Testomato

We shipped Content Security Policy monitoring before we had a CSP of our own.

So we had to build one starting from scratch, like most teams do. We deployed a report-only header first to collect violations without breaking anything. The data came in quickly: Gravatar images, GTM and other Google services, as well as third-party scripts that weren't in our initial allowlist.

We're still in report-only but are working toward enforcement. In the meantime, we're monitoring our own header from the outside, just like we monitor any site.

If you're starting from zero, that's where to begin: report-only first, then add monitoring once you have something to check. We wrote up the full process, including what we found when we ran CSP checks on our own site.

testomato.com/blog/content-security-policy-monitoring/

Uptime and website monitoring sound like they're doing the same job. They're not.

A 404 counts as up. So does a pricing page that lost its pricing table. So does a contact form that silently stopped working. Uptime tells you the server responded. That's it.

302 instead of 301. og:image missing from your most-shared page. A form submission that goes nowhere. These all pass an uptime check. None of them pass a content or functionality check.

So we wrote a guide to website monitoring: what it checks (content, forms, redirects, meta tags), how it differs from uptime, and what to set up first.

Read the guide:

What is Website Monitoring? How It Goes Beyond Uptime Website monitoring goes beyond checking if your server is online — it verifies that your pages load, forms work, and content is present and correct.

HTTP status codes are one of those things where you only need to know a handful by heart, but knowing the right ones tells you exactly where to start looking when something breaks.

502 vs 504. 301 vs 308. 401 vs 403. Soft 404s that return 200 and silently waste your crawl budget.

So we wrote a complete guide covering all the codes that matter for website owners and developers: what they mean, real-world scenarios for each one, and which ones are worth monitoring.

https://testomato.com/blog/http-status-codes/

We help thousands of websites stay fast and available

Our website 👉 testomato.com wasn't!

361 KiB of unused JavaScript. 3.5s LCP on mobile. Exactly the kind of issues Testomato catches for our customers — and we were guilty of them ourselves.

So we rebuilt. Static site, Astro + Tailwind, PageSpeed finally in the green. 🎉

Read full story here: testomato.com/blog/website-redesign-2026