Self-hosted monitoring with security scans and instant alerts StatusScout is a self-hosted website monitoring platform by Vincent Will that pairs round-the-clock uptime checks with security scanning of headers, SSL certificates, DNS records, and exposed files, alerting operators the moment something goes wrong.[1][2][3]
Quick verdict
Self-hosted uptime plus security monitoring with honest tradeoffs StatusScout fits small teams, freelancers, and agencies that want one self-hosted tool watching both availability and security posture. Its free-for-self-hosting edition covers all features, while Base and Agency plans sell managed hosting. The main tradeoffs are a custom source-available license that forbids reselling it as a hosted service and dependence on operator-managed MongoDB, Redis, and mail/SMS credentials.[1][2][3]
What StatusScout monitors
Uptime checks every 5 minutes Uptime checks record HTTP status and response time every 5 minutes and trigger instant alerts when a site stops responding.[1][2]
SSL validity and expiry warnings SSL tracking follows certificate validity and warns before certificates expire so visitors never see warnings first.[1][2]
Headers, cookies, and page analysis Security scans cover response headers such as CSP and HSTS, cookie flags, mixed content, page-level issues, and exposed stack traces or listings.[1][2]
DNS and takeover detection DNS health checks cover SPF, DKIM, DMARC, and CAA records plus subdomain discovery and takeover detection.[1][2]
Exposed files and API docs Exposure probes look for publicly reachable env files, hidden paths, and Swagger, OpenAPI, or GraphQL endpoints.[1][2]
Critical user-flow monitoring Scheduled flow tests exercise signup, checkout, and other key paths in a headless browser and alert when they fail.[1][2]
Email, SMS, and ntfy alerts Notifications go out by email, SMS, or ntfy; anyone can run a free one-click scan from the homepage without an account.[1][2]
Who it fits best
Agencies with client portfolios Agencies can watch every client site from one place and catch downtime, expiring certificates, and security regressions before clients notice.[1]
Freelancers after handoff Freelance developers can hand off projects with monitoring in place so a misconfigured header or expired certificate does not come back to them.[1]
Small product teams without DevOps SaaS founders get uptime alerts, DNS monitoring, and full security scans without staffing a dedicated DevOps role.[1]
Limits to weigh
Custom license with hosted-service restriction The StatusScout License 2.0 is source-available, not OSI-approved: anyone may self-host it free, including commercially, but may not resell it as a hosted service.[1][2]
Operator-managed infrastructure Self-hosting means operating MongoDB, Redis, secrets, backups, and updates yourself, plus your own mail and SMS provider accounts.[1][2][3][4]
Bring-your-own notification accounts Email delivery needs AWS SES credentials and SMS needs bird.com keys, so alerting is only as reliable as the accounts the operator configures.[1]
Unconfirmed enterprise and compliance posture No SSO, SLA-backed enterprise support, or documented data regions beyond EU hosting for the managed plans could be confirmed from official sources.[1]
Deployment, stack, and alternatives
Docker Compose deployment Deployment is Docker Compose based: MongoDB 7 and Redis 7 services plus API, frontend, worker, and scheduler packages start with one compose command.[1][2]
Node.js, Fastify, React, MongoDB, Redis The stack is Node.js throughout: a Fastify REST API, React dashboard, BullMQ and Redis job queueing, MongoDB persistence, and Playwright Chromium for browser-based flow checks.[1][2][3]
Safety net for AI-built sites Teams that ship fast with AI-assisted builders get a scanner aimed exactly at what slips through: insecure cookie flags, public API docs, and missing integrity checks.[1]
Free self-hosted full edition Operators who want scan data on their own server get full features free forever with self-hosting instead of per-seat SaaS pricing.[1][2]
Status-page needs favor alternatives Teams that need a plain uptime monitor with a bundled public status page may find Uptime Kuma simpler, since StatusScout centers on security scanning rather than status pages.[1][2]
Managed-only teams should skip self-hosting Teams that cannot or will not operate MongoDB, Redis, and mail/SMS provider accounts should stay on a fully managed monitor instead of self-hosting.[1][2]
Questions worth asking
How much does StatusScout cost to run?
Self-hosting is free forever with all features; you pay only for your own server. Managed hosting costs $19 per month for Base or $35 per month for Agency, billed annually, each starting with a 14-day trial.[1]
Is StatusScout really open source?
What does StatusScout check on my site?
Sources and editorial review
Source research. Reviewed on October 13, 2026. Written by Sanjib Sah. AI assisted; reviewed by a human editor.
We have not run or tested this product.
- vincenius/statusscout repository
official · Observed October 13, 2026
Identity anchor: description, homepage link, topics, commit and star counts observed 2026-10-13.
- StatusScout README
official · Observed October 13, 2026
Check catalogue, monorepo layout, Docker Compose setup, dev prerequisites, and license summary.
- StatusScout License 2.0
official · Observed October 13, 2026
Full custom license text: grant, hosted-service restriction, notice retention, as-is warranty.
- StatusScout homepage
official · Observed October 13, 2026
Feature list, alert channels, pricing tiers, audiences, EU-hosting statement.
- Introducing StatusScout
official · Observed October 13, 2026 · Published May 11, 2026
Author motivation, 5-minute uptime cadence, full check list, self-hosted data statement.
- StatusScout env template
official · Observed October 13, 2026
AWS SES mail, bird.com SMS, MongoDB/Redis settings, PageSpeed key, required secrets.
- StatusScout compose file
official · Observed October 13, 2026
MongoDB 7, Redis 7, API, frontend, and worker services with env-driven config.
- API package manifest
official · Observed October 13, 2026
Fastify REST API dependencies: MongoDB, BullMQ, Stripe, SES, passport auth.
- Worker package manifest
official · Observed October 13, 2026
Check executor dependencies: Playwright, axe-core, ssl-checker, BullMQ.
- Uptime Kuma README
official · Observed October 13, 2026
Published catalogue competitor: self-hosted monitoring scope and notification breadth.
Compared with these products
No explicit proprietary baseline is recorded.