Website monitoring and security monitoring are not the same thing

The word “monitoring” covers several different activities. Two of the most important are availability monitoring and security monitoring. They answer different questions, use different checks and produce different kinds of alert.

Availability monitoring asks whether the website can be reached and whether it is returning the expected result. Security monitoring asks whether the files and configuration have changed in a way that should not have happened. A site can pass the first check while failing the second.

What availability monitoring checks

An availability check typically requests a URL on a schedule and looks at the response. It may check the HTTP status, a marker in the page content, a redirect, certificate expiry or DNS resolution. When a check fails repeatedly, an alert is raised.

• The site responds within an expected time and returns a successful status.
• A known page contains the expected content rather than an error page.
• TLS certificates are valid and not close to expiry.
• DNS records resolve to the expected service.
• The failure is investigated to establish whether the cause is the application, server, network or an upstream dependency.

Availability monitoring detects an interruption. It does not prevent one, and it cannot tell you why the site is down without an investigation.

What security monitoring checks

Security monitoring is concerned with integrity and unexpected change. On a PHP-based website, that can include hashing files and comparing them with a known baseline, watching for new PHP files in places they do not belong, and checking configuration files that affect how the server behaves.

• SHA-256 file integrity checks against a recorded baseline.
• Unexpected or suspicious PHP files.
• Executable files appearing in upload or asset directories.
• Changes to .htaccess and .user.ini files.
• Selected PHP configuration values and file permissions.
• Automated notifications when an anomaly is detected.

This kind of monitoring is useful because many compromises do not take the site offline. A defaced page, an injected script or a new file in an upload directory can leave the site returning a perfectly normal 200 response.

Detection is not prevention

No monitoring arrangement guarantees that a site will not be compromised. Security monitoring detects change and raises a signal; it does not patch the application, remove a vulnerability or stop an attacker in advance. Those are separate activities.

Detection is also not investigation. An alert says that a file changed. Someone still has to establish whether the change was a deployment, a legitimate administrator action, a false positive or something that requires remediation. Remediation is a further step again.

Why both are needed

Availability monitoring without security monitoring can miss a compromised site that is still serving pages. Security monitoring without availability monitoring can miss an outage that has nothing to do with file changes. They cover different failure modes, and neither replaces maintenance, patching or access control.

When comparing providers, the useful questions are concrete: What exactly is checked? How often? Who receives the alert? What happens after an alert is raised? Is investigation included, or is it a separate engagement? What is explicitly outside scope?

Monitoring is an early warning system, not a security guarantee. Its value depends on what is checked and who responds.