on your own server.

Set your monitor's expected status codes to 200 rather than 200-299 and these show up as failures with the code intact, so the error message names the problem instead of just reporting that something is wrong.

Watch the TLS certificate you forgot about

Cloudflare renews the edge certificate for you. It does not renew the one on your origin, and an expired origin certificate produces a 526 that looks like a mysterious outage at three in the morning six months from now. The origin monitor above catches it.

If you host on Workers or Pages

There is no origin to check separately, so one monitor on the public URL is the whole story. Two things are still worth doing: pick the check region closest to your users, since a Worker responds from wherever the request lands, and turn on Core Web Vitals for the monitor — a static site is fast to answer and can still render slowly.

And your own protection will block you

It is the single most common surprise when monitoring a Cloudflare site: the WAF or Bot Fight Mode challenges your monitor within a day of setup. The skip rule takes two minutes, and this guide explains how to recognise it when it happens.