Cloudflare is excellent infrastructure. It protects against DDoS attacks, accelerates content delivery, terminates TLS, and provides meaningful analytics on requests hitting its edge network. Millions of production applications sit behind it for good reason.
But here's the failure mode that catches engineering teams off guard: Cloudflare doesn't know if your origin server is actually working. It knows if traffic is hitting its edge. It doesn't know if what gets returned is correct, if your API is responding within SLA, or — critically — if your SSL certificate is about to expire on the origin.
If you're using Cloudflare and don't have independent uptime monitoring on your origin, you have a gap in your observability that can hide outages from you while surfacing them clearly to your users.
What Cloudflare Actually Monitors
Cloudflare's product suite is built around network-layer protection and acceleration:
- DDoS mitigation — absorbs and scrubs volumetric attack traffic at the edge
- WAF (Web Application Firewall) — filters malicious requests before they reach your origin
- CDN — caches and delivers static content from edge nodes close to users
- Analytics — reports on request volume, cache hit rates, threat activity, and bandwidth
- Workers — serverless compute running at the edge
- Health checks (paid plans) — origin health checks for load balancing decisions
That last item is worth examining carefully. Cloudflare does offer origin health checks — but these exist to route traffic away from a failing origin to a healthy one. They are a load balancing signal, not an alerting mechanism for your engineering team. They do not send you a Slack message when your origin goes down. They do not page your on-call engineer. They do not track when the outage started or how long it lasted.
The Cached Page Problem
This is the failure mode that surprises teams most.
When your origin server goes down and Cloudflare has a cached version of the page, it will continue serving that cached content to users. From the user's perspective, the site is "up." From Cloudflare's analytics perspective, requests are being handled. Your dashboard shows healthy traffic.
But your origin is down. New writes aren't happening. Dynamic content isn't updating. API endpoints behind Cloudflare but not cached are failing. Your application is broken — and no one is alerting.
A single-location uptime monitor pointed at your Cloudflare URL will also miss this. It'll receive the cached page, report 200 OK, and never alert.
Vigilmon addresses this by monitoring your origin directly — bypassing Cloudflare — using the raw IP or an internal hostname. When the origin goes down, even if Cloudflare continues serving cached content to real users, Vigilmon sees the failure and alerts immediately.
SSL Certificate Monitoring: A Gap Cloudflare Doesn't Fill
Cloudflare terminates TLS at the edge. This means your users connect to Cloudflare's certificate, not your origin's certificate. Cloudflare handles certificate renewal automatically for edge certificates.
But your origin certificate — the one used for the encrypted connection between Cloudflare and your server — is your responsibility. And if it expires, Cloudflare will start returning 525 SSL Handshake Failed or 526 Invalid SSL Certificate errors to every user.
Cloudflare does not alert you when your origin certificate is about to expire. It doesn't monitor that certificate's validity date. You need an external monitoring tool to track origin certificate expiry and alert your team before it becomes an incident.
Vigilmon monitors SSL certificate expiry as a first-class check — configurable alert thresholds (30 days, 14 days, 7 days) with Slack and email notifications.
What Cloudflare Can't Monitor
| Check Type | Cloudflare | Vigilmon | |---|---|---| | DDoS protection | Yes | No | | CDN / caching | Yes | No | | WAF | Yes | No | | Origin health (load balancer signal) | Paid plans | N/A | | Uptime alerts to your team | No | Yes | | Multi-region consensus checking | No | Yes | | SSL certificate expiry alerts | Edge cert only | Origin + edge | | TCP port monitoring | No | Yes | | Heartbeat monitoring for cron jobs | No | Yes | | API endpoint response validation | No | Yes | | Status page for customers | Paid (Cloudflare Status) | Included |
Using Vigilmon Behind Cloudflare: The Right Stack
Teams using Cloudflare effectively pair it with Vigilmon for end-to-end coverage:
1. Monitor the origin directly
Set up a Vigilmon HTTP check targeting your origin server's IP or internal hostname. This bypasses Cloudflare and verifies the origin is actually responding. Vigilmon's multi-region consensus means a true origin failure is confirmed from 3+ locations before alerting — no false positives from transient network blips.
2. Monitor the Cloudflare URL
Set up a second Vigilmon check targeting your public Cloudflare URL. This tells you if the Cloudflare-to-user path is working: are users actually getting responses, is the page loading, is the returned content correct?
Comparing these two monitors gives you immediate diagnosis: if the Cloudflare URL check fails but the origin check passes, the problem is at the Cloudflare edge layer. If both fail, the origin is down.
3. Monitor origin SSL certificate expiry
Add a Vigilmon SSL check for your origin certificate. Set a 30-day alert threshold. This gives you runway to renew before it causes user-facing failures.
4. Monitor API endpoints independently
For API endpoints that Cloudflare doesn't cache, add individual Vigilmon monitors with response validation (status code, response body keywords). Cloudflare analytics won't surface an API that's returning 500s at a low rate — Vigilmon will.
The Alert Cloudflare Doesn't Send
Imagine your origin database crashes at 2am. Cloudflare serves cached pages for the next four hours. Your analytics show normal traffic patterns. No alert fires.
At 6am, the cache TTL expires. Cloudflare starts forwarding requests to the origin. Origin returns 503. Users see error pages. Your social media blows up. You investigate and realize the database has been down for four hours.
That's the failure mode independent uptime monitoring prevents. Vigilmon's origin check would have fired within 60 seconds of the database crash — before the cache masked the problem, before users noticed, before the 2am became a 6am incident.
Conclusion
Cloudflare and Vigilmon solve different problems. Cloudflare secures, accelerates, and protects traffic at the network edge. Vigilmon confirms your origin is actually healthy and alerts your team when it's not — including the cases Cloudflare's caching layer can hide.
If you run production workloads behind Cloudflare, you need both.
Start monitoring your origin with Vigilmon's free tier at vigilmon.online — 5 monitors, 1-minute intervals, multi-region consensus, SSL monitoring. No credit card required.
Tags: #cloudflare #monitoring #uptime #devops #ssl #sre #infrastructure