1 Introduction
Regarding health checks and instant notifications for multi-site applications, I previously wrote a solution: self-built Uptime paired with Bark, used to monitor service status on my own and push anomalies to my Apple devices (iPhone, iPad, macOS) (for specific setup steps, see the article:Docker Series: Building a Real-time Application Health Monitoring and Alerting System Based on Uptime and Bark). Aside from only supporting the Apple ecosystem, this solution is actually quite complete in terms of functionality.
However, after using it for a while, I gave it up. Not because of technical issues, but because from the actual user experience, the cost-performance ratio was indeed not high, for several main reasons:
- Graphical Interface Wastes Resources: Uptime's chart page is almost useless to me, and I won't stare at it for no reason, but rendering this content in the background consumes a lot of resources on my lightweight server—and Tencent Cloud's lightweight servers aren't exactly known for powerful performance to begin with.
- WAF Rules Compromise Security: In order for Uptime's probe requests to successfully pull from the origin, I had to add the IP of the Tencent Cloud server to Cloudflare's WAF whitelist. Honestly, I don't like doing this, as I always feel it introduces security risks.
- Frequent False Alarms are Distracting: Probes originating from mainland China travel through complex paths to reach Cloudflare data centers (mostly in US West), which is inherently susceptible to network fluctuations. As a result, I often received Bark notifications for no apparent reason, sometimes several times a minute. Even though I later reduced the probe frequency, it still couldn't be cured—the key point is that the service had no issues at all. It was just annoying noise, and I'm not a real paid sysadmin anyway~~~.
- The Service is Actually Quite Stable: More realistically, this set of services has actually been quite stable in the long run, with almost no major outages. Since the probability of real issues is very low, spending limited lightweight server resources to maintain a continuously running monitoring system doesn't make much sense.
It was precisely out of these considerations that I later completely abandoned building this monitoring + notification combination myself. However, while looking through the various features provided by Cloudflare recently to see what other freebies I could get from Cloudflare, I discovered that they had already provided native health checks and notification mechanisms long ago.
Although this is not a must-have for me, since someone else isgiving away features for free, I'm certainly happy to take them. Thus, this article was born to document how Cloudflare's ”Health Checks” and ”Notifications” features helped me rebuild a lightweight monitoring solution better suited for webmaster operations scenarios at a ”low cost.”
2 Health Checks (Pro and above)
1 Overview
Cloudflare's ”Health Checks” feature allows users to periodically check the availability of their website or server, ensuring the site is running normally and identifying issues in a timely manner: by specifying a URL path (such as the homepage, API endpoints, or a specific check page), Cloudflare will periodically initiate HTTP requests to verify if the target returns the expected status code (such as 200 OK). Users can customize the check frequency, timeout settings, and expected HTTP status codes. Once a check fails, Cloudflare will send notifications via email or Webhook to help users respond quickly. This feature is suitable for single-site or multi-origin configurations. Pro users can use up to 10 health checks for free, ensuring the site is always online and improving site availability.
2 Setup Steps
2.1 Add a Health Check
Taking adding a health check to my blog as an example, the illustrated tutorial is as follows:
After successful addition:
Compared to traditional third-party availability monitoring tools (such as the aforementioned Uptime), Cloudflare's Health Checks provide a probing method that is closer to the actual origin-pull path: probe requests sent by Uptime typically access Cloudflare's edge nodes from its designated detection nodes (for example, from my domestic Tencent Cloud lightweight server), and then Cloudflare initiates an origin-pull request to the origin server. In contrast, Health Checks initiate HTTP detection directly from Cloudflare's edge network to my origin server. Its detection path is shorter, and the origin-pull path is almost completely identical to the origin-pull path when Cloudflare actually serves visitors, thus more accurately reflecting whether Cloudflare can truly ”reach” the origin server.
But what truly makes it powerful is the ”event linkage judgment” capability brought by combining Health Checks with Cloudflare's Notification system. For example, I can set up a ”Tunnel Health Alert” for the Tunnel and a ”Health Check” for the blog in the notification system. If both trigger anomalies within the same time period, it can basically be determined that a Tunnel disconnection caused Cloudflare to fail to pull from the origin. This is impossible to achieve using only third-party monitoring tools—Uptime only knows that the origin server is inaccessible, but cannot determine whether the origin server itself is down, the Tunnel is disconnected, or Cloudflare has an issue. In contrast, Cloudflare's native monitoring system can collect internal signals from multiple dimensions, perform cross-analysis, and push alerts (such as via Email or Webhook), which is extremely valuable for users like me who deploy on an intranet and rely on Tunnels.
2.2 Configure ”Alerts” for Health Checks”
The so-called alert is actually an email notification by default, which can be configured directly from the Health Checks interface:
In the future, when the blog is inaccessible, the configured email address will receive a similar email notification:
If the blog recovers to an accessible state, the configured email address will receive a similar email notification:
3 Cloudflare Notifications
Cloudflare's Notification feature can be said to be an indispensable part of webmaster operations. Whether your website is a static blog or a dynamic service, once notifications are set up, you will know the very first moment an issue occurs on your site. It supports pushing messages through various methods such as email and Webhook, and covers a rich variety of event types, such as common DDoS attacks, origin-pull anomalies, SSL/TLS certificate expiration warnings, health check failures, WAF triggers, Tunnel Health Alerts, Page Shield alerts, etc.
However, one thing to note is thatthe types of alerts available to users vary depending on their subscription tier. Free users can subscribe to relatively basic alert types, while Pro, Business, and Enterprise users can unlock more advanced notifications, such as brand protection, new domain monitoring, BGP hijack detection, standalone health checks, etc.
The ”Health Check” alert mentioned earlier in the article is actually the ”Health Check” within the ”Notifications” feature, so creating a ”Health Check” alert in notifications is essentially the same.
In addition, even for Free subscription users, there are quite a few useful alerts that can be enabled, such as:
- HTTP DDoS Attack Alert (enabled by default): Cloudflare will detect and mitigate HTTP DDoS attacks targeting your domain, and once they occur, the system will send timely notifications.
- SSL/TLS Certificate Expiration Alert: When an SSL/TLS certificate is close to expiring, Cloudflare will remind you to avoid access issues caused by certificate expiration.
- Page Shield New Code Change Detection Alert: If the JavaScript files loaded on your page change, you will receive a relevant alert, helping you detect code changes that might affect site security in a timely manner.
- Page Shield New Malicious Domain Alert: When resources loaded by your users come from known malicious domains, Cloudflare will send a notification to alert you to the security of the resources.
- Page Shield New Malicious Script Alert: If the JavaScript loaded by users is flagged as a malicious script, the system will also issue an alert.
- Brand Protection Alerts: If a new domain matching your domain query or logo is detected, you will receive real-time notifications, helping to detect potential brand abuse in a timely manner.
For Pro users, in addition to the notification types available to Free users, there are more practical alert types including the previously mentioned ”Health Checks”, ”Passive Origin Monitoring”, ”Tunnel Health Alerts”, ”Web Analytics Metrics Updates”, and ”Cloudforce One Port Scan Alerts”. For example, all the notifications I created are as follows:
Note 1: A rather frustrating point is that the notification settings do not indicate which alert types are available for different subscription tiers, which is very inconvenient to use. Therefore, you might encounter situations where some options are grayed out or cannot be added during setup, which basically means they are not supported by your current tier.
Note 2:Free planusers are indeed limited in terms of the notification features provided by Cloudflare, with many advanced alert types not included, especially for traffic management、Health Checks、port scanning and other practical features. In contrast, the notification features provided by Pro and higher plans are more comprehensive, helping users better cope with potential traffic surges, DDoS attacks, maintenance impacts, and other issues. Therefore, if you need finer control, upgrading to a Pro plan might be a good choice, especially when your website has high traffic and security requirements.
4 Enhancing Real-Time Notifications
1 Limitations of Email Notifications
Actually, email notifications can be considered near-real-time, but most people probably don't take email notifications very seriously, especially when they frequently receive spam. I can't check if there's an issue with the site every time I hear a new email notification sound (unless it's an email address created solely for receiving notifications, or the notification emails from Cloudflare are set to a special ringtone). Therefore, an acceptable, conventional real-time notification method is needed.
2 Low-End Compromise: 139 SMS Notifications
This method has a barrier to entry: you need a China Mobile phone number, which utilizes the free SMS notification for new emails provided by 139 Mail:
I won't say much about this method, it's very simple, mainly coming from:
[email protected]notification emails from the mailbox, you can research it yourself. When there is an issue with the Tunnel, the SMS effect is as follows:
The SMS effect when encountering an HTTP DDoS attack is as follows:
The subject lines of some alert types are also cut off, but at least I know it's from Cloudflare and that there is an issue with the Tunnel named ”tencentcloud”. Real-time notification is basically achievable, though sometimes it might not be so real-time—the latest I've received an SMS notification was over 10 minutes later. In addition, after following their WeChat Official Account, it also supports WeChat Official Account alerts. Overall, the practicality is very good, and the key is that it doesn't require much hassle.
3 Webhook Notification Method
3.1 What is a Webhook
Webhook is a way for applications to communicate in real-time via the HTTP protocol. When a certain event occurs in a system, it automatically sends a piece of data to a URL you have pre-configured (i.e., the receiver's address), usually in the form of an HTTP POST request. This data can be in formats like JSON, XML, etc., containing information related to the event.
To give a practical example: suppose you have a repository on GitHub, and you want a CI/CD tool to automatically trigger a build and test when someone submits a Pull Request to this repository. You can set up a webhook so that when a Pull Request event occurs, GitHub automatically sends an HTTP POST request to the CI/CD system, containing detailed information about the event (such as the submitter, modified content, etc.). Upon receiving the request, the CI/CD system will start executing the build and test process.
Compared to polling (constantly querying the server for new data), webhooks are much more efficient because they are event-driven. Once an event occurs, the system proactively pushes data to you, rather than you frequently requesting data. In short, a webhook is a mechanism that sends relevant information in real-time to a specified URL by defining trigger conditions, commonly used for automated interactions between systems.
I've said all this just because Cloudflare's notification feature supports webhooks in addition to email notifications (which is also available to Free subscription users):
3.2 Creating a Webhook Receiver for Notifications Based on Bark
For individual users using Apple ecosystem devices, Bark is a very convenient tool for setting up a personal Webhook address (for specific setup steps, please refer to the article:Docker Series: Building a Message Push Server Based on Bark Server), which in essence is a transit service that is not responsible for storage or identity verification itself, but simply ”evaluates URI → forwards message”: each Bark client (iPhone, iPad, Mac devices) will obtain aunique device key (token), and then as long as you send a URI path request in the agreed format with this device key as the URI prefix to the Bark server, the Bark server will extract the notification content from the request and send it to the device corresponding to this device key (usually these clients maintain communication with the Bark server).
Below, taking my Bark server (address:https://barkapi.tangwudi.com) anddevice keyof ”123456789" as a virtual device example, to demonstrate the steps of creating an HTTP DDoS alert type webhook notification based on Bark:
Then set the address of the Bark server:
If the test is successful, the Bark client on the corresponding terminal device will receive a notification:
There are many ways to choose how notifications are displayed on the terminal in Bark, so you can decide for yourself:
Finally, you only need to select the previously created webhook notification method in the specific event notification (in this case, the HTTP DDoS attack alert) and then save it:
All the webhook notifications I finally created are as follows:
Note: Why did I create so many webhook notifications in the image above? Because if you want to distinguish between various alert types in Bark notifications, each terminal device should create at least one corresponding Bark notification for each required alert type (you can't have all alert types share a single notification with the same announcement content, which would mean you only know something happened but are completely in the dark about what exactly it is). To make it easier to distinguish, I created 2 notifications (up and down) for some alert types (such as tunnel status, blog monitoring), plus each terminal needs to create 2, and I have 2 terminals here (iPhone, macmini, and even added iPad for HTTP DDoS attack notifications), so naturally it became this many~.
5 Summary
The combination of Cloudflare's ”Health Checks” and ”Notifications” features provides great convenience for webmasters' daily operations and maintenance. Although there are third-party availability monitoring tools like Uptime on the market, they have many shortcomings compared to Cloudflare's native solution, whether in terms of monitoring accuracy, problem localization capabilities, or the flexibility of alerting mechanisms.
First, the detection nodes of third-party tools are usually distributed in public clouds or overseas data centers. Although they can detect whether a site is accessible, because the detection path is different from the user's actual access path, especially due to factors like network fluctuations and geographical differences, the monitoring accuracy may not perfectly simulate the access experience worldwide. In contrast, Cloudflare's Health Checks are initiated in a distributed manner from multiple edge nodes. Especially when using Tunnel to fetch from the origin, this multi-node detection can almost completely reflect the actual access paths from different regions, thus more accurately reflecting whether Cloudflare can successfully fetch from the origin and serve visitors.
Second, although Uptime can report ”access failure”, for deployments using Tunnel or hidden in an intranet, it cannot further determine whether the problem lies in the Tunnel, the Cloudflare origin fetching process, or the origin server itself. Cloudflare's solution, however, can analyze multiple event sources such as Health Checks, Tunnel connection status, and WAF behavior in combination through the ”Event Alerts” mechanism to easily locate the root cause of the problem: for example, when a Health Check fails and the Tunnel is disconnected at the same time, it can be initially determined that the Tunnel has failed rather than the origin server itself being unavailable—which is difficult for most third-party solutions to achieve.
Thirdly, in terms of notification methods, although third-party tools support Email or Webhook, their alerting logic is usually quite rigid and can only notify on a single status change. In contrast, Cloudflare provides an integrated, composable alerting system where all configurations are centralized within a single platform, offering simple operation and clear logic. Whether it is email notifications or integration with external push tools like Bark or 139 Mail SMS, it can be easily completed with almost zero barrier to entry.
For users who deploy services in an intranet, do not open public network access, and only pull origin through Cloudflare Tunnel, this ”close to the source” native detection mechanism and flexible alerting system are particularly valuable: it not only saves the effort of building an independent monitoring system, but also allows webmasters to truly achieve the lightweight, highly reliable operations goal of ”instant notification when something happens, no disturbance when nothing does.”
However, this solution is not flawless either; the only minor regret is probably that Free users cannot get it for free.