Monitoring & alerting

Several controls fail silently — a lapsed domain, a broken backup job, or a DNS change nobody approved are usually discovered only after an incident. Every control below has an owner, an alert path, and a tested condition so failures surface on their own.

Domain expiration & registrar changes

Auto-renew is enabled at the registrar as the primary defense. An external uptime monitor checks domain expiry as a backstop.

DNS modifications

Native DNS-change notifications require a paid Cloudflare tier. Until upgraded, changes are caught by a scheduled diff against the committed DNS record snapshot in /infra/dns-records.txt.

TLS certificate expiration

Universal SSL auto-renews through Cloudflare. A Universal SSL Alert notification is configured to confirm renewal, issuance, and expiration events land in the team's alert channel.

Backup failures

Scheduled backup jobs report to a dead-man's-switch monitor. The alert fires on a missed run, not only on an explicit failure — this catches a job that silently stops triggering, not just one that errors out.

WAF anomalies

Native WAF/security event alerts require a paid Cloudflare tier. Page Shield's malicious-script and malicious-domain alerts are enabled in the meantime as a partial, free-tier control against client-side supply-chain risk.

Origin exposure

A recurring check confirms the public hostnames resolve to the expected edge and serve over HTTPS. Where the hosting platform does not expose origin-level network restrictions, the limitation is tracked as a known constraint rather than presented as a control.

DMARC failures

No native push alert is available on the current Cloudflare plan. Status is checked manually on a recurring weekly schedule against a recorded baseline (DMARC, SPF, DKIM, BIMI), with escalation on any change for the worse.

Critical dependency vulnerabilities

Dependabot alerts and security updates are enabled on the repository.npm audit runs as a CI gate and blocks the build on critical/high severity findings.

Escalation

Each control has a named owner and a specific alert destination. Missed or unacknowledged alerts escalate per the schedule defined for that control, rather than waiting on someone to notice.

Control:Required so failures in domain, DNS, TLS, backups, WAF, origin exposure, DMARC, and dependency controls are caught by monitoring rather than by an incident.