Changelog

Track the latest features, improvements, and updates.

Current Month · August 2026

Fixed
  • Connecting a custom domain now makes it your status page's address straight away
    previously a domain could verify successfully (green checkmark, SSL issued) yet visitors to it were still redirected to the free *.statuspage.me subdomain, and the domain was missing from the "Primary domain" picker, so there was no way to correct it from the UI. Connecting a domain now adopts it as the primary URL automatically, and the picker lists it as expected. Status pages already stuck in that state are repaired automatically — if you deliberately prefer the platform subdomain, "Use platform subdomain instead" on the Custom Domain page switches back.
  • Bogus "DNS conflict" warning on correctly-configured custom domains
    every working custom domain was reported as having a conflicting A record alongside its CNAME, in the settings banner, the admin panel and the domain-connected email. The check was counting the platform's own address, which DNS resolvers return when they follow your CNAME, as though it were a record on your domain. It now only considers records actually published at your domain, so a real conflict is still reported and a healthy setup is not. Nothing to do on your side; the stale warnings are cleared.
  • "Set as Primary Domain" button did nothing
    the button on the Custom Domain page failed with an "Invalid domain_type" error instead of switching the primary URL.
  • **/open MRR Trend chart back-dated every MRR change by up to 6 days**
    the internal metrics sync (SyncCurrentMRRSnapshots, triggered on every /open load) and the daily scheduler job both fetched the current live MRR total and overwrote today's row plus the preceding 6 days with it, meant as a self-heal for old bad rows. In practice this meant any real MRR change (new subscription, cancellation, upgrade) got stamped across the whole rolling window instead of the day it happened, so the chart's step always appeared 6 days earlier than reality. Both jobs now write only today's snapshot; past days are never rewritten. A one-time backfill script (cmd/scripts/backfill_mrr_history) reconstructs accurate historical snapshots back to 2026-07-07 (when dodo_webhook_events started recording full subscription history) by replaying webhook events instead of guessing.

Fixed
  • A settings dropdown could render behind the sticky Save bar
    the Primary Domain dropdown (and any other select rendered near the bottom of a short settings section) could have its lower options visually covered by the sticky footer.
  • Import wizard showed the wrong field labels
    the second credential field always read "Page ID / subdomain" regardless of provider, which was actively misleading for Phare (an optional organization Project ID) and status.io (its separate API ID header). Both fields now label themselves correctly per provider.
New
  • Migrate from another provider
    a new wizard at /user/status-pages/:id/import (linked from the Components settings tab) lets you pull your existing status page over from Instatus, Atlassian StatusPage.io, Hyperping, Phare, status.io, Hund, OhDear, UptimeRobot, or Uptime.com. It's a one-time import: enter your API key, preview what will come in (checked against your plan's component/monitor limits before anything is written), and confirm. The preview step now shows actual content, not just counts — component names, incident titles with their status, maintenance windows with their dates, and monitor names/URLs, with a "+N more" for anything past the first 8 per category. Instatus, StatusPage.io, Hyperping, Phare, status.io, and Hund bring in components and incidents with their full update timeline and, except Phare, maintenance windows too; Instatus, StatusPage.io, Hyperping, Phare, OhDear, UptimeRobot, and Uptime.com can also import your uptime monitors (status.io and Hund have no uptime-monitor concept in their APIs), with an optional toggle to pull historical uptime data. If you're migrating from OhDear, monitors with SSL certificate or DNSBL blocklist checks enabled can also be brought in as account-wide monitoring tools (/user/tools/ssl, /user/tools/dnsbl) via an extra opt-in checkbox on the preview step — off by default. Your API key is never stored — it's held in memory only for the duration of the import and discarded once it finishes. If an import gets interrupted (server restart, network blip), a background watchdog flags the stuck job within 20 minutes and re-running the wizard picks up safely — already-imported components, incidents, maintenances, and monitors are automatically skipped rather than duplicated. The signup wizard now offers "Migrating from another provider" as a third option alongside Automated/Simple when creating your first status page — pick it and you're routed straight into the importer instead of the usual "add a monitor" step, then land on a short orientation screen pointing to Incidents, Maintenance, Settings, Components, On-Call, and Notifications instead of the generic setup checklist. The same third option is now available when creating any additional status page from /user/status-pages/new — picking it skips straight to the importer instead of settings/add-a-monitor.
  • Custom domain setup is now a dedicated, guided page
    replaced the old in-modal 3-step wizard with a full page at /user/status-pages/:id/domain built on a proper stepper. It normalizes what you type as you type, warns before you try to connect a bare apex domain (which can't take a CNAME) and offers a working subdomain instead, detects your DNS provider and shows the exact record format it expects (with a deep link to its DNS panel), and watches DNS in the background with backoff instead of making you click "Check" repeatedly. If you close the tab before it finishes propagating, a new background job keeps checking and emails you once it's live. The flow doesn't call itself done until your SSL certificate is actually issued.
Updated
  • Status page settings reorganized
    the settings page's 14 flat tabs are now 13 tabs grouped under Setup, Page, Communication, Publishing and Access, with Appearance and Services split into Design/Branding/Advanced and Components/Monitors/Servers sub-tabs. Domains (custom domain, primary domain) is now its own section instead of being mixed into Access; Embed (embeddable banner, embed URL, frame origins) is now one section instead of being split across two unrelated tabs.
  • Settings save button now saves only the section you're on
    editing Appearance and clicking Save no longer touches anything in Dependencies, Access, or any other tab. The button relabels to the active section ("Save Appearance", "Save Domains", …) and stays disabled until that section actually has unsaved changes. A small dot on the sidebar marks any section with unsaved edits, and saving one section no longer discards unsaved edits sitting in another.
  • Settings search
    a search box above the settings sidebar filters tabs by field name, and jumps straight to the first match (including the correct sub-tab) on Enter.
  • Dependencies: search and bulk enable/disable
    the provider list has its own search box and Enable all / Disable all buttons; providers disabled platform-wide are shown dimmed with a lock icon instead of a live-looking toggle.
  • Settings sidebar shows counts and plan locks
    Services, Dependencies and Subscribers show a live count badge; sections gated by your plan (Domains, Embed, Web Analytics, Access, Branding) show a lock icon instead of a generic "some features are locked" banner.

Fixed
  • Partial-outage alerts no longer repeat forever for latency-only checks
    a monitor whose response-time assertion is unrealistic for a distant check region (e.g. checked from the other side of the world) could sit permanently "partially failing" without ever crossing quorum, re-sending the partial-outage escalation on every cooldown window indefinitely even though the target was answering fine. The escalation is now skipped when every currently-failing region's latest failure is purely a response-time miss rather than a real reachability failure.
  • Microsoft Teams notifications restored
    Teams alerts were sent as Office 365 connector "MessageCard" payloads, and Microsoft disabled connector webhooks in Teams during May 2026, so those alerts stopped being delivered. Teams notifications are now sent as Adaptive Cards through the Workflows webhook format, with the action button intact. Saving a webhook URL on the retired *.webhook.office.com host now fails with an explanation instead of silently going nowhere — recreate the webhook from the channel's More options (…) → Workflows → "Send webhook alerts to a channel" template and paste the new URL.
  • Long alerts no longer dropped by Slack, Discord and Telegram
    notifications for incidents with long titles or many fields could exceed provider payload limits and be rejected outright. Slack header, section and field text, Discord titles, descriptions and field counts, and Telegram message and caption lengths are now capped to each provider's documented limit. Telegram truncation is character- and markup-aware, so a cut no longer lands inside a multi-byte character or an open HTML tag.
  • Notification channel entitlements enforced everywhere
    plan entitlements were only checked when a channel was created. Updating a channel, sending a test notification, linking a channel to a status page, and delivery itself all skipped the check, so a downgraded account kept receiving alerts on channels its plan no longer included. The check now runs on every write path and at send time, and a downgrade disables links to channels the target plan does not cover. The channels themselves are kept, so re-upgrading restores the setup.
  • SMS to Esendex with special characters
    an SMS body containing <, & or ]]> produced malformed XML and failed to send. The request document is now built with a real XML encoder.
  • PagerDuty and SMS channels rejected on some screens
    one API endpoint kept its own list of valid channel types that omitted PagerDuty and SMS, and the legacy config sync omitted SMS entirely. Every code path now uses a single canonical list.
  • Billing: add-on charges no longer affect your plan's payment status
    a declined charge on a separately-billed add-on could put the main subscription into its payment-retry period and send a downgrade warning to an account that was fully paid up, and a successful add-on charge could clear a payment-retry period the plan genuinely needed. Payment retry state is now tracked per subscription.
  • Billing: lifetime deal purchases are matched to the payment that bought them
    an abandoned lifetime checkout could later be matched against an unrelated purchase. Purchases are now resolved from the payment itself, and returning to the billing page verifies the payment belongs to your account before anything is applied.
  • Billing: webhook deliveries interrupted by a restart are retried
    a payment or subscription notification that was cut off mid-processing (deploy, restart, crash) was treated as already handled and never retried, which could leave a completed purchase without its plan. Interrupted deliveries are now picked up on the next retry.
  • Billing: refunds can't be issued twice for the same charge
    a repeated refund request for a charge that was already refunded is now rejected instead of being sent to the payment provider again.
  • Renewal reminders are being sent again
    the 7-day and 3-day "your plan renews soon" emails read a subscription amount field that was never populated, so every account was skipped and no renewal reminder had ever gone out. The amount is now recorded on every subscription update and backfilled for existing ones. Subscriptions already set to cancel at the end of the period are excluded, so cancelling no longer gets you a renewal notice.
  • Cancellation emails no longer repeat
    "your subscription was cancelled" was re-sent on every subsequent update the payment provider reported while the subscription stayed cancelled. It is now sent once, when the cancellation actually happens.
  • "Cancel trial" button works on provider-managed trials
    the button posted to an address that did not exist and always failed. It now cancels the trial subscription.
  • Duplicate lifecycle emails prevented
    trial reminders and payment-retry notices were de-duplicated by matching the English wording of the subject line, so any wording change would have silently allowed the same email to go out repeatedly. They are now tracked by event instead of by subject text.
  • Revenue reporting in the admin dashboard
    MRR and ARR were calculated from the same unpopulated amount field and therefore always reported zero. They now reflect real subscription amounts.
  • Out-of-order billing updates no longer take effect
    payment provider notifications are not guaranteed to arrive in the order they were sent, and a delayed "cancelled" landing after a newer "active" could downgrade a paying account (or the reverse could restore a cancelled one). Updates older than what has already been applied are now discarded.
  • Billing history shows the right kind of entry
    first charges, renewals and one-time purchases were all recorded as "renewal". Each is now labelled correctly.
  • Refunds issued by support now release the plan
    only in-app refund requests moved the account back to free; a refund issued directly in the payment provider left the plan active indefinitely. A full refund now releases the plan, while partial refunds leave it untouched.
  • Subscription notifications that arrive before signup completes are retried
    if a purchase notification arrived before the account row existed, it was set aside and never revisited. These are now re-attempted hourly for 30 days and applied once the account is found.
  • A lapsed subscription no longer cancels an active trial
    the scheduler already skipped these accounts, but the webhook and admin paths did not, so an expiring old subscription could end a running trial.
  • Subscription ownership can no longer be reassigned by an incoming notification
    a mis-matched customer lookup could move an existing subscription to another account.
Improvement
  • OSS Hero acknowledgement wording clarified
    acknowledgement (badge or sponsors/credits-page link) must stay in place for as long as the project is on OSS Hero, and section spacing on the Open Source page tightened for readability.
  • Rate limits and permanent failures handled properly
    failed notifications were retried three times regardless of cause. A rejected credential now fails immediately instead of retrying, and a provider that responds with 429 is given the delay it asks for rather than being retried on a fixed schedule.
  • Vonage SMS moved to the current API
    Vonage SMS now uses the Messages API instead of the legacy Nexmo endpoint, and no longer sends the API secret in the request body. Existing Vonage channels keep working with the same credentials.
  • Google Chat notification previews
    Google Chat alerts now show the incident headline in the notification preview instead of a generic card placeholder.
Miscellaneous
  • Payment webhooks fail closed
    if the webhook signing secret is missing outside local development the endpoint now refuses requests instead of processing unverified ones.
New
  • Customer Intelligence flow diagram
    a new full-page "Flow" tab under Customer Intelligence shows a sankey chart of acquisition source → current decision state → plan outcome across all classified users.
  • Hoverable popovers on OSS Hero plan details
    plan feature line items on the Open Source page now show extra detail on hover instead of requiring a click-through.
  • Custom webhook body templates
    webhook channels can now define their own request body and content type, with the subject, message, severity, timestamp and the alert's parsed fields available as variables. This makes the webhook channel work directly with Zapier, n8n, Home Assistant, Alertmanager and in-house consumers without a dedicated integration for each.
  • Self-hosted push channels: ntfy, Gotify and Matrix
    three new notification channels for self-hosted setups. ntfy and Gotify are available on every plan, including Free and OSS Hero; Matrix is available from Starter upwards.
  • WhatsApp and voice call alerts
    two new Twilio-backed channels. WhatsApp is available from Team upwards; voice calls, which read the alert aloud, are available on Business and Enterprise as an on-call escalation path.
  • Jira Service Management and ServiceNow
    Enterprise plans can now raise alerts in Jira Service Management Operations and open incidents in ServiceNow.
Updated
  • Admin notification test harness now covers webhook and SMS channels, which previously could not be tested there, and the plan matrix lists every supported channel automatically.

Fixed
  • Daily tick spacing on Comfort, Compact and Spotlight layouts
    the sub-pixel gap between daily uptime ticks rounded inconsistently across neighboring gaps, gluing random pairs of ticks together instead of an even strip. Replaced with a fixed margin-right: -1px overlap on each tick so spacing is uniform and rounding-free.
  • Plan-gate and checkout telemetry weren't recording real commercial activity. Fixed a check-interval/region write-denial gap where a Free user submitting a monitor interval or region selection outside their plan was correctly rejected but never recorded. Fixed checkout-attempt tracking for the production self-serve subscription flow and for admin-assisted "renewal checkout" links, which were creating real Dodo checkout sessions without ever recording the attempt.
  • Status event markdown body vertical alignment on the status page.
Improvement
  • OSS Hero program: the attribution requirement is no longer badge-only
    projects can instead list StatusPage.me on an existing public sponsors/supporters/credits page. Program FAQ expanded with migration-from-another-provider guidance, and the acknowledgement checkbox/copy updated to match.
New
  • Signal page layout
    a scan-first status page design: every component sits on one line with its status, uptime figure and a 14-day history strip, under a full-width coloured status banner. Component groups read as quiet section labels instead of collapsible cards, and recent incidents are listed compactly with a link to the full history.
  • Preview-slug reservation
    -preview demo status page slugs (used for pre-outreach demos before an org signs up) are now reserved: only allowlisted internal accounts can claim one, and the matching real slug stays reserved for that same page's owner until it's transferred over.
  • Restoring a status page that hit a plan limit
    status pages paused because they exceeded the plan's component/page capacity now show a clear locked message with a restore action, instead of just disappearing from the list. Locked pages are also hidden from public/embed endpoints until restored.

Fixed
  • More accurate product insights
    internal activation reporting now recognizes distinct ways customers reach value instead of treating every configured page as the same workflow.
  • Setup guidance that matches your workflow
    Manual status pages and standalone monitoring now reach a complete state without requiring unrelated setup, while automated monitoring still highlights unfinished checks.
New
  • Real-time operations dashboard for our team
    internal staff can now watch platform activity (signups, incidents, upgrades, deploys) as it happens, alongside live account and reliability metrics.

Fixed
  • More reliable internal tooling
    resolved several inconsistencies so routine support and administrative work is more dependable.
Improvement
  • A more relevant Starter path for active status pages
    Free accounts with a configured status page can now discover custom domains in context, after the page is already in use.
  • Clearer incident and maintenance timelines
    public detail pages now make affected-service windows and maintenance timing easier to inspect across time zones.
  • More polished Spotlight status pages
    banner images can blend into the status surface while the rest of the page retains its themed reading background.
  • Status-page notices are simpler to manage
    public-page banner changes now save with the main status-page settings action.
  • Faster internal support workflows
    improved the performance and usability of the tools our team uses to investigate and resolve customer questions.
  • Better operational context
    made relevant information easier for our team to review during support and maintenance work.
New
  • Expanded internal management capabilities
    our team now has clearer, more efficient tools for reviewing configurations and handling support requests.
  • Stronger safeguards for administrative changes
    improved the internal controls used to review and confirm sensitive changes.

Improvement
  • Recovery alerts are less likely to flap during unstable incidents
    monitor recovery handling now suppresses noisy back-and-forth recoveries when a service is bouncing, so notifications better reflect a genuine return to normal instead of every short-lived rebound.
  • Server detail pages now link incident correlation to an exact monitor
    when linking a server to a status page, you can now narrow through component group and component to the specific monitor backed by that host, then confirm the match explicitly. Incident overlays on the server charts now follow that exact monitor instead of loosely shading incidents from the whole status page, which avoids false correlation when one component contains several different targets.

Improvement
  • Status pages are more accessible and visually consistent
    tooltip behavior, link treatment, and text styling were refined across the public status-page experience to improve readability and reduce small UI inconsistencies.

Improvement
  • Status-page timestamps are easier to read across time zones
    public status pages now render timestamps with clearer timezone handling, including UTC context where appropriate, so incident and maintenance times are less ambiguous for distributed teams.
  • Status pages received a visual cleanup
    card treatments, tooltip behavior, and related status-page styling were tightened up for a more consistent public view.
New
  • HTTP timing breakdowns now go deeper for monitor checks
    monitor results can now show a fuller request waterfall, including redirect timing, so it is easier to see whether a slowdown came from connection setup, server processing, or a redirect chain before the final response.
  • Scheduled maintenance can now be extended from the product and the embed
    ongoing maintenance windows support extension actions without forcing you to recreate the maintenance event, keeping the public timeline aligned when planned work runs longer than expected.

Improvement
  • Monitor notifications are less noisy around uncertain incidents
    alerting now records notification decisions, distinguishes blocked checks from confirmed failures, and waits through recovery verification before sending avoidable repeat messages.
  • Blocked-monitor emails now point to the firewall fix
    when a monitor appears blocked by a firewall, WAF, CDN, or rate limit, email alerts include a direct guide for allowlisting StatusPage monitoring traffic.
  • Custom brand palettes apply more consistently across status pages
    shared palette rendering now covers the main status page, incident archives, maintenance archives, and related views so extracted brand colors stay aligned across the public experience.
New
  • Down notifications can now include a screenshot of the target
    on Team plan and above, a confirmed down event captures a headless-browser screenshot of the monitored URL and attaches it to the down notification (Discord, Slack, Telegram, email), giving operators visual confirmation of what the outage looked like alongside the error text.
  • Elevated latency is now tracked separately from downtime
    monitors with response-time ceilings can enter an elevated-latency phase without marking the service down. Status pages, charts, and notifications can show latency degradation as its own impact state instead of forcing every slow response into the same bucket as an outage.

Improvement
  • Outdated Server Agents are now easier to spot
    servers running an older agent show an Update available badge in the dashboard. For recently active installations, we also send one advisory email per account listing every agent that needs attention, with a 14-day reminder cooldown. Updates remain manual: the agent never downloads or installs code by itself.
  • Regional monitoring suggestions now include the missing context
    dashboard recommendations show the affected status page, link to the public page when available, and use clearer monitor labels so it is obvious which check the recommendation applies to.
  • Regional recommendation emails are now optional and easier to stop
    product recommendation emails have their own notification preference and unsubscribe handling. StatusPage may email a regional monitoring suggestion only after it has appeared in the dashboard first, and the message makes clear that no region is changed automatically.

Fixed
  • Oversize metric batches are split instead of dropped
    a host with an unusually large number of mounted filesystems could produce a batch over the server's request-size limit, which the agent treated as a permanent rejection and discarded. Such batches are now halved and retried, so the samples still arrive.
  • Corrected the IP handling described on our privacy page
    it said addresses were hashed with SHA256. Several tables were in fact storing them in full, and the hashing that did exist was unsalted, which for IPv4 offers far less protection than it sounds like: the entire address space is small enough to build a complete reverse lookup table. Both the code and the page now match, and the page explains the two different treatments and why each is used.
Improvement
  • Agent and server can no longer drift apart
    both now import the same protocol package for the wire format and its size limits, so a renamed field or a changed limit is a build error rather than a failure that only appears on machines already in the field.
  • The install command works end to end
    the install script and release binaries are now served from our own infrastructure at /install-server-agent.sh and /dist/serveragent/. They are hosted first-party on purpose: the installer verifies a SHA-256 against a checksum file fetched from the same origin, and a checksum served by a host we do not control would prove nothing about the binary.
  • IP addresses are now reduced before anything is written down
    for page views, tool checks, and error logs we keep only the network portion (203.0.113.45 becomes 203.0.113.0), which still tells one network from another without pointing at a machine. For audit trails and abuse prevention, where we genuinely need to recognise that two events came from the same source, the address is replaced with a keyed HMAC-SHA256 token that is meaningless to anyone holding only the database. Rate limiting happens in memory and writes nothing at all. This is done by hsp-ip-anonymizer, which we publish and use ourselves, so the claim is independently auditable rather than something you have to take on trust.
  • Existing records were converted too
    a migration truncated the addresses already stored, so the commitment holds for our whole history rather than only for new records. The original addresses no longer exist; that is the point, and it is not reversible.
Miscellaneous
  • Agent binaries are built from the exact version pinned in the server's dependencies, so the binary a customer downloads always matches the protocol the server was compiled against. They are build output and are not stored in the repository.
New
  • Customer Intelligence now turns product activity into explainable decision states
    admins can investigate whether an account appears to be exploring, building, evaluating, blocked, waiting, adopted, or abandoned, while keeping the underlying Signals timeline visible. Every state includes confidence, reasons, evidence, and contradictions; human overrides are audited, and outreach is drafted for review rather than sent automatically.
  • The Server Agent is now open source
    the agent you install on your own machines lives at github.com/hosted-status-page/hsp-server-agent under Apache 2.0. Asking someone to install a binary on their production server, as root, is asking for trust; the source is the answer to "what does it actually send?". It ships with a privacy document covering what it collects, what it deliberately does not, and how that is enforced on both ends.

Improvement
  • The agent tells you exactly what it collects
    serveragent -metrics prints the complete list of collected metrics and the explicit list of what it does not collect (no process names, command lines, environment variables, file contents, user accounts, or network peers). serveragent -dry-run prints a real sample from the host so you can see the actual payload before configuring anything.
  • The agent survives outages without losing data
    if the endpoint is unreachable it keeps collecting and buffers to disk, then flushes the backlog oldest-first when connectivity returns. The buffer is deliberately bounded so a long outage can never fill the disk of the machine being monitored.
  • The reported hostname is optional
    hostnames often contain a person's name, so the agent can be configured to report a name you choose, or none at all, and it can be changed from the dashboard afterwards.
Miscellaneous
  • The Server Agent runs as a dedicated, non-login system user under a hardened systemd unit (read-only filesystem apart from its own buffer, no capabilities, restricted syscalls, memory and CPU caps). It never executes commands sent by the server and never downloads or runs code; it reports that an update is available and leaves applying it to you.
  • The installer verifies the downloaded binary against a published SHA-256 checksum and refuses to install if the checksum cannot be fetched or does not match.
  • Host metric storage uses time-partitioned tables with hourly and daily rollups, so retention drops whole partitions rather than deleting rows one at a time.
New
  • Server monitoring
    a new Servers section in the dashboard shows CPU, memory, load average, disk, and network for machines you run, collected by a Server Agent you install on them. Add a server, run the generated one-line install command, and metrics appear within a couple of minutes.
  • Incidents overlaid on host metrics
    the server detail page shades incident windows from the linked status page directly onto every chart, so a load spike that preceded an outage is visible on the same timeline instead of in two separate tabs. This is the reason the feature exists: uptime monitoring tells you *that* something broke, host metrics on the same chart tell you *why*.
  • Threshold alerts for hosts
    alert when a metric stays above (or below) a threshold for a chosen duration, routed through your existing notification channels. The "sustained for" window means a brief spike stays quiet. Available on Pro and above.
  • Optional infrastructure section on public status pages
    a host can be surfaced publicly by linking it to a component. The page shows the component's name and percentages only; the server's own name, its hostname, and absolute sizes are never published, and a host that has stopped reporting is dropped from the view rather than showing stale figures.

Past Releases

2026 · 188 releases

Improvement
  • Clearer reliability metrics panel on status pages
    the Availability/MTBF/MTTR strip shown on public status pages had its 7d/30d/90d/1y period buttons pushed to the far edge of the row, above the response-time chart, which made them look like chart controls even though they only changed the metrics beside them. The strip is now a self-contained bordered panel with its own header row: a "Reliability" title, a live scope label ("Last 7 days", etc.) that updates with the period, and the period buttons directly next to it.
  • Removed the non-functional "Avg. Response" figure from the reliability strip
    it never changed when a different period was selected, since it was always today's average rather than a value scoped to 7d/30d/90d/1y. Response time is still shown in the response-time chart directly below.
  • No more duplicate uptime number
    when the reliability strip is shown for a monitor, the separate uptime percentage in the component header (with its own period dropdown) is now hidden, so availability appears once instead of twice with two different period controls.
Miscellaneous
  • Fixed a stray i18n key on the reliability strip's "7d" button (data-i18n="7d" referenced a key that didn't exist) and added proper translations for the period buttons, scope labels, and metric help text across all supported languages.
New
  • Separate toggles for MTBF and MTTR
    status page owners can now show Availability without MTBF/MTTR, or pick just one of the two, instead of an all-or-nothing switch. Both default on when the existing "Show Availability Metrics" toggle is enabled.

Fixed
  • Status pages timing out after an update
    publishing an incident, posting an update, or scheduling a maintenance could leave a status page returning a gateway timeout instead of loading, sometimes repeatedly. Status pages now stay served while their cached view is rebuilt in the background, so a content change no longer makes the next visitor wait for that rebuild.
  • Pages loading with components stuck on "Unknown"
    a status page could render with every component greyed out and uptime shown as "--", then correct itself on a later refresh. Live status now loads reliably on the first attempt, including on pages with many monitors and regions.
  • Missing 1-year uptime figures
    on larger pages, the yearly uptime percentages and some per-region history could be left out of a page's cached view and stay missing for the rest of the day. The data these depend on is now always gathered.
  • New monitors showing slightly below 100% uptime
    a brand-new monitor's placeholder "pending" check was being counted as a real check that wasn't up, so a freshly created status page could show 98–99% uptime for its first day even though nothing had ever gone down. Placeholder checks are now excluded from uptime, and a background task heals any existing pages affected by this.
  • Monitors page showing 0% uptime and 0ms for monitors that were fine
    if any monitor on the page had no checks recorded in the selected time window (a monitor added recently, or one that had been paused), every monitor listed after it could display 0% uptime and no response time. The figures were being discarded silently, so the page looked like a genuine outage. All monitors now report their real numbers, and a monitor with genuinely no data in the window is the only one that reads as empty.
  • "30 days" on the Monitors page failing to load
    selecting the 30-day range could leave the uptime and latency figures blank indefinitely, because gathering them took longer than the page was allowed to wait. It now uses the daily history the platform already keeps, and returns promptly.
Improvement
  • Much faster status page loads
    the queries behind a status page now run together rather than one after another, and a slow historical-data repair task was moved off the page-loading path entirely. Cold loads that previously took many seconds now render effectively instantly.
  • Faster live status and dependency updates
    the live status indicators and third-party dependency states that fill in after the page appears now arrive noticeably quicker.
  • Faster "Add Monitor" initial check
    creating a monitor triggered a full initial check twice in a row (once automatically on creation, then again when the "Running initial check..." modal explicitly re-ran it), which could leave that modal spinning for a long time before falling back to a "still running" message. The redundant second check is gone, so the modal now resolves as soon as the check the server already started finishes.
  • New monitors now get their own component automatically
    adding a monitor to a status page without choosing a component used to create a "standalone" monitor, which appeared in its own section below all your components and could never have a component link, a group, an incident status, or per-component subscriber preferences. A monitor added to a status page now gets a component named after it (reusing an existing component of the same name rather than making a duplicate), so all of those work by default. Existing behaviour is still available: pick any existing component, tick "Use a different component name" to name it yourself, or choose "No component — standalone monitor". Private monitors, which have no status page, are unaffected.
  • Assign a monitor to a component group while adding it
    the Add Monitor form now has a Component Group field, including creating a new group inline, so a monitor can go straight into the right group instead of requiring a second pass on the Components page afterwards.
  • One-click fix for monitors with no component
    the Components page now flags any monitor on that status page that isn't attached to a component and offers to give each one its own, so pages built before this change can be brought in line without editing monitors one at a time.
  • Component picker grouped by Component Group
    the Component dropdown on Add Monitor and Edit Monitor now organizes components under their component group (ungrouped components listed first), instead of one flat list, making it easier to find the right component on pages with several groups.
  • Faster Monitors page
    the uptime, latency and region figures on the Monitors page filled in slowly, and the delay grew with the number of monitors. Each batch of monitors the page loaded was quietly re-computing the whole sidebar — plan details, alert badges, notification counts — and then discarding it, on top of reading the same monitor and account records several times over. That duplicated work is gone: a batch of monitors now costs roughly half the database queries it used to, and the page itself around a fifth fewer. The figures shown are unchanged.
  • Much faster uptime and latency figures on the Monitors page
    the 24-hour view was doing a redundant lookup for every individual check it read, and the 7-day and 30-day views were reading every recorded check one by one instead of using the daily history already kept for them. Longer ranges are now dramatically quicker, and the numbers are unchanged apart from longer ranges being measured to the day at the window edges.
  • Abandoned page loads no longer keep working in the background
    if you closed or navigated away from the Monitors page while its figures were still loading, the server carried on gathering them anyway. That work is now stopped as soon as the page is no longer waiting for it, which frees up capacity for everyone else.
Miscellaneous
  • Monitoring history table tuned for its own read patterns
    the table holding every recorded check is now cleaned up on a cadence matched to how fast it grows, rather than a default tuned for tables that are mostly updated. This keeps uptime and latency lookups on their fast path instead of gradually drifting off it between cleanups. An unused index on that table was also removed, which slightly reduces the work done every time a check is recorded.

Fixed
  • Promotional description missing from Live Preview
    The admin edit modal's Live Preview never showed the "Promotional Description" field, making it look like the field did nothing even though it was already rendered correctly on the real banner/modal. The preview now reflects it immediately.
  • Indie Hackers Page missing from display-location badges
    The promotions table's display-location badges and "Not displayed" check omitted the "Show on Indie Hackers Page" flag.
New
  • OSS Hero feature comparison
    the open-source page now includes a full comparison table showing exactly what the free OSS Hero plan includes, with live plan limits and the notification channels available on it, so maintainers can see what they get without cross-referencing the pricing page.
  • Multi-code discount promotions
    A discount promotion can now be linked to one or more other discount codes (e.g. a Monthly + Annual code for the same sale) so they render as one banner/modal/pricing-page card with multiple labeled code chips, instead of duplicating messaging and appearance across separate rows. The linked promotion table now nests grouped codes under their parent, and the edit modal has a "Linked Discounts" section to link/unlink codes.
  • Visual gradient builder
    The promotion edit modal's background-gradient field now has a real configurator (linear/radial toggle, two color-stop pickers, angle slider, curated presets) alongside the existing free-text field, instead of requiring hand-written CSS.

New
  • Regional search ranking observations
    administrators can track how StatusPage.me pages appear in Google results from selected global agent locations, compare regional history, and distinguish real rankings from blocked, CAPTCHA, consent, and parser failures.
  • Manual VPN ranking checks
    a daily rotating regional checklist now records administrator-entered Google positions and sends deduplicated email and Telegram reminders until that day's work is complete; automated Google runners remain disabled.
  • Faster regional ranking workflow
    manual checks are grouped by region with generated Google links, visible completion and position badges, next-check navigation, copyable link sets, and optional private evidence screenshots.

Improvement
  • Stronger password protection
    stored passwords now use Argon2id, a modern memory-hard hashing algorithm. Existing passwords are upgraded automatically and invisibly the next time you sign in; no action or password change is needed.
  • Versioned agreement records
    new signups record which version of the legal agreements was accepted, and when, so it is always clear which terms apply to an account.
Updated
  • Privacy Policy and subprocessors
    the Privacy Policy and the list of subprocessors were revised, effective 25 July 2026. Cookie descriptions are clearer about what each cookie is for, and references to advertising and analytics cookies were removed because we do not set them.
  • Clearer data exports
    the account data export now states exactly what each exported file contains and how it is structured.

Improvement
  • Accounts are created only after email verification
    signing up now holds your details as a pending registration and creates the account once you confirm your email address, so abandoned or mistyped signups no longer leave half-created accounts behind. Trial and billing setup happens at the same moment, so a verified account is ready to use immediately.
  • **New account:reset API scope**
    API keys must now carry an explicit scope to perform a workspace reset, so a general-purpose key cannot trigger one by accident.
New
  • Reset your workspace
    you can now clear a workspace back to a clean slate (monitors, status pages, incidents, and related data) without closing your account or signing up again. The reset is protected by two-factor confirmation, and a restore point is kept for 30 days in case you change your mind. Your account, API keys, plan, and billing records are kept — see Resetting Your Workspace.

Fixed
  • Pending checkouts stay visible on the main dashboard
    the resume-checkout cart now appears consistently across user dashboard pages.
Improvement
  • More control over product emails
    notification settings now include tips and suggestions, and every optional nudge email includes a secure unsubscribe link.
New
  • Terraform provider on the public Terraform Registry
    manage status pages, monitors, incidents, maintenance windows, and custom metrics as code with hosted-status-page/hsp; start from the Terraform provider guide.

Fixed
  • Incident and maintenance API updates are more predictable
    optional fields can be cleared, newly created incidents begin in Investigating, and create responses use timestamps consistent with later reads.
Improvement
  • Safer API retries
    create requests now support idempotency keys, so retrying a request after a timeout will not accidentally create duplicates.
  • More accurate maintenance visibility
    scheduled maintenance can identify the specific monitors it affects, so public history only highlights the relevant services and real monitoring data.
New
  • Manage more of your setup through the API
    API clients can now create, update, and delete status pages, site monitors, and status-page metrics.

Fixed
  • Dashboard incident and monitor summaries are more resilient
    a failed aggregation query no longer prevents the rest of your status-page data from loading.
Improvement
  • Custom-domain issues are easier to catch
    we'll now notify you when a configured custom domain is disabled or fails its origin check, with clearer guidance for restoring it.
  • Public status pages are better protected during traffic spikes
    requests are rate-limited to keep pages responsive for everyone, and visitors who exceed the limit receive a clear retry page instead of a generic error.
New
  • More precise incident updates
    when an incident affects one monitor within a component, you can now select that monitor directly. The incident view makes the affected service clearer for subscribers and your team.

Fixed
  • Subscription renewal reminder emails now actually send
    the daily job that emails paid users 7 and 3 days before their plan renews was silently failing on every run due to a SQL query referencing columns that don't exist on user_subscriptions. No paid user had ever received this reminder; the query is now corrected.
  • Renewing a lapsed subscription no longer dead-ends at "contact support"
    if a user's Dodo subscription had already lapsed (expired/cancelled) but their plan hadn't been downgraded yet, trying to change or renew their plan incorrectly failed. It now starts a fresh checkout instead, the same as a new signup.
  • Admins can now send a renewal checkout link directly from a user's profile
    the billing drift warning (paid access out of sync with Dodo) now includes a "Send renewal checkout" button that jumps straight into the checkout-link builder with that user pre-selected, instead of requiring a manual search.
  • OSS application success page no longer re-pitches the plan
    after submitting an OSS Hero application, the confirmation page previously repeated the entire marketing hero (with inconsistent "OSS Supporter" copy) and showed "Apply" buttons again. It now shows a clean confirmation with next steps and a single, login-aware call to action.
  • Open-source logo showcase can no longer show placeholder projects in production
    /open-source and /status-page now only fall back to the example logo list in non-production environments; production always shows real approved projects or the existing empty state.
Improvement
  • OSS apply form is easier to fill out
    fields are grouped into labeled sections (Project, Maintainer, Traction, Your setup, Confirmations), required fields are marked, and invalid fields get live feedback on blur instead of only at submit time. The submit button now shows a loading state to prevent double submissions.
  • Open-source page FAQ can't drift out of sync
    the visible FAQ accordion and its FAQPage structured data are now generated from the same source instead of being maintained by hand in two places.
Miscellaneous
  • Extracted the OSS apply/open-source page CSS out of inline <style> blocks into static/css/oss.css, part of the shared build pipeline.
  • Moved the OSS application handlers (validation, drafts, notifications) out of routes_public.go into internal/handlers/oss.go, matching the rest of the codebase's structure.
New
  • **Public status.json for every status page**
    every status page now serves a free, unauthenticated status.json at its own domain root (platform subdomain or connected custom domain), matching the machine-readable convention used by Statuspage.io, Instatus, and BetterStack. Includes overall indicator, a per-component status list, and recent incidents, and respects the same private/password/blocked gating as the HTML page. Unlike the existing paid embed widget API, this is available on every plan.

Improvement
  • Clearer monitor response-check wording
    the "Response must contain" field is now labeled "Match text", with help text clarifying it only applies to 2xx/3xx responses and pointing to Advanced Conditions for matching text on other status codes.
  • Per-region history explains sparse data
    status page region history now shows a note when a region only has a few days of data, since regions are checked during incident confirmation rather than continuously.
  • Spotlight layout background card
    status pages using the Spotlight layout can now show a background card behind the status heading when a banner image is set, and the banner image's vertical position can be adjusted so the important part stays visible when cropped.
Miscellaneous
  • Refreshed localization strings for the updated monitor and region wording across all supported languages.

Improvement
  • Per-monitor region picker shows a live count
    the region selection UI now displays how many regions are selected out of your plan's quota and disables further checkboxes once the limit is reached.
  • Primary region stays in sync with region selection
    choosing a primary monitoring region automatically locks it into the selected regions list (and unlocks the previous one), instead of letting the two fall out of sync.
Miscellaneous
  • Onboarding completion is now saved more reliably
    reaching the final onboarding step marks it complete even if the user never clicks "Go to dashboard".
New
  • Internal IT status page use case
    added a dedicated landing page and navigation links (navbar, mobile menu, footer) covering internal status pages for VPN, SSO, and office systems.
  • Custom domain reassignment notice
    users now get an email when their custom domain is disconnected because another account verified ownership of it, explaining what happened and how to fix it.

Fixed
  • Resumable checkouts handle stale products safely
    if a saved checkout can no longer be purchased, users see a clear message and can start a new purchase instead of following a broken payment link.
Improvement
  • Landing page status-page message
    the public landing page now adds a focused reminder that customers need a single, clear place for incident updates when something breaks.
  • Spotlight status page layout
    status pages can use a focused, centered layout with a dark masthead and full uptime history.
  • Resuming checkout now creates a fresh secure payment link
    pending checkout items no longer rely on an old Dodo checkout URL; when a user resumes, the system creates a new session for the saved plan or add-on.
  • Incomplete checkout messaging is clearer
    the billing page now tells users when a checkout was not completed and points them to the checkout cart to continue.

Fixed
  • Incident severity handling is more robust
    status rendering now has explicit incident severity support, reducing edge cases in pages and metadata that depend on severity values.
  • Public markdown rendering is shared and better tested
    markdown rendering was moved into a reusable renderer with table coverage, improving consistency across public and user-facing surfaces.
  • Status page settings copy around components is clearer
    component management guidance now points users toward the dedicated components workspace and explains subscriber notifications more directly.
Improvement
  • Billing and add-ons pages now explain state more clearly
    active add-ons, available add-ons, renewal dates, trial/renewal progress, and checkout success or failure states are presented with clearer labels and actions.
  • Pricing modal plan details are more consistent
    plan feature data and modal rendering were tightened so upgrade options present limits and included features more predictably.
  • What's New tables are easier to read
    tables in the user What's New page and dashboard panel now have improved spacing and table styling.
  • Internal IT status page template refreshed
    the public internal IT status page template was reorganized with clearer service status content and layout.
New
  • Checkout recovery for unfinished purchases
    users now have a dedicated checkout cart for plan and add-on purchases they started but did not finish, with options to resume or remove pending checkouts.
  • One-time checkout reminder emails
    unfinished checkout sessions can trigger a restrained recovery email after a delay, with a direct path back to the purchase if the user still wants to complete it.
  • Add-on subscription management
    recurring add-ons can now be cancelled at renewal or resumed from the user billing and add-ons pages.

Fixed
  • Transfer acceptance flow no longer strands users on unclear next steps
    post-acceptance navigation now points users toward the transferred status page instead of leaving them to hunt for it manually.
Improvement
  • Status page transfer acceptance is easier to understand
    transfer confirmation now highlights the accepted page in the user's status page list and provides clearer navigation after a transfer is completed.
  • Markdown tables render more reliably in status content
    markdown processing now handles table-heavy content better so incident details and other formatted updates keep their intended layout.

Fixed
  • Status page transfer acceptance now handles existing accounts better
    recipients who already have an account are sent to log in before accepting, and transfer confirmations now show the page URL, monitor/component/subscriber counts, and plan limitations before acceptance.
Improvement
  • Lifetime Deal partner pricing is clearer
    partner landing pages now show the discounted one-time price more directly, split whole and cents pricing for easier scanning, and use partner branding where available.
  • Lifetime Deal page layout was polished
    the page now presents the offer, partner banner, and pricing details with a cleaner visual hierarchy so visitors can understand the deal faster.
  • Onboarding completion feels more concrete
    the final onboarding step now previews the new status page, puts "View my status page" first, and saves attribution answers immediately so they are not lost if the user exits after setup.
  • Business checkout details are easier to prepare
    users buying as a business now get clearer guidance to add company and tax details before purchasing a Lifetime Deal.
New
  • Signed alert chart images for notifications
    alert notifications can now include short-lived, signed latency or fail-rate chart images, giving recipients more context without exposing unrestricted chart URLs.
  • Balkan business tax ID validation
    added validation support for Serbia, Bosnia and Herzegovina, Montenegro, and North Macedonia tax IDs so business billing details can be checked before checkout.

Fixed
  • The public HTML cache could serve the wrong variant of a page whose output depends on its query string
    the cache key was host+path only, so a page like /lifetime-deal?partner/discounthub could either read back a plain cached page or overwrite the cache for everyone else visiting the plain URL. Query-string-dependent pages now bypass the cache entirely; all other pages are unaffected and keep their existing UTM-tolerant cache behavior.
  • The Lifetime Deal "Total Value" stat could mix currencies into one nonsensical dollar figure
    the public Lifetime Deal page and the admin LTD dashboard summed raw purchase amounts regardless of the currency each one was actually charged in, so a single non-USD sale could badly distort the displayed total. Both now report USD-denominated sales only, with a small note when other-currency sales are excluded from the figure.
Improvement
  • Clearer Lifetime Deal inventory, pricing, and trust signals
    the campaign stats now read "Limited to N Lifetime licenses / Sold / Remaining" instead of an ambiguous "Capacity Used" percentage, with a correctly-labeled progress bar. Added a plain-language "regular price vs. one-time price vs. break-even" comparison, a compact trust row (one-time payment, no recurring fees, future Starter updates included, 15-day refund policy) under the purchase button, and an approved-customer-logo social proof section reusing the homepage's showcase data.
  • Lifetime Deal FAQ expanded and corrected
    added entries on future Starter-plan updates, buying add-ons separately, and why licenses are limited; corrected the upgrade-path answer to reflect that lifetime plans don't auto-convert to a higher tier today, and standardized the refund answer on the actual 15-day policy with a link to /refunds-policy.
  • Savings calculator now defaults to a 5-year horizon instead of 3, matching how most lifetime customers actually evaluate the deal.
Miscellaneous
  • Extracted the duplicated Dodo checkout-session construction (used by both the admin checkout-link generator and the public self-serve purchase flow) into a single shared internal/dodo.NewCheckoutSession helper, and moved the public flow off Dodo's deprecated single discount_code field onto the modern stacked discount_codes field.

Fixed
  • Some plan-gated features on team-shared status pages could be checked against the wrong person's plan
    SLA reports, web analytics, and a few other plan-gated on-call/status-page checks were evaluated against the acting team member's own plan instead of the status page owner's plan. A team member could therefore see a feature incorrectly allowed or blocked based on their own plan rather than the page's actual plan.
  • The Team Maintenances page could incorrectly show an "upgrade required" screen
    the check for whether scheduled maintenance is available wrongly excluded a team's own linked status pages in some cases, so a team could be told to upgrade even though their plan already included the feature.
  • Embed widget requests could receive duplicate CORS headers
    /api/embed/status and /api/embed/banner could end up sending the CORS header twice under certain deployment configurations, which some browsers reject outright. Only one is sent now.
  • Links in previously-sent broadcast emails could hit a login wall
    clicking the tracked link in an older broadcast email could redirect through a page that required being logged in, breaking the link for recipients who weren't. Those links now work without requiring login, matching how they worked when originally sent.
Improvement
  • On-call schedule "Rotation Start" now uses a proper date/time picker
    the new/edit schedule form previously relied on the browser's native datetime-local input, which renders inconsistently (and sometimes confusingly) across browsers. It now uses the same Flatpickr calendar+time picker used elsewhere in the dashboard, with a friendlier displayed format while submitting the exact value the server already expects — no other behavior changes.
New
  • On-call schedules can now be shared for editing with your team
    a schedule's creator can flip on "Allow team admins/editors to edit this schedule" so trusted teammates can update the rotation, escalation policy, and members themselves, instead of every change having to go through the original creator.

Fixed
  • The embeddable status widget could silently fail to render on third-party domains
    /api/embed/status and /api/embed/banner weren't sending CORS headers, so a browser loading the widget on any domain other than the app's own could be blocked from reading the response. Both endpoints now reflect the requesting Origin.
New
  • Signed embed widget tokens
    The embeddable status widget and banner snippets now carry a signed, per-page token, so the widget keeps working on every plan (including Free) while direct/raw calls to the underlying JSON endpoint without that token require a paid plan. Enforcement sits behind an env flag (EMBED_API_GATE_ENABLED, default off) so it can be turned on deliberately once existing snippets have had a chance to be regenerated.

Fixed
  • Branding feature access could be checked against the wrong plan field
    one path that gates custom CSS, white-label, and custom logo settings was checking a raw plan field instead of the properly resolved branding permission, which could disagree with what the rest of the app shows you as available on your plan. Both now agree.
Improvement
  • More consistent theme handling across login and account pages
    light/dark theme preference is now respected more consistently across auth pages and related components.
  • Status page transfer emails now include plan-limit warnings
    when you transfer a status page to another account, the notification email now tells the recipient about any of their plan's limits that are relevant to the page they're receiving (e.g. monitor count, feature availability), instead of leaving that to be discovered after the fact.

Improvement
  • Status badge and monitor status rendering on the status pages list is now more consistent.
New
  • Compact and Minimal layout modes for status pages
    two new layout modes join the existing default and large layouts, for teams who want a denser or more stripped-down public page.
  • Dark logo support for status pages
    you can now set a separate logo for dark mode (in addition to the light-mode logo), and status pages automatically switch between them based on the visitor's theme.

Fixed
  • SSL monitoring recommendations could keep nagging you after you'd already acted on them
    the dashboard's "add SSL monitoring" recommendation wasn't being reconciled against your actual monitor setup, so it could stay active even after you added an SSL monitor for that host. It's now automatically completed once a matching SSL monitor exists.
Improvement
  • Redesigned the status pages list
    card-based layout with a clearer operations header, health badges and incident summaries per page, and better-organized notification/action sections. Alerts for page limits, simple-page creation, and manual controls now use clearer language. Monitor status fetching was also streamlined for more accurate, faster updates, including better handling of monitors in an "unknown" state.

Fixed
  • Webhook and chat-integration notifications could be redirected to internal addresses
    Webhook, Discord, Google Chat, Mattermost, Rocket.Chat, and Microsoft Teams notifications only checked the destination hostname once, before delivery. A notification endpoint that responded with a redirect could send the actual delivery request somewhere else entirely, including internal network addresses. Delivery now revalidates every redirect target, not just the original URL.
  • An on-demand billing charge could target another account's subscription
    The charge action accepted a subscription reference from the request instead of always resolving it from the caller's own account. Charges are now always scoped to the authenticated account's own subscription, matching how plan changes, cancellations, and resumes already worked.
  • Refunds could be requested against another account's payment
    Both the direct refund action and the self-service 15-day refund request accepted any payment reference without confirming it belonged to the requesting account. Refunds are now checked against the caller's own recorded payment and subscription history before being processed.
  • A component-scoped team member could manage page-wide incidents
    Team members whose access is limited to specific components could still edit, delete, or post updates to page-wide incidents (ones not tied to a single component), even though creating a new page-wide incident was already correctly restricted to full-access members. Managing existing page-wide incidents now requires that same full-page access.
  • Status page settings could take 3–27 seconds to load
    Loading the "last checked" time for each monitor on the settings page forced a full scan of that monitor's entire result history instead of using an index. This is now an index-only lookup per monitor.
  • Trials extended manually could still auto-expire on their original date
    A trial that had been extended skipped the normal grace-period handling but was still being picked up by the job that auto-expires trials, so it could be cut off early instead of on its actual (extended) expiration date.
  • Billing charge/refund actions could report success even when the record wasn't saved
    If saving a charge or refund to your billing history failed after the payment provider had already processed it, the request still returned success with no indication anything was wrong. These actions now surface an error and ask you to contact support if that happens, instead of silently losing the record.
  • Duplicate or retried billing webhook deliveries could be processed twice
    Dodo billing webhook events (subscription changes, payments, refunds) had no de-duplication, so a retried delivery could be applied a second time; a failure partway through processing was also silently swallowed instead of causing a retry. Each webhook delivery is now tracked and de-duplicated, and failures now correctly trigger a retry.
  • Fixed a rare case where loading status page settings could silently recreate a missing custom-domain record instead of just omitting it from the page.
Improvement
  • Status page settings page loads noticeably faster
    Previously every settings tab's HTML was sent on every page load; each tab now loads only when you open it.
  • Redesigned the public status page's "unavailable," "suspended," and "refreshing" pages (shown when a page is deleted, disabled, or being rebuilt) with clearer layouts.
New
  • Feature Unlock add-ons
    Add-ons now come in two kinds: the existing one-time Increment add-ons (extra monitor slots, extra status pages) and new monthly Feature Unlock add-ons that turn on a single premium feature your plan doesn't include (e.g. Custom Domain) without a full plan upgrade. The Add-Ons page shows what each add-on grants, its type, and why it isn't purchasable if it isn't (already included, already active, or not offered on your plan); a new "Add-Ons" entry was added to the dashboard menu, the over-limit and downgrade-choice screens now explain add-on options more clearly, and Billing shows a billing-cycle progress indicator.
  • incident.io Widget API auto-detection
    When connecting an incident.io integration, a new helper can auto-detect your Widget API endpoint from your public status page URL instead of requiring it to be entered by hand.

Fixed
  • Status page settings menu didn't respond to clicks (stuck on the Visual tab)
    The activate-disabled-monitors handler had a stray block of leftover/mismatched code (from an unrelated delete-status-page flow) that unbalanced the script's braces, and the same block's containing IIFE was missing its closing })(); entirely. Either defect alone breaks JS parsing for the whole settings page, silently killing every tab/click handler on it. Restored the correct handler body and the missing closing braces.
  • Favicon/logo uploads never showed up on the public status page
    Uploading a new favicon or logo updated the dashboard instantly but never invalidated the public page/shell cache, so visitors kept seeing the old one until the cache naturally expired. These uploads now invalidate the cache immediately, matching every other branding change.
  • Deleting a status page could leave a stale cached copy live
    Soft-deleting a status page (by its owner or an admin) didn't invalidate its page/shell cache, so a deleted page's public URL could keep serving cached content for a while after deletion.
  • Concurrent settings saves could silently overwrite each other
    Two people (or two tabs) saving status page settings at the same time could have the second save silently discard the first one's changes. Saving now detects this and asks you to reload and retry instead of losing data. The same protection now applies to restoring settings from a pre-downgrade snapshot.
  • A status page manager could delete another page's subscriber
    Deleting a subscriber only checked that you could manage the status page named in the URL, not that the subscriber actually belonged to it, so a valid-looking request with someone else's subscriber ID would delete it. Deletion is now scoped to the specific status page.
  • The "blocked" moderation flag could be cleared by the page owner
    A hidden form field meant only to help the settings form detect partial saves could be tampered with to un-block a page an admin had blocked. That field is no longer user-writable.
  • Uploaded SVG favicons/logos could carry executable scripts
    SVG files were stored and served as-is with no sanitization, unlike other status page platforms. SVGs are now parsed and stripped of <script> tags, event-handler attributes, and external references before being saved; logo uploads also now get the same image-validity check favicons already had.
  • Logo/favicon filenames could collide and silently corrupt each other
    Two uploads within the same second (or a default/dark/light logo uploaded together) could overwrite each other's file on disk despite being tracked as separate settings. Filenames now include a UUID.
  • Custom domain locale save wasn't atomic with the rest of settings
    A status page's display locale was written in a separate, non-transactional query; if the rest of the settings save then failed and rolled back, the locale change stayed committed anyway. It's now part of the same transaction.
  • Secrets could leak into application logs
    A debug log on settings-save failure dumped the entire settings struct, including the password hash and Azure AD/Google/OIDC client secrets, in plaintext. These fields are now redacted before logging.
  • Unbounded SSL-provisioning poll
    The custom domain modal polled the SSL status endpoint every 10 seconds indefinitely while a certificate was pending. Polling now stops after ~5 minutes with a "still provisioning" message instead of continuing forever.
  • Custom domain wizard showed the wrong CNAME target
    The DNS setup instructions hardcoded statuspage.me as the CNAME value instead of the page's actual platform domain, so pages served from other supported domains got incorrect setup instructions.
  • Fixed several data-i18n keys on the status page settings page that used literal English text as the translation key (so they silently never translated) instead of a proper namespaced key, and one case where a JS-injected empty-state message was mismapped to the "loading" translation key.
  • Fixed a fragile subscriber-count selector (.card-body h3) on the settings page that could update the wrong element if another matching card ever rendered earlier in the DOM.
  • Adding a component or component group with a blank name now shows a clear validation message instead of silently doing nothing.
Improvement
  • Status page settings, favicon/logo, and palette validation now reject malicious or malformed input more consistently
    custom_css has a 64KB cap, logo_url/dark_logo_url/light_logo_url are validated the same way logo_click_url already was, custom_domain is checked against a hostname format before being saved, and color-palette extraction now caps image dimensions and remote download size to avoid a decompression-bomb-shaped upload.
  • Branding uploads (favicon/logo/palette) now correctly gate on the status page owner's plan rather than the acting team member's own plan, matching how the banner settings already worked.
  • New status page slugs now go through the same validation as slug *change* requests (minimum length, no leading/trailing hyphen, global uniqueness, reserved-word check), closing a gap where a brand-new page could get a slug the rename flow would have rejected.
  • Replaced the remaining native alert()/confirm() fallbacks in the status page settings page with SweetAlert2, and removed several since-fixed "Swal isn't loaded" defensive branches that are no longer needed.
  • Component groups can now be renamed and deleted directly from the settings page (the backend already supported this; only reorder was wired up in the UI before).
  • The Banner tab's save button now uses the same AJAX save experience (spinner + toast, no page reload) as the rest of the settings page, instead of a full-page form submit.
  • Replaced ~840 lines of dead/orphaned code in the status page settings page and its handler
    unreachable legacy notification-channel config modals superseded by the newer "Linked Notification Channels" system, and an old inline custom-domain verification flow superseded by the current wizard.
Miscellaneous
  • Reviewed the status page ownership-transfer flow, IDOR exposure of ownership-agnostic model lookup functions, and the recipient-email trust model
    all confirmed already safe (strong token entropy, no unauthorized cross-tenant access found).

Fixed
  • Custom domains could get permanently stuck as "verified but inactive"
    Checking SSL status in the custom domain settings modal confirmed DNS routing and certificate validity but never activated the domain, and once that check succeeded, the only other button that could activate it disappeared from the UI — leaving no way to finish setup. Checking SSL status now activates the domain (unless an admin has explicitly disabled it), matching what the UI already implied was happening.
  • Custom domain deactivation splash showed the wrong message for paid customers
    The "requires an active paid plan" splash could incorrectly appear for a domain that was simply never fully activated (see above), even on a paid plan. It's now only shown when a domain was actually deactivated for a known reason (plan downgrade or admin action), and shows different, accurate copy for each — no upgrade prompt for an admin-disabled domain.
  • Wrong status page URL shown when a custom domain was set as primary but not yet active
    The Status Page Settings header could show <slug>.your-custom-domain.com (which won't resolve for most custom domains) instead of the bare custom domain, because the URL-display logic required custom_domain_active while the primary-domain resolution used a looser, inconsistent check. Both now agree.
  • "Set as Primary Domain" didn't actually make the custom domain primary
    The action only updated which domain was marked primary, but the public redirect logic separately required the domain to be "active" to treat it as such — so visitors kept landing on the free slug.statuspage.me URL even after a verified custom domain was set as primary. Setting a verified domain as primary now also activates it.
Improvement
  • Clearer custom domain connection status
    The "DNS Routing" step indicator and instructions in the custom domain modal now correctly reflect whether CNAME/SSL is actually confirmed, instead of always showing "pending" even once the domain is fully connected. The "Set as Primary Domain" button now has an animated highlight (matching the embeddable widget and public navbar's "Dashboard" link) when it's the one remaining step.
New
  • Custom domain deactivation splash page
    Visitors hitting a custom domain that was previously verified and active but has since been deactivated (e.g. after a trial or plan downgrade) now see a branded 10-second interstitial explaining the domain is temporarily unavailable, with an upgrade CTA and a "Continue now" link, before being redirected to the status page's default statuspage.me URL. Domains that are still pending verification or never completed setup continue to redirect instantly, unchanged.
  • Removed custom-domain redirect fallback
    Because DNS-verified TLS certificates can remain cached and valid for a while after a custom domain is fully removed from a status page, visitors who still reach us via a stale cached cert are now redirected (with a neutral "no longer connected" splash, no upgrade messaging) to the status page's current address instead of seeing a generic "this status page doesn't exist" page.
  • Custom domains auto-restore on plan upgrade
    A custom domain deactivated by a trial expiration or plan downgrade is now automatically re-enabled the next time the user upgrades to a plan that supports custom domains, instead of requiring a manual re-toggle in settings.
  • More reliable custom domain DNS verification
    Domain ownership verification now forces IPv4 for its DNS lookups, so an IPv6-only nameserver path can no longer cause a verification attempt to fail or report a confusing network error.
  • Admin "claim existing domain" tool
    Admins can now attribute a custom domain that's already resolving to our infrastructure (DNS and TLS cert already in place) but has no record in our system to the correct status page, without requiring the owner to redo DNS verification.
  • Clearer messaging for unclaimed custom domains
    A custom domain that resolves to us but has no matching status page (e.g. setup was never finished, or the record was lost) now shows instructions to log in and reconnect it, instead of a generic "create your own status page" pitch, and no longer auto-redirects anywhere.

Improvement
  • Trial cohort analytics fixed
    Trial Management now separates signup trials, billing-upgrade trials, admin extensions, feedback access, friend/free access, support recovery, and legacy admin-granted trials. Qualified conversion rates now exclude active pipeline trials and non-qualified free/feedback/legacy cohorts instead of mixing them under the old source-based view.
  • Matomo analytics support
    Status pages can now use Matomo as a web analytics provider alongside the existing privacy-friendly analytics options, including support for self-hosted Matomo installations.
  • Safer alert and email formatting
    Email rendering now handles Markdown-style content more defensively, reducing formatting surprises in operational messages and alert emails.
  • Cleaner traffic logging
    Long-lived server-sent event streams are now excluded from page-visit logging, keeping traffic analytics focused on real page views instead of background connections.
  • Plain-English product guide
    Added a new public guide explaining what StatusPage.me does in buyer-friendly language, with internal links from the active landing page, FAQ, feature pages, hosted status page, status page explainer, and footer.

Improvement
  • Heartbeat controls and recovery prompts
    Heartbeat monitoring got stronger admin controls and tracking, and accounts coming back from plan reactivation now get a dashboard prompt to restore pending settings snapshots instead of silently leaving work half-restored.
  • Regional aggregation and monitor settings performance
    Admin-triggered regional aggregation and backfill jobs now tolerate longer runs more reliably, while the related gap-scan and monitor-region queries were tightened up for better performance and cleaner type handling.

Improvement
  • Heartbeat evaluator liveness alerting
    The background job that checks heartbeat monitors for missed pings now reports its last successful run to the existing internal health-check system. If it stops ticking for more than 8 minutes, admins now get an alert instead of only finding out via a customer report. Also fixed a gap where a panic during the page-load "self-heal" status correction (added June 29) could crash the whole dashboard process instead of being safely logged, matching the protection the background evaluator already had per-row.

Improvement
  • Suspension notifications and weekly reports
    Suspension and unsuspension actions now send the related notification emails, and weekly reports include richer incident details plus uptime settings context for clearer customer summaries.

Improvement
  • Heartbeat creation/edit forms now hide irrelevant fields
    "Show on public status page" and "Public Name" no longer appear when creating or editing a private heartbeat, since there's no status page for them to apply to.
New
  • Private (standalone) heartbeat monitors
    Heartbeat monitors no longer need to belong to a status page. Choose "None — private heartbeat (alerts only)" when creating one to get alerting with nothing public-facing, or detach an existing heartbeat from its status page at any time. Requires a paid plan; uses a separate quota from page-attached heartbeats. See Private (Standalone) Heartbeat Monitors.
  • Heartbeat Troubleshooter
    Every heartbeat's detail page now has a Troubleshooter card that independently re-checks whether the current status is accurate, explains the deadline math, and shows ping cadence stats (count, min/max/average delta) and drift status over a selectable 1h/24h/7d window — so you can self-diagnose a heartbeat without contacting support.

Fixed
  • Heartbeat monitors could stay stuck on "Healthy" past their grace period
    In some cases a heartbeat that stopped receiving pings wasn't reliably flipped to "Missed," so the dashboard kept showing it as healthy and no alert was sent even well past the configured interval + grace period. Missed-detection is now isolated per monitor so one problematic heartbeat can no longer prevent others from being evaluated, and opening the heartbeat list or detail page now also re-checks and corrects the status immediately if it's overdue.

Fixed
  • Plan downgrades now apply reliably after a subscription ends
    When a paid subscription reaches its end state, accounts are now moved back to the Free plan consistently and paid-only resources are limited according to the Free plan instead of leaving paid access active by mistake.
  • Billing and downgrade emails now use the current plan names
    Subscription, renewal, payment-failure, and trial-expiry messages now consistently refer to the Starter and Team plans instead of older plan names.

Fixed
  • The Rotation Members add button on on-call schedules now opens the inline member composer reliably
    The + action now reveals, focuses, and scrolls to the add-member form instead of appearing to do nothing when adding rotation members from the schedule detail page.
  • Sending a test alert now refreshes the Alert Delivery Log automatically
    Test alerts for on-call members now trigger an immediate log refresh plus a short follow-up refresh so recent delivery entries appear without a manual reload.
  • Empty escalation policies no longer show a misleading save action
    The schedule editor now keeps the empty-state message visible and hides the Save Policy action until at least one escalation step exists.
  • Alert Routing now blocks exact duplicate rules on the same schedule
    Component- and page-level routes already assigned to the current schedule can no longer be added again, while existing routes can still be reassigned cleanly from one schedule to another.
Improvement
  • Team pages now offer direct On-Call shortcuts
    Team detail pages now include an Open Team On-Call action plus a sidebar On-Call summary card with quick links to schedules and response metrics, making shared on-call workflows easier to reach from the team dashboard itself.
  • On-call calendars now show the next handoff in the selected timezone
    The schedule calendar header now displays the next handoff as an absolute time in the currently selected timezone, which makes team and local-time views much clearer during cross-timezone rotations.

Fixed
  • Team invitations now fail more cleanly when the recipient already has an account or another invite is pending
    Invite creation and acceptance now surface clearer conflict states instead of behaving ambiguously around existing accounts, duplicate invites, or full teams.
  • Invite acceptance for new users is now safer and more atomic
    Accepting an invite through the account-creation path now creates the passwordless account and accepts the invitation in one transaction, preventing half-completed joins.
  • Team audit history is preserved after a team is deleted
    Team audit logs now keep the deleted team's identity and name snapshot, so admins can still review historical team actions even after the live team row is gone.
  • Partial-outage notifications now explain the real cause too, not just full monitor-down alerts
    The expired-SSL-certificate detection and root-cause lookup added on 2026-06-23 only ran when a monitor crossed the full down threshold. Monitors stuck in a sustained partial-failure state (some but not all regions failing) now get the same "likely cause" line in their escalation notification instead of a generic "regions have been failing" message.
Improvement
  • Team pages now emphasize seat usage instead of a generic member count
    Team owners now see how many seats are used versus available directly in the "My Teams" view, making plan limits and upgrade pressure much clearer.

Fixed
  • Trial links and trial provisioning could disagree about how long a free trial lasts
    Trial duration logic was previously split across pricing links and signup handling, which could produce mismatched expectations. Trial length is now resolved consistently across the pricing page, public routes, OAuth signups, and account creation.
  • Checkout/subscription metadata handling now matches the updated Dodo SDK flow
    The billing integration was updated to the newer Dodo Payments SDK behavior so checkout-link and subscription creation continue sending metadata correctly.
Improvement
  • Pricing CTAs now state the actual trial length for each billing mode
    Starter and Team plan buttons now clearly show when the trial is 7 days versus 14 days, and the signup flow uses the same trial-duration rules consistently.
New
  • Heartbeat monitors can now target specific notification channels
    Each heartbeat can now be linked to a custom subset of the user's notification channels, instead of always inheriting the broader status-page notification setup.

Fixed
  • HTTPS monitors with expired certificates now explain the real cause of the outage
    When a site is reachable but its TLS certificate has expired, monitor-down alerts and incident text now say that the SSL certificate expired, instead of surfacing a generic TLS/network failure.
Improvement
  • Checkout link discount codes are now validated against the selected product before a link is created
    Instead of accepting any typed code and failing later, the tool now checks that each code is active and actually applies to the chosen Dodo product.
  • The admin checkout-link screen now handles expired sessions more gracefully
    If an admin session expires while loading discount codes or generating/deleting a link, the page now shows a clear "session expired" prompt instead of a confusing background-request failure.
New
  • Admin checkout link generator for billing/sales follow-ups
    Admins can now generate one-off Dodo checkout links from the dashboard for a specific product, optionally stack multiple discount codes, attach a return URL, and keep a local history of recently generated links.
  • Checkout links can now be tied to a specific customer
    The generator supports an optional customer email and name, so a shared checkout session can be associated with an existing Dodo customer when one already exists, or create a new customer record when needed.

Fixed
  • Self-service email change wrongly rejected as undeliverable
    The deliverability check treated a transient SMTP-probe rejection (common for corporate mail servers that throttle or block third-party verification probes) as a confirmed permanent failure unless the domain was a Microsoft consumer domain, then cached that false negative for 48 hours. The transient-to-unknown correction now applies regardless of domain, so a flaky probe no longer permanently blocks a legitimate address.
Improvement
  • Telegram client-error alerts now show the real rejection reason
    User-facing 4xx/5xx alerts previously showed a generic "Unexpected client-side error" note for any 422. They now surface the actual error message returned to the user when available.
New
  • Admin "Email Deliverability Recheck" tool
    Clears the cached disposable/deliverability verdict for an arbitrary email address and re-checks it live. Lets support unblock a user whose self-service email change was wrongly rejected, without waiting out the 48-hour cache.

Fixed
  • Some account/dashboard links in emails could 404 due to a duplicated path segment
    Several lifecycle and notification emails (including the "your status page is growing" tip, trial/billing reminders, complimentary-access notices, and custom-domain confirmations) built their call-to-action links by appending a path that was already partially included in the configured base URL, producing a broken doubled segment. These links now resolve correctly.
  • A test/preview password-reset email pointed at a non-existent page
    An internal admin tool used to preview transactional emails linked to the wrong reset-password path.
  • The Incident Archive and Maintenance pages on public status pages loaded empty by default
    Visitors had to manually pick a date and click "Apply Filters" before any history appeared; the page always landed on a "No incidents/maintenances selected" empty state even though years of history existed. These pages now load the full history immediately, sorted newest first, with date/month/year/range filters available as optional refinements.
  • The archive "Search" box only matched rows already loaded on the current page
    Searching for an older incident or maintenance event not on the visible page silently returned "no results" instead of finding it. Search is now handled server-side across the full archive.
  • Affected component badges never appeared on the default (unfiltered) Maintenance page listing
    The component names were looked up but never attached to the response, so the badges shown next to each maintenance entry were always empty unless a date filter was applied. They now resolve correctly in both the filtered and unfiltered views.
Improvement
  • Incident Archive and Maintenance pages now show severity/state context per row
    Each entry displays its severity and status badge inline, matching the styling used on the main status page and single-incident view, instead of plain unstyled text rows.
  • Incident Archive and Maintenance calendars are now keyboard-accessible
    Calendar days can be focused with Tab and activated with Enter/Space, and selected/unselected state is exposed to assistive technology.
  • Archive action links now have descriptive labels for screen readers
    Each "View Details" link announces the specific incident/maintenance title instead of identical, indistinguishable link text.
  • Incident Archive and Maintenance pages now use the status page's configured background
    Previously these pages always showed a generic decorative gradient regardless of the status page's brand background settings.
New
  • Automatic recovery for stale duplicated-path links
    Requests that hit a URL with the duplicated path segment described above (for example from an old, already-sent email) are now automatically redirected to the corrected link instead of showing a 404.
  • Server-side search on the Incident Archive and Maintenance pages
    The search box now queries title and description across the entire archive instead of only the currently loaded page.

Fixed
  • Team invite seat limit could be exceeded by concurrent invites
    Seat-limit checks read the current member/invite count without locking the team row, so two invites submitted at nearly the same time could both pass the check and push a team over its seat limit. CreateTeamInvitationWithSeatLimit now locks the team row (FOR UPDATE) for the duration of the check-and-insert.
  • Team admins kept Admin-level access after a trial expired
    Admin is a paid-plan-only team role, but team members who'd been promoted to Admin during a trial kept that role after the trial expired and paid features were disabled. They're now automatically demoted to Editor when trial features are turned off.
  • Team invite acceptance could leave a user logged in without an actual team membership
    Accepting a team invite set the user's session before confirming the invite was actually accepted, so a failed/expired acceptance (race condition) could leave someone logged in with no team access. The invite is now accepted before the session is created, and suspended accounts are blocked from joining a team via an invite link entirely.
  • Component group status showing "Unknown" after a status page's first monitor was added
    The public live-status hydration endpoint (used to refresh status badges client-side after page load) computed component-group status from monitors only, passing nil for manual (non-monitored) components — the same gap fixed elsewhere on 2026-06-16 had been missed here. Pages built entirely from manual components never triggered this endpoint client-side (it's skipped when there are no monitor cards on the page), so the bug stayed dormant until a page's first monitor was added — at which point every component group's badge flipped to "Unknown" the moment client-side hydration ran, even though the underlying components were fine. Fixed by loading and resolving manual component states the same way the other status-page render paths already do.
Improvement
  • Status page selection now respects the URL over local storage
    Visiting a dashboard page with ?status_page_id=<id> now always selects that page, falling back to the last page you had open (local storage) and then to your first page only if the URL doesn't name a valid one. Previously a previously-selected page stored in local storage could override a bookmarked or shared link.
  • Dashboard stat badges redesigned
    The Monitors / Status Pages / Uptime badges on the main dashboard now use a colored icon tile plus a number/label pair instead of plain text-in-a-pill badges.
  • Status pages list switched from a table to a card grid
    Each status page is now its own card (logo, name, URL, health badge, incident/monitor/uptime stats, last check and last incident time) instead of a table row; logos now switch between light/dark variants to match the active theme.
  • Team management visual indicators
    The Teams page now shows a progress bar and avatar-style badges for team/seat usage (turning red at the limit, with an upgrade prompt), and role descriptions (Owner/Editor/Viewer) are shown as cards with icons instead of a plain list.

Fixed
  • Status page overall status ignoring manual (non-monitored) components in several places
    CalculateOverallStatusWithDependencies/CalculateOverallStatus, used by the embed widget and badge endpoints, only ever looked at monitor states, so a status page built from manual components (plus their overrides and incidents) could show "All Systems Operational" on an embed or badge during a real outage. The shell-cache merge path (MergeShellWithLiveData) had the same gap when computing component-group status. Added models.CalculateStatusPageOverall(), which folds in monitor states, manual component states/overrides, component groups, active incidents, and dependency providers, and switched the embed/badge endpoints and the shell-merge group computation over to it.
  • Stale incident data on the no-shell-cache fallback render
    The fallback full-render path derived manual component states from a 60-second in-memory incident-impact cache instead of the incident list it had just queried, so a newly opened or resolved incident affecting only manual components could take up to a minute to show up. Now recomputed from the freshly-fetched incidents on every request.
Improvement
  • Shared "Ping URL" modal
    The heartbeat "Ping URL" dialog (copy-to-clipboard plus Bash/PHP/Go/Node.js/Python code samples) is now one shared partial used by both the heartbeats list and the heartbeat detail page instead of duplicated modal markup, and the heartbeat monitors list layout was tightened up for narrower screens.
  • Heartbeats on public status pages now render as compact rows
    Heartbeat monitors shown on a status page switched from one card per heartbeat to compact, hover-highlighted table rows (name/description, last ping, expected interval, status badge); the expected interval is now shown in human-readable form (e.g. "Every 5 minutes") and all heartbeat status labels are translated.
  • Status page header blur-on-scroll
    The large/simple status page template's sticky header now picks up a subtle blur once the page is scrolled, matching the effect used elsewhere.
  • Admin "status pages" popover no longer disappears when you move toward it
    The hover popover on the Admin Users list used Bootstrap's built-in hover focus trigger, which hid the popover the instant the cursor left the badge — including while moving toward the popover itself to click a link. Replaced with a manual show/hide state machine that tracks hover/focus on both the badge and the popover with a short grace period.
Miscellaneous
  • IMAP bounce worker retries transient failures
    The background job that scans the bounce mailbox for hard-bounce notifications now retries once after a 5s backoff on connect/login/search failures instead of giving up for the rest of that run.
New
  • Heartbeat monitor enable/disable toggle
    Heartbeat monitors can now be paused without deleting them: a new toggle button on the heartbeat detail page flips the monitor on/off via a confirmation dialog. While disabled, the monitor stops accepting pings (returns a "disabled" response instead of recording a check), is excluded from status calculations, and won't alert; re-enabling re-checks your plan's heartbeat quota. Toggle, confirmation, and failure messages are translated across all 9 supported languages.
  • "Was this article helpful?" feedback on docs articles
    Public help-center/docs articles now show a thumbs up/down widget. Votes are recorded once per browser and aggregated per article; admins can review helpfulness rates from a new Docs Article Feedback page under the admin marketing menu.

Improvement
  • SSO login access via social login area
    The Sign in with company SSO button now appears as a full-width outline button in the social login area on both the login and registration pages, between the OAuth provider buttons and the hardware key option.
  • OIDC SSO new users skip onboarding
    New users created via OIDC SSO go directly to the dashboard instead of the onboarding wizard. Since they are part of an organization that already has status pages configured, the guided setup is not relevant.
New
  • OIDC SSO for dashboard login
    Organizations can now configure their own OpenID Connect identity provider (Okta, Azure AD, Keycloak, Auth0, and any OIDC-compliant provider) so team members sign in to StatusPage.me with corporate credentials. Setup is fully self-service from Account Settings → SSO Settings: enter your issuer URL, client ID, and allowed email domains, and we auto-discover endpoints via .well-known/openid-configuration. When a team member enters their work email on the login page, we route them to your IdP and automatically create or link their account on first login. Supports multiple providers (e.g. separate configs for @acme.com and @acme-eu.com). See OIDC SSO for setup instructions.

Fixed
  • Private monitor check history page returning 404
    The Checks page for private monitors returned 404 because the ownership query joined through status_pages, which has no row for private monitors. Fixed to use a direct monitors.user_id lookup.
  • Private monitors excluded from scheduler
    The main scheduler query filtered monitors by status_page_settings.active = true. Since private monitors have no status page, sps was always NULL and they never entered the scheduling loop, meaning checks only ran when manually triggered. Fixed to also include monitors where both status_page_id and component_id are NULL.
  • Private monitor bell icon opening alerts page instead of channel picker
    The monitors list showed the /alerts page link for private monitors instead of the channel picker dialog. The template condition checked StatusPageID.Valid, but because the SQL uses COALESCE(..., '') the field was always non-null (empty string). Fixed to check StatusPageID.String == "" instead.
  • **Bootstrap Modal.getOrCreate not a function**
    The channel picker used bootstrap.Modal.getOrCreate() which does not exist in the Bootstrap version bundled with the project. Replaced with the standard getInstance() || new Modal() pattern.
  • Private monitor notification channels not shown on Edit Monitor
    The Edit Monitor handler only fetched notification channels from the status page. For private monitors (no status page) it now falls back to ListEnabledChannelsForMonitor so currently linked channels display correctly on page load.
  • Channel destination disappearing after saving
    After saving alert channel changes on the Edit Monitor page, the refreshed channel list omitted the destination (email, Slack channel, etc.) because the JS refreshChannelList function did not call subtitle(). Fixed to include destination in the re-rendered list.
  • "Manage channels" link pointing to wrong URL
    The Notification Channels card on Edit Monitor linked to /user/notification-channels; corrected to /user/status-pages/notifications.
  • "Detach from Status Page" in Edit Monitor triggering browser resend dialog
    The button used window.location.reload() after the async detach request succeeded; because the page was reached via a form POST, the browser prompted to resend the form. Fixed to use window.location.href = window.location.href which always issues a GET.
  • Team members seeing skeleton loaders on Monitors page
    The metrics API used filterMonitorIDsForUser which only checked direct monitor ownership and status page ownership, not team membership. Invited team members had all their monitor IDs filtered out, so the metrics endpoint returned empty data and sparklines/stats never resolved. Fixed to include an EXISTS subquery through team_status_pages → team_members, mirroring the same pattern used elsewhere in the codebase.
  • Monitor sparkline blank for newly created private monitors
    Two JS guards checked data.latency.length > 1 before calling the sparkline renderer, silently dropping a single data point. A new monitor whose checks all fall within one 30-minute bucket receives exactly one latency value from the API, which was discarded. Changed guards to > 0 and updated spark() to handle a single point by duplicating it into a flat horizontal line.
  • Card view "Alerts" button for private monitors opening wrong page
    In Card View the Alerts button always linked to the alert history page, even for private monitors. For private monitors it now opens the notification channel picker dialog (matching the Row View behavior), and the button is relabelled "Notifications".
  • Card view Disable/Enable button wrapping alone on a second row
    The action buttons used flex-wrap with ms-auto on the Disable button; at typical card widths Disable wrapped onto its own row right-aligned in empty space. Restructured the card footer into two explicit rows: action buttons (Edit / Notifications or Alerts / Checks / SLA Report) on the first row, and Disable/Enable full-width below.
New
  • **Import from JSON
    auto-detect from live response — The Import from JSON button in the Validation section now silently probes your API endpoint in the background (the same call that powers URL validation). If the response is JSON, a ✓ Response detected hint appears next to the button. Clicking it opens a visual picker instead of a paste dialog — no copy-pasting needed. The picker groups fields by their parent key (root-level fields under ROOT**, nested objects and arrays under their parent name). Arrays of objects with a shared identifier field (key, id, slug, or code) are expanded to one row per item using JSONPath filter expressions, not index-based paths. Each row shows the field name in plain language, a type-coloured value badge (grey for strings, green/red for booleans, blue for numbers), and the full JSONPath expression for expert review. Common field names (status, code, error, message, ok, result, state, healthy, alive) are pre-checked; everything else starts unchecked. If the endpoint requires authentication or a custom payload is needed, Paste custom output instead → falls back to the original paste flow. The same auto-detect behaviour is available on both Add Monitor and Edit Monitor.
  • Detach a monitor from its status page
    Any page-attached monitor can now be converted to a private (standalone) monitor without deleting it. Two entry points: the ⋮ kebab menu on the Monitors list ("Make Private"), and the Detach from Status Page button at the bottom of the Edit Monitor sidebar. The monitor keeps its check history, keeps running, and keeps sending alerts — it simply leaves the public status page. See Private (Standalone) Monitors.
  • Component assignment guard for private monitors
    Selecting a status page component while editing a private monitor now shows a confirmation dialog before proceeding. Previously the assignment happened silently, which surprised users who were exploring the form. The dialog explains that the monitor will become page-attached and gives the option to cancel.

Improvement
  • JSONPath condition row UI
    Condition rows now use a two-row layout: the type dropdown and path occupy the top row (full width), and the operator, value, and remove button sit below. Paths render as depth-coloured badge pills (click to edit, blur/Enter to return to pills). The operator dropdown auto-sizes to its longest option so labels like "does not contain" and "matches regex" are never clipped.
  • Channel destination in alert channel picker
    The channel picker modal on the Monitors list and the Edit Monitor picker both show a second line per channel with the human-readable destination: email addresses, #channel-id for Slack, chat ID: N for Telegram, webhook hostname for Discord/Teams/Google Chat, destination numbers for SMS.
  • **Notification Channels card
    "Manage channels" always visible** — The empty-state in the Notification Channels card on Edit Monitor now always shows a "Manage channels →" link, even when the monitor has no status page.
New
  • Private (standalone) monitors
    Monitors can now be created without a status page. Select None — private monitor (alerts only) in the Status Page dropdown when adding a monitor. Private monitors run on the normal check schedule, send alerts via per-monitor notification channels, appear in the monitors list under a dedicated group, and can be moved to a status page later via Edit Monitor. Quota is calculated separately from per-page limits (floor(monitors per page / 3)).
  • Per-monitor alert channel picker
    Private monitors have a dedicated Configure button in the Notification Channels card on the Edit Monitor page. Channels show type icon, name, and destination (email address, Slack #channel, Telegram chat ID, webhook hostname, etc.). The card updates in-place after saving without a full page reload. The bell icon on the Monitors list also opens the picker for private monitors.
  • **Import from JSON
    smart filter expressions** — When pasting an API response with a homogeneous array of objects that share an identifier field (key, id, slug, or code), the importer now generates JSONPath filter expressions ($.components[?(@.key=='upload')].status = ok) instead of index-based paths ($.components[0].status). Filter expressions survive array reordering and produce far fewer conditions (one per component instead of one per leaf field per component). Generic label fields (label, name, title, description, display_name) are skipped as they are not meaningful health conditions.
  • **Import from JSON
    hide already-monitored conditions** — When importing conditions for a URL that already has other monitors, conditions whose JSONPath key is already covered by another monitor are excluded from the import results. A note shows how many were hidden. (Edit Monitor excludes the current monitor's own conditions so re-importing works correctly.)

Fixed
  • Recurring Caddy CPU/load outage (certmagic on-demand TLS race)
    Root-caused the repeated swap-thrashing outages (load average 28+, all cores pegged) to a certmagic v0.25.2+ concurrency bug in getCertDuringHandshake's leader/waiter cache-population pattern: when concurrent TLS handshakes arrive for the same not-yet-cached hostname (e.g. immediately after a Caddy restart, when the on-demand cert cache is empty), the race causes unbounded recursive goroutine pileup (742 stuck goroutines found within 4 minutes of a fresh restart). Investigated and ruled out DNS-01/wildcard certs as a fix (1984.is has no real DNS API — only a fragile screen-scraping integration — and the race is in cache population, not challenge type). Shipped a fix that keeps the on-demand cert cache "always warm" so the race condition's precondition (concurrent handshakes to a *cold* cache entry) never occurs:
  • Added scheduler.StartPrewarmSelfHealScheduler (internal/scheduler/prewarm_self_heal.go), which every 3 hours re-enqueues every active platform subdomain and verified+active custom domain into the existing status-page prewarm queue (internal/prewarm, originally shipped for first-visit performance)
    closing the gap where that queue only ever warmed *newly created* hosts and never revisited ones that already existed, so previously-warm certs never silently drift back to a cold/race-prone state between restarts.
  • Added scheduler.StartCaddyRestartWatcher, which polls systemd's ActiveEnterTimestamp for caddy.service every 30s and triggers an immediate full prewarm sweep the moment Caddy (re)starts
    closing the cold-cache window that's the dominant trigger for the race. Note on the path not taken: the first attempt wired a serial pre-warm script directly into caddy.service via an ExecStartPost= drop-in. That unit ships hardened with ProtectHome=true/ProtectSystem=strict, which makes any path under /home (including a deploy-checkout script) invisible inside Caddy's sandboxed mount namespace — producing a misleading "Failed at step EXEC ... No such file or directory" (203/EXEC) for a file that plainly exists. Attempting to punch through with BindReadOnlyPaths= destabilized the main process during its restart cycle (SIGKILLed instead of exiting gracefully), causing a further outage. Polling from the Go server side — which isn't subject to Caddy's sandbox and already owns the prewarm queue — achieves the identical "warm immediately on restart" outcome without ever touching caddy.service or its drop-ins.
  • Restore binaries and cache cleanup
    Improved error handling for restore-binaries and tightened the cache cleanup logic.
  • Self-targeting monitor sweep crash
    runSelfTargetingMonitorPause failed to scan 9 of 10 candidate rows with cannot scan NULL into *string because it selected the unused, nullable component_id column into a non-nullable field; removed the dead column from the query/struct/scan entirely.
  • Apex self-monitoring incorrectly flagged as a self-targeting loop
    The pause sweep treated the platform operator's own legitimate uptime checks of owned apex domains (e.g. statuspage.me, sapat.chat) as orphaned self-targeting loops and would have permanently disabled them across all monitoring regions. Orphaned loops only ever arise from customer subdomains (<slug>.statuspage.me) whose slug no longer resolves; bare apex targets are now exempt via security.IsPlatformOwnedApex. Also added sapat.chat to the SelfHostedDomains skip-list so its checks stop running locally from the primary scheduler server (avoiding the Caddy on_demand_tls loopback) while continuing to run from external regional agents.
Improvement
  • Cache cleanup
    Added periodic cleanup for allowCache and caddyAskCache to prevent unbounded growth.
  • Daily regional aggregation queries
    Added a covering index to speed up daily regional aggregation lookups.
  • Caddy CPU/load tuning
    Consolidated the duplicated active health-checkers that nearly every site block was independently running against the same backend ports (18080-18085) into shared (backend-health-apex)/(backend-health-subdomain) snippets, removed the redundant @embed reverse_proxy blocks on the wildcard domains (CORS headers now attach via the shared fallback proxy), raised health_interval from 2s/5s to 10s/15s, and added minimum_length 1024 to all encode blocks to skip compressing tiny responses. Also recommend bumping the Caddy binary from v2.11.2 → v2.11.3 for its security patches (admin-socket auth-bypass hardening).
  • Self-targeting monitor backlog drain
    Load remained elevated after the above tuning because pre-existing self-targeting monitors (see "Self-targeting monitor checks" above) keep triggering Caddy's on_demand_tls "ask" flow on every check, and the new auto-pause scheduler only catches them gradually (3h continuously down, checked every 30 minutes). Added scheduler.RunSelfTargetingMonitorPauseSweepNow plus a one-off bin/scripts/pause_self_targeting_monitors_now.go to immediately pause the entire backlog in one pass instead of waiting on the drip-feed.
New
  • Self-targeting monitor checks
    Added checks and auto-pause handling to prevent monitors from wasting resources by targeting the status page itself.

Fixed
  • Suggestion events table formatting
    Updated the date formatting function to use time formatting in the suggestion events table.
Improvement
  • Suggestion events analytics
    Admin analytics now shows the total suggestion events count.
New
  • Status page settings loading
    Status page settings now load in parallel with caching optimizations for faster rendering.

Fixed
  • Pending downtime component join
    Corrected the component ID join condition in the pending downtime scan handler.
New
  • False downtime scan and fix tool
    Added a tool to scan for false downtime and fix the affected monitors.

New
  • status.io dependency provider support
    Added support for status.io in dependency providers, including a detection helper.

New
  • B2B invoice details on profile
    Users can now opt in to business billing via an "I'm purchasing as a business" toggle on the profile page. When enabled, company name, full billing address, and Tax ID / VAT number are all required and stored. These details are passed to Dodo Payments at checkout so they appear on invoices.
  • Dependency providers cache
    Dependency providers now use a cache with admin-driven updates and public display.
Updated
  • Dodo Payments SDK v1.102.0
    Upgraded the Dodo Payments Go SDK from v1.98.0 to v1.102.0.
  • Go dependencies
    Upgraded Go dependencies and added a new alias for explicit usage.

Fixed
  • Monitor runner panic logging
    spawnMonitorRunner now logs the full stack trace on panic instead of silently swallowing it.
  • Landing footer background
    Corrected CSS class name for the landing page footer background.
Improvement
  • Admin user profile
    Monitors and status pages are now displayed in an improved layout on the admin user profile page; incident count added to the user details section.
  • Pricing compare table
    Sticky headers with dynamic offset adjustment added to the compare table on the pricing page.
New
  • SLA credits detail modal
    Admin user profile now has a per-user SLA credits breakdown modal showing credit history and amounts.
  • Live Dodo wallet balance
    The user billing page now displays the live Dodo Payments wallet balance alongside the SLA account credit section.
  • Vultr and Contabo providers
    Added Vultr and Contabo to the infrastructure dependencies section on the feature page.
  • /archive redirect
    /archive now redirects to /incidents-archive for improved URL clarity and SEO consistency.

Improvement
  • Billing metrics & revenue calculations
    Enhanced caching and correctness for MRR/revenue figures; added separate calculations for monthly and annual subscriptions.
  • Plausible analytics bootstrap
    Added the Plausible snippet for internal analytics tracking, with corresponding tests.
Miscellaneous
  • URL join refactor
    Internal URL joining logic consolidated for consistency across the application.
  • Legal page restyling
    Privacy policy, refund policy, security, subprocessors, support, and terms & conditions pages updated with improved layout and styling.

Fixed
  • Team invite new-user notification
    Admins now receive the expected email and Telegram notification when a new user joins by accepting a team invitation.
  • OAuth user email deliverability status
    Google and GitHub OAuth users now have their email_deliverability_status set to validated immediately on signup/login, matching the behaviour of the email activation link flow. Existing OAuth users are backfilled via migration 0446.
  • **/open checks-performed count**
    The uptime checks count on the /open stats page now uses MAX(id) (a fast index-only approximation) instead of a full-table COUNT(*), consistent with the social proof section.
Improvement
  • Password reveal toggle on profile page
    The password fields on the user profile page now include an eye icon to reveal or hide the value, matching the login and register pages.

Fixed
  • Monitor restrictions on simple status pages
    Enforced monitor type restrictions for simple status page plans and corrected free-tier plan limits (migration 0445).
  • URL encoding in documentation links
    Fixed malformed documentation links across public marketing pages and user dashboard templates.
Improvement
  • Author attribution on articles
    Blog and university articles now support author and email front-matter fields, displayed on the article page and used in structured data.
  • JSON-LD structured data for blog articles
    Blog article pages now include JSON-LD markup with modifiedTime and full canonical URL for improved SEO and search result presentation.

Fixed
  • Pending monitor results excluded from metrics
    Availability cache and monitor metrics calculations no longer count results with pending status, preventing skewed uptime figures.
  • Monitor result count accuracy
    Social proof stats query now uses COALESCE to handle null values correctly when counting monitor results.
Improvement
  • Status page creation live preview and slug validation
    The new status page wizard now shows a live preview of the page as you configure it, with real-time slug availability validation.
  • SLA and regional incident support in monitor management
    Monitor create/edit flows now properly surface SLA settings and regional incident options, with a refactored SLA-eligible plans helper.

Improvement
  • Support page accessibility/layout updates
    Refined the user support page structure to improve readability and accessibility.
  • Monitoring and billing docs expansion
    Expanded monitoring guidance (timeouts, error budgets, health score, causal chain) and refreshed related docs/localizations for the new alerting and reminder features.
New
  • Region quota enforcement for monitors
    Monitor create/edit flows now enforce plan region limits during validation and form handling to prevent over-allocation.
  • SLA breach and health alerting framework
    Added core SLA/health alerting mechanisms, including scheduler support, notifier integration, evaluator/model updates, and supporting database migrations for thresholds, tracking, and persistence.
  • Monitor down reminders
    Added reminder support for prolonged monitor-down states, including data model updates, scheduler/notifier integration, user-facing notification settings, and migration 0435.
  • Payment methods documentation
    Added new account payment methods documentation and surfaced related billing/help updates in user-facing pages.

Improvement
  • Blog article presentation refreshed
    Blog article templates were refactored to improve information hierarchy, cover image handling, and overall layout consistency.
  • Public marketing page consistency pass
    CTA sections, selected titles/SEO metadata, and status-page messaging were aligned across multiple public templates for a more consistent conversion flow.
New
  • Admin notification tests panel
    Added an admin-facing notification test workflow for running delivery scenarios directly from the dashboard, including new routes, handlers, and UI entry points for easier notifier verification.
  • OpsGenie migration guide published
    Added a dedicated OpsGenie migration guide article and refreshed related plan-detail/public footer links to improve migration discoverability.

Fixed
  • WordPress plugin defaults and packaging corrected
    The WordPress widget now uses 0 as the default for response time and uptime settings where appropriate, classic widget defaults align with saved settings, uninstall cleanup removes default options correctly, the frontend stylesheet path is fixed, and the packaged release was refreshed for version 1.0.3.
  • Azure redirect URI instructions corrected
    The Azure app registration guidance in status page settings now renders the redirect URI in the expected format.
Improvement
  • Marketing and feature pages refreshed
    Multiple public pages, FAQs, integrations pages, and product screenshots were updated to better reflect the current product surface, including status page settings, private pages, branding, custom domains, SSL monitoring, uptime monitoring, and the WordPress plugin.
  • WordPress embed requirements clarified
    The WordPress plugin page and related documentation now better explain advanced embed requirements and the current widget setup.

Fixed
  • Cross-browser logout consistency improved
    Authentication flows now use 24-hour persistent cookies where needed so logout and related session transitions behave more consistently across browsers.
Improvement
  • Simple status page component management upgraded
    Component updates now have stronger validation, override tracking, and clearer UI feedback in both settings and component cards, making manual status updates easier to manage on large simple status pages.
  • Public comparison navigation expanded
    Alternative landing pages and the public footer now surface additional comparison paths for Instatus, Atlassian Statuspage, and Status.io.
New
  • Smart Suggestions for user dashboards
    Added a new suggestions system that evaluates account activity, shows actionable recommendations inside the user dashboard, supports enable and dismiss flows, sends scheduled email nudges for relevant cases, and includes an admin analytics view for recent events and performance. This is backed by migration 0434.
  • Status.io alternative page launched
    Added a dedicated Status.io alternative landing page and expanded competitor comparison coverage across the public site.

Improvement
  • Large status page feature content refreshed
    The simple status page marketing surface now points users to the new large-page guidance and related layout capabilities.
  • Language completeness and locale bundles refreshed
    Generated language completeness data and locale JSON files were updated to cover the latest product and content changes.
New
  • Best practices guide for large status pages
    Published a new guide covering how to structure large status pages with clearer groups, collapsed healthy sections, affected-system summaries, and better incident communication for high-component pages.
  • Active subscriber count in stats responses
    Stats handling now retrieves active Dodo subscribers so internal dashboards and related consumers can display current subscriber totals alongside the existing metrics.

Fixed
  • Scheduler leader lock lifecycle hardened
    The scheduler now keeps the PostgreSQL advisory leader lock for the full scheduler context lifetime and releases it on shutdown, preventing premature unlock after startup and reducing duplicate scheduler execution risk in multi-instance deployments.
  • Scheduled monitor config hydration parity
    Scheduler monitor loading now includes full API and database monitor fields (HTTP method, auth, request body, DB connection/query fields, DNS structured config, and regional settings), so scheduled checks use the same runtime config surface as monitor definitions.
  • Maintenance-safe monitor resume behavior
    Maintenance pause/resume logic now tags monitors paused by maintenance and only resumes those monitors when maintenance ends, preventing accidental re-enable of monitors that were manually disabled or disabled for other reasons.
  • Failure tracking recovery no longer flips monitor enablement
    Recovery cleanup resets failure-tracking fields without implicitly setting enabled = true, avoiding unintended re-enable side effects on disabled monitors.
  • Dark palette CSS injected into wrong template
    The [data-bs-theme="dark"] CSS variable overrides were added to head.gohtml, which is never included by the status page templates. The fix applies the dark palette CSS directly inside default_sp.gohtml and large_simple_sp.gohtml where the brand color <style> block actually lives.
  • Palette save silently broke after adding dark color columns
    Before migration 0432 was applied, the updated UPDATE query failed with "column does not exist", triggering a minimal legacy fallback that saved neither light nor dark colors. A tiered fallback now retries without dark columns when migration is pending, preserving the light palette save path.
  • Brand Color Palette card did not auto-expand when already enabled on page load
    The collapse trigger only fired on toggle click, not on initial render. The initPaletteControlsState IIFE now also expands the card body when the palette is already enabled.
  • Live Preview showed stale hardcoded defaults on page load
    updatePalettePreview() was not called on initialization, so the preview badges and background always showed the hardcoded default colors instead of the saved palette values until the user changed a picker.
Improvement
  • Brand Color Palette UX overhaul
    The palette settings panel received a full UX pass: Live Preview now has a ☀ Light / 🌙 Dark toggle so you can verify colors in both modes before saving; real-time WCAG AA contrast ratio is shown below the preview; an "Unsaved changes" badge appears when colors have been edited but not saved, with a browser unload guard; hex inputs auto-correct missing # and expand 3-character shorthand on blur; extracted color swatches now open a role-assignment mini-menu ("Apply as Primary / Secondary / Accent / Background / Text") instead of just copying to clipboard; the Enable toggle auto-expands the palette card on page load and when first enabled; "Remove Palette" is separated visually from "Save" with ms-auto; each color role label has a tooltip describing which page elements it controls.
  • Status page settings always reflect latest palette on cache hit
    The Redis page cache now refreshes StatusPage.Settings from the live database on every request, even when the cached page data is served. This means palette, CSS, and theme changes take effect immediately without requiring a full cache flush.
New
  • Dark Mode Color Palette
    Status pages now support a separate set of brand colors for dark theme visitors. Five independent color roles (Primary, Secondary, Accent, Background, Text) can be configured for dark mode and are automatically applied via [data-bs-theme="dark"] CSS overrides when a visitor's system or manual preference is dark. The database stores them in five new brand_dark_*_color columns (migration 0432).

Fixed
  • Navbar search returned no results
    The search bar was loading a static search-user.json file instead of calling the live API. The frontend now calls /user/api/search dynamically.
  • Team member search was broken
    The members query used a non-existent owner_id column; corrected to owner_user_id.
  • Status page search missed team-shared pages
    Pages accessible via team membership were excluded from search results; the query now includes them.
Improvement
  • Search results are cached
    Search responses are cached server-side per user and query for 30 seconds, and debounced client-side at 180 ms with a per-session cache, keeping database load minimal regardless of typing speed.
New
  • Navbar search now covers all content
    The Ctrl+/ search now queries live user data across Status Pages, Components, Monitors, Heartbeats, Incidents, Teams, and Members. Previously it returned no results because it was reading from a static placeholder file.

Fixed
  • Onboarding checklist out of sync after wizard
    Creating a status page through the wizard now also marks the customize_branding step complete, keeping the wizard and dashboard checklist in sync.
  • Password toggle double-fires on login/register
    Replaced Frest's built-in password visibility toggle (which used Boxicons and bubbled click events incorrectly) with a Bootstrap Icons-compatible implementation that listens on the correct element.
  • Onboarding wizard logo upload stored invalid JSON
    extracted_palette was being reset to an empty string instead of a valid empty JSON array ([]), which could cause parse errors downstream.
Improvement
  • SSRF-safe outbound HTTP hardening
    Introduced SSRF-safe HTTP client protections and routing-level adoption to reduce unsafe outbound request risk.
  • Authentication middleware hardening
    Improved JWT middleware and OIDC authentication handling for stricter security behavior in auth flows.
  • Core security refinements
    Updated CSRF internals and related server wiring to tighten request-security handling.
Updated
  • Branding and translation support updates
    Refined branding palette and translation applier internals for consistent metadata and localization behavior.
  • Footer support link points to internal page
    The dashboard footer's support link now navigates to /user/support instead of an external URL.
  • Onboarding completion page heading
    Changed from an <h1> to a properly sized <h2> for correct document hierarchy.

Improvement
  • Dashboard and model cache integration
    Updated dashboard trends and related monitor/status-page model interactions to support return-summary cache reads and writes.
  • Public link coverage for legal page
    Updated public footer and related public pages to include links to the new DPA page.
New
  • Dashboard return summary cache
    Added caching for dashboard return summaries, including a dedicated database migration and integration in user dashboard data flows.
  • Public DPA page
    Added a Data Processing Agreement (DPA) page and registered it in public routing and sitemap generation.

Improvement
  • Incident state in monitors list
    The monitors list now reflects active incident state in monitor badges and status display, giving a more accurate at-a-glance view when an incident is open against a monitor.

Improvement
  • On-call metrics and schedules UI refresh
    The on-call metrics and schedules pages have been updated with improved visual styles and iconography for clearer at-a-glance readability.
  • Accessibility improvements in dashboard templates
    Alert and notification elements across the dashboard now include proper ARIA roles for screen readers, and progress bars carry accessibility labels.

Improvement
  • Testimonials section redesign
    The public site testimonials section has been rebuilt with a new card grid layout, featured/regular testimonial separation, card hover effects, and dark mode support.

Improvement
  • Scheduler and monitor model updates for DNS validation
    Scheduler and monitor internals were refactored to support the new expected-DNS configuration workflow, with regression coverage for DNS configuration handling.
  • Per-monitor region support docs
    Added a new monitoring-per-monitor-regions help article and cross-linked it from monitoring location docs, monitor setup UI, and the Milan region announcement.
  • Status page snapshot and What's New docs
    Added new Help Center articles for status page settings snapshots and dashboard What's New announcements, then cross-linked them from nearby status page, downgrade, and dashboard guides.
  • Billing guide refresh
    Rewrote the account-billing-plans Help Center article to match the current billing page, including usage snapshot, subscription overview, payment-method updates, receipts, refund requests, and cancellation behavior.
  • Notification guide refresh
    Expanded the personal alerts and on-call scheduling Help Center articles to cover the current notification matrix, alarm controls, browser-notification behavior, escalation preview, and alert-log workflow.
  • Maintenance form timezone handling
    The scheduled maintenance form now uses the browser's local timezone when parsing dates and times, so the times you enter reflect your local clock.
  • Contextual help popovers in dashboard forms
    Key forms (monitor setup, notification channels, on-call schedule, status page settings) now include in-page help popovers for guidance without leaving the current page.
New
  • DNS expected configuration for monitors
    Monitors can now store expected DNS record configuration for stricter validation and future DNS-focused checks.

Improvement
  • Monitor setup and editing UX refresh
    The add-monitor and edit-monitor flows, onboarding, and wizard interactions were updated for a smoother monitor configuration experience.
  • Request ID traceability
    Request ID middleware now improves correlation across logs and request handling paths for operational debugging.
New
  • Registration observability plumbing
    The server now captures registration failure and client-side error signals to improve debugging of signup issues.
  • Detailed monitor result panel
    User monitor flows now include a dedicated result panel component for clearer validation and troubleshooting feedback.

Fixed
  • Large-layout private access translations
    The large status page private access card now resolves password and sign-in labels through the status-page translation tree instead of exposing missing i18n key names in the UI.
Improvement
  • Incident-aware monitor status display
    Live monitor status and badge rendering now incorporate incident-state context so user and public status views reflect ongoing incidents more accurately.
  • Markdown rendering normalization
    Markdown processing now normalizes CRLF and blank-line handling, preserves table rendering more reliably, and disables Smartypants substitutions that were mutating punctuation in status updates.
  • Signal backfill idempotency
    Signal backfill routines are now safe to rerun without duplicating work, with regression coverage for idempotent behavior.
  • Status page layout controls
    User settings now expose a layout-mode selector for simple status pages, and public routing resolves the large layout automatically when selected.
New
  • Large layout mode for simple status pages
    Simple/manual status pages can now use a large accordion-based layout optimized for pages with many component groups, including collapsible sections and an "Affected Systems" summary.

Improvement
  • Severity selection consistency for incidents
    Incident severity selectors now expose the full component severity set so incident classification stays aligned with component health states.
  • Payment method action visibility
    Billing UI now only shows the update-payment-method action for subscription states where that action is actually usable.
  • Component visibility transitions
    Component visibility controls now support a fade-hide effect for smoother public status page interactions.
  • Uptime streak and Jira assessment work
    Added uptime streak day logic and expanded Jira integration assessment documentation.
New
  • Markdown-rendered incident details and tables
    Incident and status-event detail bodies now render markdown more fully, including table support, so structured incident updates display cleanly on status pages.
  • Incident task assignment notifications
    Assigning incident tasks now triggers dedicated notifications with improved email links for responders.
  • TLS fallback snippets with ZeroSSL ACME support
    Reusable TLS fallback snippets now include ZeroSSL ACME/EAB configuration, timeout controls, and simpler issuer setup for hardened fallback deployments.

Fixed
  • Disabled monitors on status pages
    Status page monitor selection and related template display logic now consistently treat disabled monitors as hidden, preventing them from appearing in public status views.
  • On-call override creation and duplication
    Override creation forms now validate that neither the start nor end time can be in the past, and drag/resize operations on the on-call calendar are subject to the same checks.
Improvement
  • On-call schedule management improvements
    On-call rotation schedules now include better iCal feed formatting, shift-end time display in "Take On-Call" confirmations, and improved validation when creating or editing override windows.
  • Escalation countdown display for incident details
    Incident detail view now correctly hides the escalation countdown when an incident has been closed or acknowledged.
  • Historical uptime data accuracy
    Historical uptime charts and tables now correctly display all metrics including average response time, handle plans with unlimited data retention, and show the retention badge for team-shared status pages.
  • Localized empty-state messaging
    Added the new no-components status page copy across the supported translation files and regenerated the frontend locale bundles so the empty state is translated consistently.
  • **i18n-ensure always rebuilds runtime locales**
    The i18n workflow now always merges source translations into runtime locale files before verification, ensuring value-only translation updates are reflected in the frontend bundles.
New
  • Empty state for status pages without components
    Public status pages that do not yet have any components, monitors, heartbeats, or component groups now show a dedicated empty state instead of an empty components section.

Fixed
  • Centralized login error handling
    Login flows now use a shared context helper for auth errors, reducing duplicated handling logic and making failure messaging more consistent.
Improvement
  • User incidents statistics and filtering
    Expanded the user incidents page with better summary statistics and more flexible filtering options for browsing incident history.
  • Domain normalization for tools and SSL checks
    Improved domain input normalization so tools and SSL validation flows behave more consistently when users enter partially formatted or messy hostnames.
New
  • Status page display controls and logo uploads
    User status page settings now include additional display options together with logo upload widgets, giving users more control over how their public status pages appear.

Fixed
  • **notification_channels.change_type translation mapping**
    Corrected the notification channel editor label key so the change-type control resolves the intended localized string.
Improvement
  • Maintenance-aware status page metrics
    Status pages now track and display maintenance percentages more explicitly, and incident popovers better distinguish maintenance states and related historical context.
New
  • Active maintenance status endpoint and navbar indicator
    Added an API endpoint and dashboard navigation integration for active maintenance, making it easier to surface in-progress maintenance without opening the incidents view.
  • Notification channel management localization
    Added translated copy for notification channel management flows and localized maintenance state labels such as upcoming and in-progress across supported languages.
Updated
  • Notification channel icons
    The SMS notification channel picker now uses a dedicated SVG icon instead of a generic chat glyph, making the notification channel grid more visually consistent with the other integrations.
  • Brand SVG assets refresh
    Replaced the favicon source artwork and updated the bundled Dodo, PagerDuty, and PostgreSQL SVG assets with higher-fidelity brand artwork.

Fixed
  • Simple status page: stale override message
    Clearing a manual component override now also clears the override message. Previously the italic message text persisted on the public status page even after the override was removed.
  • Simple status page: 90-day strip tooltip labels
    Days marked as "Partial Outage" or "Major Outage" in the 90-day history strip now show the correct label in tooltips and aria-labels. Previously they fell through to "Unknown" due to a hyphen/underscore mismatch between the template and backend.
  • Simple status page: misclassification when uptime display is off
    A monitor-backed status page with the "Show Component Uptime" setting disabled and at least one unmonitored component is no longer misclassified as a simple/manual page, which could cause the wrong card template to render.
  • Private status page auth tokens
    In-memory session tokens for private status pages are now pruned every 10 minutes, preventing unbounded memory growth on high-traffic private pages.
  • Nudge email buttons were broken
    CTA buttons in recommendation emails linked to relative paths, which email clients cannot resolve. Buttons now link to full URLs.
  • Custom domain nudge showed a nonsensical example domain
    The email copy constructed the example domain from the recipient's own email address, producing results like status.gmail.com. Replaced with a clear, generic example and updated copy that explains subdomain, apex domain, and personal domain options.
  • Admin Signals filtering edge cases
    Fixed Select2/DataTables integration issues in the Admin Signals dashboard and corrected JSON formatting in the bulk signal users script so filtering and client-side actions behave consistently.
Improvement
  • Simple status page: manual override history takes priority
    In the 90-day component status strip, explicit operator overrides now take priority over historical incidents and maintenances. Previously an incident on a given day would always override whatever the operator had manually set for that day, making the history inaccurate.
  • Status page settings and analytics performance
    User status page settings now batch-load related configuration and are backed by new performance indexes for common query patterns, reducing unnecessary repeated database work.
  • Analytics UI asset loading
    Added dedicated analytics CSS styling and only loads it from the base user template when needed, while also removing unused responsive DataTables assets from the dashboard.
New
  • 5 new in-app recommendations
    The recommendation engine now covers five additional product areas that free and trial users commonly miss:
  • Organize monitors
    suggests assigning monitors to status page components when several are left unorganised.
  • Set up on-call
    prompts users with team members to configure an on-call rotation.
  • Schedule maintenance
    reminds users with subscribers to use maintenance windows before planned downtime, so subscribers are notified in advance rather than seeing a surprise outage.
  • Create an incident template
    suggested after two or more incidents have been filed without any saved templates.
  • Heartbeat monitors
    introduces cron job and background task monitoring to users who only have HTTP monitors.
  • Per-user Brevo delivery overrides
    Added admin controls and delivery settings support for Brevo overrides on a per-user basis, making it easier to route email sending through account-specific delivery configurations.
  • Monitor alert sensitivity setting
    Users can now tune monitor alert sensitivity directly in monitor settings for finer control over outage detection behavior.
  • Admin Signals hide-users filter
    Added a dedicated hide-users filter and improved hidden-row handling in the Admin Signals table.
  • Demo alarm override controls
    Added demo alarm override support and related notification handling improvements for internal/admin workflows.

Fixed
  • Conversion nudge emails not sending
    A combination of issues caused conversion recommendation emails to never dispatch. Signup events were not recorded correctly, causing user activity timestamps to be wrong and making many eligible users invisible to the scheduler. An anti-spam dedup guard was checking the wrong table and effectively disabled. All three issues are now resolved.
Improvement
  • At most one recommendation email per user per scheduler pass
    Users with multiple active recommendations now receive a single email per pass, prioritised by relevance. A 72-hour cooldown prevents follow-up emails until the first one has had time to be acted on.
  • Nudge emails respect quiet periods
    Lifecycle nudge emails now enforce a 3-hour gap between sends. If multiple nudge types qualify at the same time, the highest-priority one is sent and the rest are retried on the next tick.
  • Undeliverable addresses excluded from all nudge pipelines
    Users marked as undeliverable are no longer evaluated as nudge candidates, alongside the existing closed, suspended, and suppressed account guards.
New
  • Monitor check history
    Each monitor now has a dedicated Check History page with a full, paginated log of every check result. Results can be filtered by outcome (up / down / degraded) and each down event can be expanded to see which regions detected the problem, in what order, and how long it took to reach quorum. Accessible from the monitor list and the individual monitor page.
  • Migration 0411: corrected signup timestamps
    Backfills missing activation state rows and corrects signup timestamps that were set to the first action date rather than actual account creation time.
Removed
  • Email open tracking pixel
    Removed the 1×1 tracking pixel from re-engagement emails. Click and action tracking are unaffected.

Improvement
  • Regional aggregation scheduler cleanup
    Simplified regional aggregation logic in the scheduler by removing an unused existence check and tightening the aggregation path for region-based monitor processing.
  • Status page logo preview fix
    Removed the no-referrer preload gate in the settings UI logo preview so remote SVGs (e.g. Next.js static assets) now render correctly, matching live status page behavior.

Fixed
  • Latest monitor status selection
    Latest-status lookup now ignores pending rows and handles empty result sets safely instead of treating pending data as the current state.
New
  • Status event detail disclosures and archive previews
    Public status pages now expose richer status event details and archive preview pages for incidents and maintenance history.
  • Region-aware monitor creation
    Monitor creation now supports multiple monitor region IDs and a primary region ID for more explicit regional configuration.
Updated
  • Immediate non-pending monitor feedback after setup
    The add-monitor flow now fetches the latest non-pending result after creation and shows users clearer initial feedback while checks complete.
  • Status event markdown rendering
    Status event bodies now preserve single line breaks more cleanly in public status page output.

New
  • User signal recalculation controls
    Added a recalculate-user endpoint and admin dashboard integration so signal-related data can be recomputed from the UI when needed.
Updated
  • Monitor toggle confirmation flow
    Monitor enable/disable actions now use stronger critical-action handling, including clearer visibility prompts during toggle flows.
  • Status page cache invalidation on monitor changes
    Monitor updates now trigger status page cache invalidation so public pages reflect visibility and state changes more reliably.
  • Conversion nudges and trust indicators
    Refined conversion nudge behavior and introduced a reusable trust badge strip across selected marketing pages.

Miscellaneous
  • Blog planning and content strategy notes for May were updated to reflect the new incident-communication article and related editorial work.
New
  • CrowdStrike outage communication lessons article
    Published a new blog article covering incident communication lessons from the CrowdStrike outage, including supporting cover and inline imagery for distribution.
Updated
  • Monitoring accuracy and down-prediction documentation refresh
    Expanded internal documentation and comparison content around monitoring accuracy, failure detection, and down-prediction guidance.
  • Atlassian comparison article refresh
    Updated the Atlassian Statuspage comparison article with the latest positioning and supporting assets.

Improvement
  • Breadcrumb navigation on the Atlassian and UptimeRobot alternative comparison pages updated for improved semantic structure and accessibility.
  • Card body spacing on alternative status page comparison templates improved for a more balanced visual layout.
New
  • Feature pages for Free and Hosted Status Page plans
    Added dedicated public feature pages for the Free and Hosted Status Page offerings, making plan capabilities easier to discover and link to from marketing and support content.
  • Onboarding initial monitor checks
    The onboarding flow now immediately checks newly created monitors and logs signal events, so users can see their first monitor status without waiting for the next scheduled polling cycle.
  • Conversion nudges and user recommendations
    Added scheduler-backed user recommendation generation, new admin analytics and nudge screens, and dashboard surfacing for recommendation-driven conversion prompts.
Updated
  • Plan renaming: Pro → Starter, Growth → Team
    Plans previously named "Pro" and "Growth" are now called "Starter" and "Team" respectively. The rename is applied consistently across all templates, documentation, the feature list, and plan entitlement checks.

Fixed
  • Brevo SMTP settings form refactored to use a single <form> element, fixing a submission issue that could silently prevent settings from being saved.
Improvement
  • Onboarding now surfaces actionable error notifications when setup steps fail, and guides users through a clearer progression flow when issues occur during initial configuration.
  • Signal events for key user actions are now inserted asynchronously, removing the overhead from the critical request path.
New
  • IMAP bounce worker for Microsoft NDR handling
    Added a background worker that processes Microsoft-specific Non-Delivery Reports (NDRs) and complaints via IMAP, reducing hard-bounce accumulation for Microsoft consumer domain recipients.
  • Brevo SMTP relay for Microsoft consumer domains
    Email delivery to Microsoft consumer domains (Hotmail, Live, Outlook.com) is now routed through Brevo SMTP relay to improve inbox placement and reduce rejection rates.

Improvement
  • What's New announcements
    Announcement history now loads faster thanks to indexed lookups, and the dashboard panel has been refactored to render announcements with conditional visibility and a modal detail view.
  • User growth analytics (DAU/WAU) now layer live data on top of cached values to ensure accuracy when activity occurs between cache refreshes.
  • Payment frequency interval handling now normalises incoming values by trimming whitespace and lowercasing before comparison, preventing billing mismatches caused by inconsistent interval strings.
New
  • MRR snapshot tracking
    The admin analytics dashboard now records daily MRR snapshots. A 7-day rolling window corrects any previously inaccurate data points, and the trend chart plots MRR movement over time.

Improvement
  • LLM context via llms.txt
    Added an llms.txt file and paginated announcement retrieval to improve structured LLM-accessible context for the platform.
  • Layout and styling improvements across user component and status page views for better visual consistency.
New
  • Status page theme presets
    Status pages now support selectable theme presets, letting users quickly apply a consistent visual style to their public status page without manual CSS overrides.
  • Full-page embedding for status pages
    Status pages can now be embedded in full-page mode, providing a flexible integration option beyond the existing widget embed.
  • Per-region monitor history on status pages
    Multi-region monitors now display per-region daily uptime history on the status page, giving visitors granular visibility into regional availability over time.
  • OSS showcase on status page landing
    The status page landing route now includes an open-source project showcase section highlighting community projects built on the platform.
Updated
  • SSL monitoring documentation
    SSL monitoring support docs updated with health check examples and new screenshots.
  • New brand logo assets added and notification channel list styles refreshed in the user dashboard.

Fixed
  • Webhook header names are now validated for length and safe characters before being persisted, preventing malformed header values from reaching outbound webhook requests.
Improvement
  • Incident state ordering
    Incident states now carry an explicit sort order so timeline entries and state selectors appear in a consistent, configurable sequence across the incident create, edit, and timeline views.
  • Notification dispatch is now concurrent across channels with per-channel retry logic, so a slow or failing channel no longer delays other channels or drops delivery silently.
New
  • Dashboard return summary - Users who return to the dashboard after an extended absence now see a personalized summary card highlighting what changed while they were away
    including monitor status shifts, new incidents, and maintenance events — with a single dismiss action.
  • Idle re-engagement emails
    Added an automated re-engagement email workflow that detects idle users and sends styled summary emails with usage highlights and direct links back to the dashboard. Emails use the Hermes HTML template engine with open and click tracking.

Fixed
  • Fixed notification channel plan gating in the user dashboard so the Add Notification Channel modal now follows the same per-plan availability matrix shown on pricing pages instead of mixing feature gates, paid-plan checks, and hardcoded upgrade copy.
  • Fixed Starter and Team plan alias handling for notification entitlements, so marketing-style plan keys resolve to the correct internal plans before channel availability is evaluated.
  • Fixed the step number shown in the DNS record addition wizard so the step counter is accurate.
  • Fixed the Clear Monitor History action so it correctly targets the selected monitor when deleting history records.
Improvement
  • Notification channels now visible in monitor settings
    The Edit Monitor page now shows all notification channels attached to the monitor's status page, including their type, name, and per-plan availability, with a direct link to manage channels from within the monitor settings view.
  • Notification channel locking and channel-creation validation now share the same entitlement source of truth, reducing UI/API drift for Slack, Discord, Telegram, Webhooks, Microsoft Teams, PagerDuty, SMS, and related integrations.

Improvement
  • Stale resolved demo incidents can now be cleaned automatically each day at 00:00 UTC, so old demo history does not linger on public status pages or dashboards.
  • Admins now have a manual cleanup action in Admin -> Tools to backfill older resolved demo incidents that predate the automatic delete-at-completion flow.
Updated
  • Added support documentation for the demo incident lifecycle, including Try Demo, Clear Demos, automatic cleanup behavior, and how demo incidents differ from archived real incidents.

Fixed
  • Dodo receipt downloads now handle 100% coupon / zero-amount transactions more reliably by supporting HTML fallback receipts in the billing UI instead of assuming all non-PDF responses are JSON.
  • Billing-history pagination receipt actions now use invoice_reference with payment_id fallback and include processed status, matching server-rendered table behavior.
  • Added JS regression tests for receipt response classification (pdf, html, json, and error paths) plus a test:js npm script to keep this flow covered.
  • Admin password resets from /admin/list/admins now hash generated passwords with the same Argon2 flow used by admin login verification, so shown reset passwords can be used successfully.
  • Demo incidents no longer leak into public incident views or public status-page incident lists unless the request is explicitly in demo mode via the ?demo flow.
  • Public status pages now keep serving the last good shell during demo-cleanup refreshes and fall back to a temporary status page is updating 503 view for transient lookup or rebuild failures instead of surfacing a misleading 404.
Improvement
  • Billing and plan-limit handling was expanded for newer billing fields so defaults and inserts stay consistent across subscription states.
  • Pricing and trial subscription presentation was refined, including purchase-button loading behavior, to make checkout actions clearer during async operations.
  • Added a small reusable receipt-response classifier in frontend JS to centralize receipt-download response handling and reduce logic duplication.
  • Signal now tracks plans_dialog_opened from /user/billing when the pricing modal is shown, scoring it conservatively and deduplicating it weekly so the admin dashboard can surface plan-consideration intent without inflating scores.
  • Demo incidents triggered from the monitors dashboard now progress automatically and auto-resolve after a short delay, and users can clear all active demo incidents at once from /user/monitors.
  • Clearing demo incidents from /user/monitors now shows a live progress overlay, including exact X of N cleanup progress and status-page refresh phases, so the dashboard no longer looks idle during long-running demo cleanup.

Fixed
  • Added focused Telegram notification tests for spam-registration alerts to validate formatting and sanitization behavior and prevent malformed alert payloads.
Improvement
  • Spam-registration Telegram notifications were refactored to keep message construction and delivery flow cleaner and easier to maintain.

Fixed
  • Blog category URLs without a trailing slash (e.g. /blog/monitoring, /blog/changelog) now 301-redirect to their canonical trailing-slash form instead of serving the page with a non-self canonical, which Ahrefs was flagging as "indexable page became non-indexable".
  • Blog category pages with ≤1 published article are no longer included in blog-sitemap.xml; they were already marked noindex by the handler, creating a sitemap/noindex contradiction that wastes crawl budget.
  • Removed nofollow from the <meta name="robots"> tag emitted by noindex public pages
    previously all outgoing links on those pages were treated as nofollow by crawlers, causing every main-site page to show a mix of dofollow and nofollow inlinks in Ahrefs.
Improvement
  • Page titles across marketing, feature, and alternative comparison pages shortened to stay within the 50–60 character SEO guideline; blog, docs, and university article titles now omit the redundant section label (e.g. "- Blog") since the brand suffix already provides context.
  • Homepage title no longer appends "| Hosted Status Page" (the brand is already in the title text itself), keeping it comfortably under 60 characters.
  • noindex pages on the public site (thin blog category pages, dev.to verification) now emit noindex, follow instead of noindex, nofollow, so the shared navbar links on those pages continue to pass link equity to the rest of the site.
  • Dashboard sidebar mode middleware was refactored and covered with focused tests to keep sidebar-state behavior stable across requests and reduce UI regressions.
  • Maintenance form UX was improved with clearer structure, better character-count guidance, and safer confirmation messaging around subscriber notifications.

Fixed
  • Direct signups can no longer bypass onboarding through legacy skip actions or the old onboarding=1 suppression path; they must complete setup before leaving the onboarding flow.
  • Invited shared-team users still avoid the forced onboarding redirect, and the wizard and checklist UI now only show skip actions when that invite-based exception applies.
  • Added focused regression coverage for the first-login onboarding redirect rules so direct signups and invited shared-team users follow the intended path consistently.
Improvement
  • Onboarding skip eligibility now uses accepted shared-team invitation membership as the durable source of truth instead of client-controlled query or session bypasses.
  • Blog listing pages now paginate at 6 posts per page on /blog, category pages, and tag pages, with centered theme pagination and compact ... page ranges.

Fixed
  • **.local email safety guard**
    Outbound email now skips any recipient ending in .local, including scheduler-triggered alerts and queued retries, so local-only test addresses are never sent through SMTP.
  • Queued email suppression consistency
    Pending and held email now respect admin-wide suppression and .local filtering before retries are attempted.
  • Status pages now refresh their shell cache immediately after daily and startup aggregation runs, reducing cases where newly aggregated per-region uptime data would not appear until a later shell-refresh job.
  • SSL monitor details now accept both legacy expires_at and issued_at fields and the newer not_after and not_before fields, preventing missing certificate dates after the SSL check-flow upgrade.
Improvement
  • What's New in the user navbar
    Added a direct “What's New” entry to the user navbar menu so release updates are easier to find from anywhere in the dashboard.
  • Embedded status pages can now restrict which websites are allowed to frame them through optional Allowed frame origins settings, with matching frame-ancestors CSP handling in embed mode.
  • Incident and maintenance archive pages now inherit the selected status page theme and embed-mode styling for a more consistent public and embedded experience.
  • Reduced redundant status-page incident popover rerenders, which improves hover stability and reduces flicker on dense history views.
  • SSL certificates are now rechecked every 6 hours instead of once per day, improving freshness of expiry and validation data and shortening the time to detect certificate-health changes.
  • Added in-product help popovers with direct docs links across SLA reports, SSL monitors, heartbeat monitors, DNSBL monitoring, email-auth monitoring, postmortems, incident templates, maintenances, on-call schedules, and runbooks.
New
  • Admin global email unsubscribe
    Admins can now suppress or restore all outgoing email for any user from the user profile, covering notifications, system emails, marketing emails, and queued sends.
  • Added status page Page Theme presets
    Default, Minimal Edge, High Contrast, Soft Cloud, and Terminal. These presets change typography, spacing, card styling, and tick-bar density without replacing your brand colors or overriding Custom CSS.
  • Added full-page status page embedding for websites and apps. Add ?embed=1 to a public status page URL to render a chrome-free version that is suitable for use in an <iframe>.
  • Expanded SSL monitoring into a fuller certificate-health workflow
    all users now see SAN coverage validation, paid plans now surface chain completeness plus OCSP stapling and freshness details, and manual Check now now runs the full persisted check pipeline so those details are stored and shown consistently.
Updated

Fixed
  • Fixed status page regional history metadata so cached and live pages preserve whether each region has sufficient history and how many days are actually available, preventing misleading per-region uptime or day-count displays.
  • Fixed several internal monitor and cache error-handling paths so background failures are surfaced more safely instead of being silently dropped.
Improvement
  • Trial starts are now serialized and committed atomically, reducing the chance of duplicate or racing trial activations under load.
  • Notification and scheduler reliability improved behind the scenes
    failed sends now retain delivery error details for diagnosis, unsubscribe-secret fallback handling is safer, and slow monitor cycles back off correctly instead of thrashing.

Fixed
  • Notification Hub page now loads significantly faster
    the channel-to-status-page matrix is built with a single database query instead of one query per channel per status page. A database error during matrix loading now surfaces a clear error message instead of silently showing all channels as disabled.
  • Creating an incident now guarantees an initial timeline entry
    if saving the first update fails the incident is rolled back, preventing incidents from appearing with an empty history.
  • Fixed a missing error check when looking up the "Investigating" incident state
    a misconfigured database now returns a clear error instead of silently creating an incident in an invalid state.
  • Creating a monitor with a new component is now atomic
    both records are written in a single transaction, so a failed monitor insert can no longer leave an orphaned component behind.
  • Fixed a potential server crash on the user dashboard when plan limit lookups fail concurrently
    results are now only applied on success, keeping the pointers at a safe nil instead of dereferencing a partially-written value.
  • Component status overrides on Simple Status Pages now return an error if the incident record could not be created, rather than silently succeeding while skipping subscriber notifications.
  • Added a 500-character limit on component override messages; previously an oversized message would produce a cryptic database error instead of a validation message.
  • Fixed simple status page component authorization gaps in the user dashboard
    component group listing, component notification override routes, monitor lookup, and the incident API now all enforce the same component-group scope rules instead of mixing page-level access with component-level access.
Improvement
  • Down Prediction spike alerts now require the elevated response time to persist for at least 30 seconds before a notification is sent. Single-check transient blips that self-resolve by the next check cycle are discarded silently, eliminating false-positive spike alerts without adding any delay for genuine sustained spikes.
  • Email Authentication monitors (SPF, DKIM, DMARC) now use an automatic retry mechanism
    when a check detects an issue, the monitor is re-checked up to 3 times at 5-minute intervals before an alert is sent. Alerts now represent confirmed, persistent problems rather than transient DNS lookup failures.
  • Editing a monitor's Site URL now refreshes URL preview-based validation suggestions automatically after a short pause, and the Advanced Expected Conditions docs now explain how URL preview suggestions work in both Add and Edit Monitor.
  • Add/Edit Monitor now use one-click interval quick picks plus an exact-seconds field, reducing cognitive load while still allowing custom intervals.
Updated
  • Down Prediction docs
    Updated Down Prediction Alerts to document the 30-second spike persistence gate and correct the absolute response-time floor value used in spike detection.
  • Email Authentication docs
    Updated Email Authentication Monitoring (SPF, DKIM, DMARC) to explain the retry behaviour and what a confirmed alert means.
  • Monitor setup docs
    Updated Setting Up Your First Monitor, Advanced Expected Conditions, and Monitor Types to match the current Add/Edit Monitor dashboard: Site, API, and DNS are documented as the active dashboard monitor types, Database is called out as unavailable in Add and not editable from the current dashboard edit flow, configuration examples now map directly to the current form, and the first-monitor guide documents the quick-pick interval UI plus current save and validation-suggestion behavior.
  • Advanced Request Settings docs
    Updated Setting Up Your First Monitor and Advanced Expected Conditions to explain that query parameters, request headers, and custom request bodies live in Advanced Request Settings, and that POST/PUT/PATCH shows a direct shortcut from the HTTP Method field to that section.
  • Added a permanent analysis note under docs/analysis documenting the simple status page component-permissions audit, the pre-fix leak paths, and the final verification criteria.

Fixed
  • Fixed duplicate blog-category routing so category pages resolve through a single canonical path and no longer create unnecessary SEO duplication.
  • Fixed the regional daily aggregation insert path to cast values correctly during backfills.
  • Fixed per-region status-page history tick tooltips so hover details render more reliably on the public status page.
Improvement
  • Scheduler startup now performs proactive regional aggregation gap checks and unconditional backfills where needed, reducing the chance that public status-page history stays incomplete after deploys or missed jobs.
  • Improved canonical URL handling across marketing pages, blog, docs, tools, sitemap generation, OG metadata, and robots rules so duplicate public URLs are redirected or described more consistently for search engines.
New
  • Added admin tools for checking regional daily aggregation coverage and triggering regional backfills directly from the admin panel, with clearer in-panel reporting when a backfill returns errors.

Fixed
  • Fixed scheduled maintenance entitlement checks so marketing labels such as Starter and Team, internal plan names, and lowercase plan keys all map to the same canonical tier before access decisions are made.
  • Fixed scheduled maintenance upgrade messaging so the feature is treated as available from Starter and above, avoiding incorrect upgrade prompts for eligible users.
Improvement
  • Expanded plan-based feature gating and upgrade messaging across the user dashboard so locked features resolve plan names consistently and point users to the correct minimum tier.
  • Improved the analytics UI with clearer button structure, better historical-view tooltips, and related template cleanup to make the dashboard easier to use and maintain.
  • Added focused regression coverage for plan-name normalization and scheduled maintenance entitlement checks to keep the tier-resolution path protected.
New
  • Added the internal Signal intent-scoring tool and guide so the team can track product-usage signals and identify free users showing stronger purchase intent.
Updated
  • Refreshed locale files, translation completeness data, and related UI copy for new cached-result labels, restore prompts, channel-management flows, and validation or error messages across supported languages.

Fixed
  • Fixed yesterday hourly aggregation fallback so monitors missing precomputed rows fall back individually to live data instead of leaving the 24-hour response graph blank when only some monitors had hourly history.
  • Fixed status page chart hydration so minute-chart load failures no longer overwrite hourly graph placeholders and the hourly graph can appear reliably after cache or shell regeneration.
Improvement
  • Per-region history strips now always span the full 90-day date range
    missing days are padded with gray "no data" placeholders instead of leaving fewer, wider ticks. This fixes the visual bug where a newly added region showed 1–2 enormous blocks instead of a proper aligned strip.
  • The "Per-region history" expandable section now shows the total region count and a color-coded "N affected" badge (orange for minority, red for majority) directly in the summary line, so partial outage impact is visible without expanding.
  • Monitoring gap ticks (gray, unknown status) now show "No data (monitoring gap)" in their tooltip, clearly distinguishing deployment gaps from actual downtime.
  • Per-region uptime percentage is replaced with a day count (e.g. "2d") when a region has fewer than 14 days of history, preventing misleading low percentages for newly added regions.
  • Minute-by-minute response charts now distinguish partial outages (only some regions down, shown in muted orange) from full outages (all regions down, shown in red), with an inline legend for multi-region monitors.
  • Status page response graphs now render the hourly placeholder consistently and bootstrap or fetch hourly series on first load, including shell-first responses and pages where auto-reload is disabled.
  • Added focused model tests for per-monitor yesterday-hourly fallback handling to keep the response-graph data path covered.
  • Improved monitor region pill readability in the user dashboard by using stronger success-state text contrast in light theme while preserving the existing dark-theme appearance.
Updated
  • Added the clear monitor history dialog screenshot asset for related documentation and UI references.

Fixed
  • Improved stale DOWN alert reconciliation so recovered monitors can automatically close lingering DOWN alerts.
  • Tightened recent monitor-result filtering to only include entries from the last two hours where the stale-result path could otherwise distort current state.
  • Removed unnecessary card wrappers from brand assets and press sections.
Improvement
  • Expanded daily and hourly aggregation pipelines with region-aware rollups so status page history can represent regional health instead of only global monitor state.
  • Updated cache structures and cache key versioning to support the new regional history payloads safely.
  • Improved plan-name presentation in the monitor history clearing flow and related user-facing monitor UI.
New
  • Added per-region history display for multi-region monitors on public status pages, including region-aware daily history data and richer daily tick metadata.
  • Added support for clearing monitor history and resetting related monitor statistics from the user dashboard.

Fixed
  • Added missing monitors.form.advanced_settings_hint translations in ar, de, es, fr, hr, pt-br, and sv locale files to keep runtime locale key coverage aligned with template usage.
  • Restored green i18n pipeline status by resolving the per-locale missing-key check in make i18n-magic / make i18n-ensure.
Improvement
  • Humanized Telegram admin alerts for user-facing HTTP errors
    4xx errors (400, 401, 403, 404, 429) now show with an ℹ️ icon and a plain-English note so routine client errors are no longer indistinguishable from real server failures (🚨 reserved for 5xx).
  • Alert messages now show the real request URL (with actual IDs and query string) instead of the route template placeholder.
  • Removed unnecessary analytics cache invalidation on upsert and delete. Snippets are built per-request so cache busting was a no-op.

Fixed
  • Fixed /admin/errors pagination to stop rendering every page link; pagination now shows a compact first-5/last-5 page set with ellipses.
  • Fixed the non-working single "resolve error" action by sending CSRF token headers on admin resolve requests.
  • Added "Mark All Filtered Open Errors Resolved" in the error-log filters area with double confirmation and optional notes.
  • Fixed broken hero links on the landing page audit template.
Improvement
  • Optimized the monitors dashboard metrics pipeline to reduce /user/monitors data loading time from about 28 seconds to about 2.5 seconds for ~20 active monitors.
  • Added short-lived metrics response caching and reduced heavy region-query workload in batched monitor metrics processing.
  • Updated 24h metrics aggregation to combine pre-aggregated hourly history with a live recent tail for faster query execution while preserving response compatibility.
  • Improved status page settings UX
    enhanced section initialization and event handling for notifications and analytics sections, and added error handling and refresh functionality to the service selection flow.
  • Updated badge colors for admin and signup sources in the trials admin view for better visual clarity.
Updated
  • Expanded GET /user/api/monitors/metrics to support range=30d, including uptime-derived trend aliases (uptime_percentage, uptime_trend, response_time_trend) while preserving legacy apdex compatibility fields.
  • Expanded GET /user/api/monitors to return inline metrics windows (1h, 24h, 7d, 30d) for each monitor in addition to existing identity fields.
  • Updated monitor API documentation and API-key endpoint reference to document monitor metric windows, required query parameters, and validation errors.

Fixed
  • Template and notification preference wiring
    Updated user-facing templates, notification settings, and route handling so the new browser notification and incident alarm preferences are correctly exposed and usable across the dashboard.
Improvement
  • Browser notification and incident alarm preferences
    Extended user notification settings with browser notification and incident alarm preferences, injected the VAPID public key into user templates for registration, and added alarm sound assets for incident-related notification flows.
  • Incident form cleanup
    Removed the misleading "Connected channels" list and "Connect Slack, Discord, Telegram…" button from the incident create/edit form. These owner notification channels are configured at the status page level and fire automatically; surfacing them inline implied per-incident control that doesn't exist and linked to a non-existent page.
  • Dashboard and incident editing clarity
    Refined user dashboard wording and visibility logic, improved average response-time presentation, and tightened incident edit UX around component severity display and inline guidance.
  • Team detail auditing visibility
    Added an audit logs section to the team detail view and updated the related translations needed to surface the new admin/user copy consistently.
New
  • Web push notification foundation
    Added VAPID-backed web push support, including push token storage, service worker handling, dispatch logic for browser/mobile push channels, and a helper tool for generating VAPID key pairs.

Fixed
  • Navbar notification dropdown state consistency
    Standardized row-click handling so opening a notification from either navbar also clears its unread state, while dedicated checkmark clicks mark items as read in place without redirecting.
  • Notification dropdown HTML escaping
    Escaped notification title, body, and link values in the shared dropdown renderer to avoid injecting raw notification content into navbar markup.
Improvement
  • Notification bell per-row read actions
    Added explicit per-notification "mark as read" checkmark actions to the admin navbar bell dropdown and aligned the user bell dropdown behavior so notifications can be marked read directly from the menu without visiting /admin/notifications or /user/notifications.
  • Shared navbar notification dropdown helper
    Extracted the duplicated admin/user bell dropdown logic into a reusable shared helper to keep loading, mark-read, mark-all-read, badge updates, and live-notification insertion behavior consistent across both dashboard navbars.

Fixed
  • Subscription action payload compatibility
    Adjusted Dodo-related handler payload construction so plan-change and subscription operations remain compatible with the current SDK/request contract.
Improvement
  • Dodo subscription plan change request alignment
    Updated Dodo billing and subscription handling to use the newer subscription plan request structure and revised proration-mode wiring across authentication and subscription flows.
Miscellaneous
  • Dodo dependency refresh
    Refreshed related module definitions in go.mod as part of the subscription request structure update.

Fixed
  • Public sitemap eligibility filtering
    Excluded disabled status pages and suspended or banned users from public sitemap generation.
  • Incident creation validation flow
    Tightened incident creation/edit validation and related user incident UI handling to reduce invalid submissions and improve error behavior.
  • Email validation caching behavior
    Refined email validation caching logic to reduce unnecessary validator work while preserving expected validation outcomes.
  • Monitor results index migration safety
    Updated the monitor-results region/created-at index migration to remove the CONCURRENTLY option and clarify migration comments for safer execution in this repo's migration flow.
Improvement
  • Monitor metrics query performance
    Optimized monitor metrics retrieval by bulk-fetching admin-managed region IDs and introducing more concurrent query handling in the monitor metrics API path.
  • Status page domain routing for free platforms
    Improved status-page middleware to better enforce the intended domain redirection behavior for free-platform status pages.
  • Notification dropdown read actions
    Improved dashboard notification UX by enabling direct mark-as-read actions from the navbar dropdown instead of requiring the full notifications page.
  • Analytics visualization coverage
    Extended analytics reporting with prediction-event quality data and accompanying UI/chart updates for better monitoring insight.
New
  • IndexNow ignored URLs management
    Added storage, migrations, and admin UI support for managing ignored IndexNow URLs, including bulk ignore/unignore workflows and server-side retrieval helpers for sitemap submission filtering.
  • Prediction event quality analytics
    Added new prediction-quality metrics and charting support to the user analytics experience, along with supporting analytics cache and handler updates.
Updated
  • Down Prediction documentation examples
    Expanded the Down Prediction article with clearer outage-prevention guidance and a concrete alert example, plus new supporting documentation imagery.

Fixed
  • Async notifier context-cancellation fix across channels
    Normalized async notification fan-out in internal/notifier/service.go to use per-goroutine background timeout contexts for channel delivery and separate short-lived DB contexts for async logging, preventing Email Send Failed alerts caused by inherited request/check context cancellation (smtp_settings + context canceled).
  • Deploy notifier end-state full-log policy
    Updated deploy notifications so full deploy logs are attached only once at terminal pipeline states (success, failure, unknown), while non-final updates stay lightweight. Also updated cmd/deploy-notifier to send logs as Telegram document attachments (sendDocument) instead of inlining large <pre> blocks that can fail with Bad Request: message is too long.
  • Hourly "Today (UTC)" strip now respects issue state even without hourly samples
    Corrected the no-hourly-data fallback path so per-hour segments are still classified and colored from incident/maintenance overlap instead of rendering all 24 hours as tick-unknown.
  • Maintenance precedence in hourly rendering
    Enforced strict precedence where maintenance overrides incident/alert styling for the same hour (maintenance > incident > alert/default).
  • Future-hour masking on hourly strip
    Upcoming UTC hours are now forcibly normalized to gray/unknown (tick-future + tick-unknown) and stripped of incident/maintenance/alert metadata so not-yet-happened periods cannot appear red/yellow.
  • Hourly popover source consistency
    Hour popovers now derive and display source context from segment metadata (maintenance, incident state, or alert context) in line with hourly segment semantics.
Improvement
  • Zero-downtime website deploy topology
    Added a second website service unit (status-website-b on port 18085) and updated Caddy @website upstream routing to pool 18080 + 18085 with health-aware failover, so website traffic remains served while one website instance restarts.
  • Website deploy sequencing and restore safety
    Updated deploy/restart automation in makefile to roll website instances sequentially (status-website-b then status-website) with per-instance health checks, and to stop both website units during binary restore operations.
  • Post-deploy website path validation
    Extended bin/scripts/deployment_health_check.sh to validate both /health and a real website endpoint (WEBSITE_CHECK_ENDPOINT, default /) during startup and the 60-second monitor window.
New
  • Per-component subscriber notifications guide
    Added a new Notifications article, Per-Component Subscriber Notifications, documenting the public subscribe modal, selective incident delivery, page-wide incident behavior, maintenance scope, and feed scope.
Updated

Fixed
  • Protected account action CSRF handling
    Fixed edit, deletion, and password-reset actions in internal account-management flows to consistently send the correct session CSRF token and surface clear retry guidance when validation fails.
  • Temporary credential targeting confirmation
    Added response confirmation so reset-password results are verified against the selected account before a new password is displayed.
  • Signed-in self-delete safeguard
    Prevented signed-in operators from deleting their own active privileged account and routed those requests into a notification flow for separate review.
Improvement
  • Account management workflow polish
    Improved internal account-management interactions by removing a legacy page-load dependency, tightening modal error handling, and making generated temporary passwords click-to-copy for faster handoff.

Fixed
  • On-call escalation countdown freshness
    The active incidents panel on the on-call schedule detail page now updates escalation countdowns in real time (seconds/minutes) instead of showing a stale server-rendered minute value until reload.
  • On-call active incidents live refresh
    The active incidents list on the schedule detail page now refreshes in the background every 15 seconds and updates immediately after acknowledgment, so assignments/ack state/escalation visuals stay current without a full page reload.
  • Account settings notifications navigation
    The Account Settings → Notifications tab now opens the notification preferences page instead of the unread-notifications inbox, so sound and delivery settings are reachable from the settings nav again.
  • TSA inactivity timeout semantics
    The TSA banner no longer shows a permanent session-lifetime countdown. The idle countdown appears only after inactivity begins, and impersonation last-seen is no longer refreshed by background XHR polling, so the 5-minute timeout now correctly reflects actual operator idle behavior.
  • Realtime TSA approval prompt delivery
    Newly created TSA requests now emit a user-side realtime event that opens the approve/decline modal immediately in the dashboard, while keeping the existing page-load pending-request fallback.
  • TSA pending-request decline reliability
    Fixed user decline/approve dialog request serialization in the dashboard prompt so CSRF headers and request IDs are sent correctly, preventing false failure loops on page reload/navigation.
  • TSA idle banner reset consistency
    The inactivity countdown in the user red banner now fully resets on renewed activity and no longer resumes from stale paused values while the session is actively in use.
  • Realtime TSA pill teardown
    When a TSA session ends (manual stop, timeout, or window close), the user now receives an immediate realtime tsa_ended event so stale "TSA in progress" navbar timers are removed without requiring page reload.
Improvement
  • On-call active incidents polling performance
    Background polling now short-circuits unchanged payloads and only re-renders changed incident rows, reducing unnecessary DOM churn while preserving live countdown and relative-time updates.
  • On-call alert log refresh performance
    Manual alert-log refresh now uses digest checks and row-level reconciliation, so unchanged refreshes avoid rebuilding the full table and changed entries update with lower UI churn.
  • On-call escalation notification semantics
    Escalated on-call assignments now emit a dedicated in-app/SSE type (on_call_escalated) instead of being folded into regular assignment events, enabling accurate critical handling in clients.
  • Realtime notification audio coverage
    In-app SSE notifications now play an audible alert so new events are noticeable even when the dropdown is closed.
  • Persistent critical notification alarm
    Critical notification types (including on-call escalations) now trigger a repeating alarm that continues until the operator explicitly dismisses it.
  • User-level notification sound preference
    Added a new account setting to mute non-critical in-app notification chimes while preserving the persistent critical alarm flow.

Fixed
  • Supported OSS logo alignment
    Centered the Supported OSS logo row on the open-source page so short lists no longer stick to the left side of the section.
  • Status page settings plan gating
    Started standardizing status-page settings gating so OSS Hero and other plans now see locked UI for unsupported options like white label and web analytics, while the backend preserves existing locked values instead of clearing them on unrelated saves.
  • Analytics period retention gating
    Historical uptime and analytics quick ranges now respect plan retention limits in both the UI and backend; user analytics pages are excluded from HTML minification to prevent inline script rewrite regressions that caused g/h reference errors on quick-range clicks.
  • On-call override overlap hardening
    Added a database exclusion constraint to prevent overlapping overrides per schedule and mapped concurrent overlap violations to user-facing 409 conflict responses instead of generic server errors.
  • On-call email acknowledge safety
    On-call email acknowledge links now open a confirmation page on GET and only perform acknowledgment on POST, preventing crawlers or link previews from mutating incident state accidentally.
  • On-call escalation step reliability
    The escalation scheduler now advances escalation steps only when reassignment succeeds, and correctly handles same-assignee escalations without silently skipping or prematurely consuming a step.
  • On-call action CSRF coverage
    On-call schedule actions in the user UI now send CSRF tokens consistently for acknowledge, test alert, preference save, and schedule deletion flows instead of relying on mixed client behavior.
Improvement
  • OSS directory publishing workflow
    Added direct navigation from the OSS applications screens into the public directory workflow so publishing approved projects takes fewer manual steps.
  • On-call detail refresh UX and accessibility
    The schedule detail view now preserves shift-end details during current-user refreshes and upgrades key controls like refresh and calendar toggle to more accessible button and keyboard-operable interactions.
New
  • OSS Hero public directory management
    Added a managed OSS Hero Public Directory so approved applications can be prepared and published to the public open-source page without editing static JSON files by hand.
Updated
  • Open-source page listing source
    The public open-source page now prefers visible database-backed OSS directory entries, with the legacy static logo list kept as a fallback until the new directory is populated.
  • OSS approval follow-up flow
    Approved OSS Hero applications now seed a hidden directory draft automatically so logo, destination URL, visibility, verification badge, and ordering can be reviewed right after approval.
  • OSS first-time account setup
    Auto-created OSS Hero accounts now receive a direct password-setup path with clearer first-time setup wording instead of being sent through a generic forgot-password flow.

New
  • Translation Studio docs
    Added updated Translation Studio documentation for dashboard and status page workflows.
  • Embeddable Status Banner docs
    Added a user guide for configuring and embedding the new hosted status banner.
Updated
  • Languages page
    Refreshed the languages page to reflect Translation Studio across the dashboard and public status pages.
  • Older translation docs now point to the latest guide
    Legacy translation articles now link to the current Translation Studio documentation.
  • Embed and status page docs cross-links
    Linked the new banner guide from related embed and status page settings documentation.

Fixed
  • More status page text is now clickable in Translator Mode
    Additional status page strings are now recognized by the translator toolbar for translation suggestions.
  • Shared-page permissions apply more consistently
    Component and incident workflows on shared status pages now respect page access rules more consistently.
New
  • Status page language
    Each status page can now use its own public language, separate from your dashboard language.
  • Translation helper on status pages
    You can now use Translator Mode directly on your public status pages.
  • Preview with Translator
    Open your status page with Translator Mode already active so you can start suggesting translations right away.
  • Temporary Support Access alerts
    Users now get clearer in-app and email alerts when a support session is active.
Updated
  • Translation helper stays active when navigating
    The translator toolbar now stays active as you move through status page and archive views.
  • Status page helper toggle in profile
    The Translation Helper section in your profile now includes a toggle to enable or disable the translation toolbar across all your status pages at once.

Fixed
  • Email Auth Monitor and SSL Monitor add buttons
    Fixed a form issue that could block monitor creation on the DKIM/SPF and SSL pages.
  • Shared-page access in the simple dashboard
    Team members with access to a shared status page can now open the simple dashboard and save component overrides more reliably.
  • Simple dashboard incident updates no longer duplicate unnecessarily
    Repeated note updates now stay grouped more cleanly in incident history.
Improvement
  • Simple dashboard inline editing
    Component status changes and note updates are now faster to manage directly in the dashboard.
New
  • SMS notifications
    You can now send text message alerts through Twilio, Vonage, MessageBird, or Esendex using your own provider account. Available on Pro and higher plans.
  • SMS cost controls and event filters
    SMS channels now support configurable dedup windows, daily send caps, and event-level triggers so you can control both noise and cost.
  • SMS delivery history
    SMS sends and failures now appear in Notification History so it is easier to confirm delivery and spot problems.
Updated
  • Swedish localization added
    Swedish is now available in the supported language set.

Fixed
  • Resetting a component to Operational now fully clears the override
    Components switched back to Operational now return cleanly to their default state and close any related auto-created incident.
New
  • Simple Status Page Dashboard
    Simple status pages now have a dedicated dashboard for updating component statuses, adding notes, and tracking active incidents from one place.
  • Simple Dashboard default landing option
    You can now set the Simple Dashboard as your default landing page after login.
  • Status notes can create and resolve incidents automatically
    Adding a note during a status change can open an incident and notify subscribers, while returning a component to normal can close that incident automatically.
  • Override notes appear on public pages
    Notes added to component status overrides are now shown directly on the public status page.

Fixed
  • Overall status calculations now ignore disabled monitors
    Disabled monitors are no longer included when computing overall status, preventing inactive checks from skewing page-level health.

Improvement
  • Admin user filtering
    Expanded admin user management with additional filtering options and data attributes so large user lists are easier to search and segment.
  • Degradation prediction tuning
    Adjusted degradation prediction thresholds in the monitoring scheduler to improve alert accuracy and reduce premature degradation signals.
New
  • Admin broadcast email tools
    Added an admin broadcast email interface, supporting handler/model work, and related menu wiring so internal teams can send broader operational messages from the admin panel.
  • Operational outage documentation
    Published a provider outage postmortem and supporting incident-analysis content, including refreshed blog coverage and new visual assets for the Contabo outage write-up.
Updated
  • Monitoring incident write-ups
    Updated outage-related blog and guide content with clearer summaries, supporting screenshots, and stronger cross-linking to follow-up documentation.

New
  • Release notes publication workflow
    Added a release notes guide covering February 27 to March 17, 2026 and extended metadata handling and tests so these summary pages generate cleaner share previews.
Updated
  • Localization key coverage
    Added the subject translation key across supported locale files to keep email- and notification-related UI text consistent.

Fixed
  • WordPress plugin download CTA
    Updated the public pricing page plugin button to point directly to the hosted ZIP download.
  • Suspended-account email suppression
    Outbound email sending and queued email flushing now skip suspended users instead of attempting delivery.
  • Template safety in status page analytics UI
    Removed a Go-template parsing hazard caused by literal {{status}} placeholder text inside the status page list analytics JavaScript.
Improvement
  • Status page quick analytics snapshot
    Added 30-day quick analytics popovers and modal summaries on /user/status-pages with uptime, average response time, incident counts, downtime totals, and unique visitor counts plus a direct link into the full historical analytics view.
  • Incident context visibility
    Expanded the incident details view to show linked runbooks and impacted monitor context together so responders can jump from an incident into the right operational follow-up faster.
New
  • Runbooks for incident response
    Added user-managed runbooks with create/edit/delete flows, status-page or component scoping, automatic incident linking for matching components, and inline runbook visibility from the incident details sidebar.
  • User dashboard search API
    Added authenticated navbar search for status pages, monitors, and team members so dashboard search results can be loaded dynamically instead of relying only on static JSON.
Updated
  • Localization coverage for new user UI
    Added translation keys and shipped locale updates for runbooks, incident context labels, status page quick analytics, component override messaging, and navbar search labels across the supported language set.

Improvement
  • Operational analytics processing
    Added asynchronous queue + worker processing for status page view events so analytics collection remains non-blocking during traffic spikes.
  • Analytics retention cleanup
    Added periodic cleanup for processed queue rows and expired daily anonymous dedupe records so view analytics storage stays bounded over time.
New
  • Privacy-friendly status page view analytics
    Added built-in daily view counters for status pages with total views, approximate unique visitors, incident-period views, and incident unique visitors using anonymous daily hashing and no cookies, localStorage IDs, or raw IP storage.
  • More selectable status page dependencies
    Added new dependency provider options to the existing Dependencies tab in status page settings so pages can select more third-party services from the list and configure their per-page impact and ordering.
  • Shared analytics links for view metrics
    Analytics share-token links now load the new status page view counters as well, so shared dashboards can access the same privacy-friendly view metrics as signed-in users.
Updated
  • Support documentation
    Updated the customer-facing guide at /docs/articles/status-page-view-analytics to document all four view metrics, privacy guarantees, hashing approach, and metric semantics.

Improvement
  • User dashboard activity visibility
    Reworked analytics and dashboard activity surfaces to make recent activity easier to scan, including clearer access to the full activity view.
New
  • Authenticated user API surface
    Added authenticated API endpoints for incidents, maintenances, monitors, and status pages, along with user API-key scope handling and an in-app API console for testing and discovery.
  • Zapier integration for event workflows
    Added Zapier hook subscriptions, event handling, database support, and a visual-builder setup guide so users can route product events into no-code automations.
  • Admin tools page
    Added a dedicated admin tools surface with supporting scheduler and agent-monitoring work to centralize internal operational tooling.
Updated
  • Localization for new tools and analytics UI
    Added or updated translations across supported locales for the new tools page and recent dashboard activity changes.

Fixed
  • Status page component group matching
    Optimized known component-group ID checks in the default status page template to avoid incorrect grouping behavior in rendered pages.
Improvement
  • Subscription downgrade flow cleanup
    Simplified subscription management by removing the separate trial-cancellation path and improving downgrade-to-free handling across the billing flow.

Improvement
  • Plan limit messaging in the user dashboard
    Refined plan-limit notifications and status page list messaging so users get clearer upgrade guidance when they approach or hit account limits.
  • Pricing page copy clarity
    Tightened pricing page descriptions to better explain plan differences and reduce ambiguity during evaluation.
  • Landing page CTA state awareness
    Updated landing page variants so primary calls to action adapt more cleanly to the visitor's current signed-in state.
Updated
  • Simple status page marketing assets
    Refreshed simple status page documentation content and added supporting imagery for the public marketing flow.

New
  • University content wave 3
    Published 11 new university guides covering SSL monitoring, multi-region monitoring, maintenance windows on status pages, custom domains, status page components, custom branding, subscription options, SLA vs SLO vs uptime, monitoring false positives, on-call escalation policies, and incident update cadence.
  • Simple status pages support article
    Added a customer-facing article in /docs/articles explaining when to use simple status pages, how their reported-status timeline works, and how incidents/components affect them.
  • Simple status pages guide
    Added /docs/guides/SIMPLE_STATUS_PAGES with behavior, precedence rules, tick semantics, caching notes, and troubleshooting for manual incident-driven pages.
Updated
  • University topic coverage
    Expanded the university library to better support live feature pages for SSL monitoring, multi-region checks, maintenance windows, custom domains, custom branding, incident workflows, and on-call operations through stronger educational content and internal linking.
  • University metadata consistency
    Tightened March 8-11 university descriptions and summaries to reduce overlap and improve search snippet quality across the growing article library.
  • Simple status page language and metadata
    Removed uptime-centric wording from simple status page tick UX and made public metadata descriptions simple-page aware so incident/status semantics are reflected accurately.

Improvement
  • Monitors list filtering persistence
    The Status Page filter on /user/monitors now persists in browser storage and restores on reload, with safe fallback to All Status Pages when a previously saved page no longer exists.
  • Monitors grouped browsing mode
    Added a new Group by: Status Page toggle beside Card/Compact view controls, including collapsible per-status-page sections, visible monitor counts, and an Ungrouped bucket for monitors without an associated status page.
  • Grouped view compatibility across existing controls
    Grouping now works with status filters, Enabled/Disabled/All tabs, monitor state transitions, deletions, and both card + compact list rendering.
Updated
  • Monitors list UX documentation
    Added a new Monitoring support article, Monitors List: Sticky Filters and Grouping, covering sticky filter behavior, grouped sections, local storage keys, and support troubleshooting.
  • Monitoring article cross-linking
    Updated Choosing Monitor Locations to link to the new monitors-list UX guide for easier in-doc discovery.

Fixed
  • University product page links
    Replaced stale /incident-management product-page references and handler fallbacks with /incidents to avoid 404s while preserving valid /university/incident-management/... guide URLs.
Improvement
  • University navigation visibility
    Added University to the desktop Resources menu, mobile Discover menu, footer Resources list, and Resources active-state matching so the new section is discoverable across the site.
  • Dedicated university social previews
    All university-related pages now default to static/img/og-meta/university.png for Open Graph and Twitter image metadata.
  • Expanded university library
    Added follow-up university guides for synthetic vs real user monitoring, alert fatigue reduction, and on-call handoff checklists.

Improvement
  • Manual restart support
    Improved operational controls for monitoring nodes by adding a clearer manual restart workflow with failure reporting.
  • Safer setup flow
    Improved first-time and recovery setup behavior so existing monitoring nodes resume more reliably while newly configured nodes can still be completed safely before activation.
New
  • University content hub
    Launched /university with markdown-backed landing, category, and article pages for evergreen guides on status pages, incident management, uptime monitoring, and on-call workflows.
  • University sitemap support
    Added a dedicated /university-sitemap.xml and included university URLs in the sitemap index and complete sitemap output.
Updated
  • Initial university curriculum
    Published the first university guide set covering status page examples and best practices, incident communication templates, maintenance and postmortem templates, uptime monitoring fundamentals, and on-call rotation guidance.
  • Shared public styling for university pages
    University templates now use the docs-style public help bundle and shared public metadata flow for a more consistent reading experience.

Improvement
  • Distributed monitoring rollout improvements
    Improved how monitoring nodes are updated so both one-off updates and broader rollouts are more consistent and easier to manage.
  • Deployment inventory support
    Added a structured inventory-based rollout flow so monitoring nodes can be updated from a defined target list instead of ad hoc manual steps.
  • Operational rollout guidance
    Expanded deployment guidance for monitoring nodes, including safer rollout expectations and clearer handling of target-specific configuration.
  • Alias-friendly remote management
    Improved remote host handling so updates work more cleanly with named SSH host configurations and explicit install paths.
  • Release version tracking
    Added a stable rollout versioning approach for monitoring node updates so intentional monitoring releases can be tracked separately from other routine deploys.
  • Version drift visibility
    Added a way to review which monitoring nodes are on the expected release and identify nodes that have drifted from the intended rollout.

New
  • Transport fallback support guide
    Added a new Monitoring support article, Transport Errors, Timeouts, and IPv4 Fallback, documenting interval-aware timeout behavior, one-shot IPv4 fallback for eligible transport failures, and how to interpret "UP with IPv4 fallback" notes in Recent Checks.
  • Support macro templates for transport incidents
    Added docs/guides/SUPPORT_MONITOR_NETWORK_FALLBACK_MACROS.md with copy-ready responses for IPv6/IPv4 path mismatch cases, timeout-heavy monitors, DNS/config mismatches, and internal escalation handoff.
Updated
  • Monitoring locations article
    Updated Choosing Monitor Locations with a new section on IPv6/IPv4 transport behavior, fallback notes, and links to deeper troubleshooting guidance.

Fixed
  • False down events showing 0s response time
    Fixed false positive "down" events that were incorrectly recorded with 0ms response time due to an error in the monitoring algorithm. The backfill script corrects historical data by skipping these erroneous entries, as they were not actual failures.
  • Region UUID storage in monitor results
    InsertMonitorResultWithMetadata now explicitly writes the primary region UUID to monitor_results.region_id instead of relying on the database default, fixing the bug where all region status pills showed as gray/unknown due to the literal string 'primary' being stored instead of the actual UUID.
  • Scheduler region ID passing
    The scheduler now resolves and passes the primary region UUID to InsertMonitorResultWithMetadata before inserting monitor results, ensuring correct region association in the database.
Improvement
  • Bootstrap 5 popovers for region status pills
    Monitor list region indicators now use rich HTML popovers (hover/focus) instead of native browser tooltips, showing region name, status, and average response time with proper styling and color-coded status badges.
  • Compact region pill UI
    The plain text "Regions: Munich, Portsmouth, Seattle" label has been removed from monitor rows; only colored status pills are shown for multi-region monitors, keeping the list view cleaner and more scannable.
New
  • Per-region average response time in monitor list
    Multi-region monitors now display region-specific average response time in the pill hover popover, using the same averaging model as the global "Avg response" column but scoped to each individual region.
Updated
  • Monitor location documentation
    Updated support articles (monitoring-locations, monitoring-primary-region, getting-started-first-monitor) to document the new region pill UI, popover behavior, and per-region metrics visibility in the Monitors list.

Fixed
  • On-demand TLS allow decision on cache miss
    /caddy-ask now falls back to status_pages DB lookup when a platform slug is missing in loaded cache, preventing stale-cache SSL issuance denials for valid pages.
  • SSL provisioning reliability for new slugs
    New *.statuspage.me pages no longer fail certificate issuance solely because slug cache was loaded but not yet containing the slug.
Improvement
  • Automatic slug propagation on page creation
    Status page slugs are now synchronized automatically when pages are created, improving first-access reliability.
New
  • Faster domain readiness for new status pages
    New status page slugs are now propagated immediately so newly created pages are ready for secure access faster.
Updated
  • HTTPS provisioning flow
    Improved certificate allow-check behavior for newly created status page domains to reduce false denials.

Fixed
  • Private avatar endpoint
    Public /api/avatars* is blocked at the edge; avatar images are only accessible through authenticated routes.
  • More resilient avatar rendering
    When the DiceBear upstream is unavailable or returns unexpected responses, the proxy returns a deterministic SVG fallback instead of failing the page.
Improvement
  • DiceBear proxy hardening
    Avatar proxy requests are restricted to SVG/PNG output paths and forward query strings to DiceBear (private caching headers included).
New
  • User avatars: source selection
    Users can choose gravatar or custom in profile settings (persisted in users.avatar_source).
  • User avatars: custom style selection
    Custom avatars support a style dropdown (persisted in users.avatar_style): identicon, bottts, pixel-art, lorelei, initials.
  • User avatars: local DiceBear rendering
    Custom avatars are rendered via an authenticated local proxy endpoint (/user/api/avatars/...) and are deterministically seeded from the user’s email.
Updated
  • Profile UI
    Profile settings now include avatar source + custom style controls with helper text.

Fixed
  • User monitors: trend deltas now hydrate correctly
    The /user/monitors dashboard no longer shows 0.00% for uptime/response change by default; the metrics hydration API now returns the change fields and the UI applies them in both card and compact list views.
Improvement
  • User monitors: neutral indicator for no change
    0.00% changes now render with a neutral dash icon + muted styling instead of looking positive/negative.

New
  • On-Call: per-member notification channel preferences
    Each schedule member can now configure their preferred notification channel (Slack, Pushover, Discord, etc.) for on-call alerts, overriding the team-level default on a per-person basis.
  • On-Call: notification rules per member
    Members can define personal notification rules including DND hours and repeat-until-acknowledged escalation, so alerts keep firing until the on-call engineer confirms receipt.
  • On-Call: active incident response dashboard
    The schedule detail view now includes an active incident panel showing the current assignee, acknowledgement status, escalation timer, and quick-action buttons, giving responders immediate context without leaving the schedule.

Improvement
  • On-Call calendar: event click quick menu
    Clicking an override event now opens a contextual quick menu with "Edit assignee", "Duplicate override", and "Delete override" actions directly from the calendar, without opening the full detail panel.
  • On-Call calendar: undo toast after drag/resize
    Accidentally dragging or resizing an override now shows an "Undo" toast with a 5–8 second window to revert the change.
  • On-Call calendar: success toasts for delete actions
    Deleting an override now shows a lightweight success toast (create and update toasts were already in place).
  • On-Call calendar: compact density toggle
    Week and day views now have a compact/comfortable density toggle so users can fit more events on screen without switching to a different view.
  • On-Call calendar: legend chips
    The calendar legend now displays stronger, color-coded chips for Rotation, Override, and Conflict event types for clearer visual differentiation.
  • On-Call calendar: active filter counts
    The filter bar now shows the number of active filters next to each filter label so users can see at a glance how many selections are in effect.
  • On-Call calendar: improved mobile defaults
    On small screens the calendar now defaults to day or list view instead of week view, preventing cramped layout on mobile devices.
  • On-Call calendar: clearer "now" line
    The current-time indicator in time-grid views now displays a visible time label alongside the line so the current hour is immediately apparent.
  • On-Call calendar: timezone mode in header
    The active timezone mode (local / schedule / UTC) is now displayed more prominently in the calendar header so it is always visible without opening the settings panel.
  • On-Call calendar: keyboard shortcut for create override
    A keyboard shortcut now opens the "Create override" modal directly from the calendar, without requiring a mouse click.
  • On-Call calendar: enter-to-save in override modals
    Pressing Enter in any field of the create or edit override modal now submits the form, consistent with standard modal behavior.
  • On-Call calendar: focus return after modal close
    After closing an override modal or dismissing a drag error, focus is returned to the previously active element, improving keyboard and screen-reader accessibility.

Improvement
  • Scheduler leader election reliability
    Implemented scheduler leader election wiring in the server/scheduler startup flow so only the elected instance performs scheduled job execution.
  • Deploy workflow readiness for failover
    Updated deployment scripts and Make targets to support failover-oriented operations and safer scheduler/service orchestration.
  • Public navigation update
    Added on-call scheduling visibility in public marketing navigation and feature surface to improve discoverability.
New
  • HA failover watchdog service
    Added a dedicated failover watchdog script and systemd unit (status-failover-watchdog) to continuously monitor leader state and support automatic failover handling in high-availability deployments.
  • Scheduler HA implementation guide
    Added docs/implementation/HA_FAILOVER.md with operational setup and rollout guidance for leader election and failover behavior.

Fixed
  • Monitor sparkline and detail chart repaints no longer fire randomly. Monitors appear in multiple DOM tabs (Enabled/Disabled/All), causing duplicate element IDs; all metric/sparkline update paths now use querySelectorAll to update all clones, and detail pane updates are scoped to the exact clicked/expanded instance to prevent cross-panel interference.
  • Switching range tabs (1h / 24h / 7d) now deterministically updates the chart immediately on XHR completion; late responses for a superseded range are discarded via range guard checks.
  • 7d range now renders a visually distinct weekly shape instead of mirroring the 24h chart.
  • Status page link below monitor name no longer spans full row width
    display changed from block to inline-block so only the link text is clickable. Clicking the link no longer toggles the row expand/collapse panel.
  • Down check error messages in Recent Checks are no longer truncated to 60 characters; full text is now rendered with safe HTML escaping and word-wrap.
Improvement
  • Monitor sparkline graphs now anchor the Y-axis floor to 3× the actual data range (clamped to 0), so small absolute jitter no longer fills the full chart height and looks like a chainsaw.
  • Monitor metrics API now samples data across the full selected time range using SQL bucketing (width_bucket) instead of returning only the latest 80 raw checks. This ensures range changes produce visually distinct graphs.
  • Sparkline bucket count and output point cap are now tuned per range
    1h → 24 buckets/24 pts, 24h → 48 buckets/40 pts, 7d → 7 buckets/7 pts (true daily averages).
New
  • On-Call: Shift-start notifications
    When the on-call rotation changes, the newly on-call person automatically receives a "Your shift has started" email and a Slack/Discord/Telegram channel notification (if a status page notification channel is configured).
  • On-Call: One-click acknowledge from email
    Assignment emails now include a signed one-click "Acknowledge" link so the on-call person can acknowledge an incident directly without logging in (link expires in 48 hours, single-use).
  • On-Call: Override conflict detection
    Creating an override that overlaps with an existing override now returns a clear error instead of silently stacking.
  • On-Call: "Take On-Call Now" button
    A new button on the schedule detail page lets any eligible team member immediately take over the current shift, creating a self-override until the natural shift end.
  • On-Call: Visual Gantt timeline
    The 14-day timeline is now a color-coded Gantt chart (blue = rotation, amber = override, today highlighted) instead of a plain text table.
  • On-Call: Assignee name in incident list
    The incident list now shows the assigned team member's name in the assignee badge (with ✓ or ⏱ acknowledgment status).
  • On-Call: Multi-level escalation policies
    Schedules now support an ordered escalation policy (L1 → L2 → L3 …). Each step defines a timeout and a target schedule. The escalation scheduler walks steps in order, reassigning the incident and resetting the timer at each level. Existing single-step escalation settings are automatically migrated as step 1.
  • On-Call: iCal calendar feed
    Each schedule exposes a secret-token-protected .ics URL that can be subscribed to in Google Calendar, Apple Calendar, or Outlook for a rolling 60-day view of who is on-call.
  • On-Call: Click-to-assign Gantt editor
    Clicking any day cell in the 14-day Gantt chart opens a user-picker dialog (avatar + name + email card grid). Selecting a person creates a full-day override for that day. If a conflicting override already exists, you are prompted to replace it.
  • On-Call: Schedule link in emails
    All on-call emails (incident assignment, escalation, shift-start, schedule-changed) now include a "View schedule →" link pointing directly to the schedule detail page. Assignment and shift-start emails also include a 7-day schedule table rendered as a proper HTML table (previously the table was silently dropped by the markdown renderer).
Updated
  • 7d sparkline hover tooltip now shows date only (no time) and labels the value as "Daily avg
    …ms".
  • Detail chart series name and tooltip formatter reflect "Daily Avg Response (ms)" when in 7d mode.
  • DOWN check error messages now include explicit expected-vs-actual detail: "Expected conditions not satisfied. Expected \<condition\>, got \<actual value\>" for status code, response time, body, and header conditions
    in both the main scheduler and the distributed agent check executor.

New
  • Added an optional “How did you find us?” question to onboarding (saved as users.attribution_source + users.attribution_detail).
Updated
  • Updated monitor documentation in docs/articles to match the current Monitors compact-list flow
    pause/resume from row action icons, inline AJAX behavior with progress overlay, automatic tab move/counter refresh, and temporary Restarting… state after resume.
  • Sitemap <lastmod> for docs and blog articles now reflects the actual file modification time (from os.Stat) rather than the original published_at date, so the IndexNow admin tool and scheduler can accurately detect re-submitted or updated pages.
  • Sitemap <lastmod> for static marketing/public pages is now derived from the modification time of the corresponding .gohtml template file, enabling IndexNow detection of template-only content changes without a full deploy.

Fixed
  • Synced monitors.status_page_id and added a migration to backfill missing IDs.
  • Fixed landing page hero (#landingHero) CTAs being unclickable in dark mode due to a decorative overlay intercepting clicks.
New
  • Added SLA target tracking and UI support when editing monitors.
Updated
  • Added new blog articles and enhanced existing posts with structured data.

Fixed
  • Fixed user settings updates to correctly handle unchecked HTML checkboxes.
Improvement
  • Enhanced status page functionality and inactive-state handling.
  • Improved agent deployment workflow with dynamic remote directory and user handling.
  • Expanded the makefile help output with detailed target descriptions and usage instructions.
New
  • Added a distributed monitoring agent with configuration and health check endpoints.
Updated
  • Updated the account plan limits & quotas doc to reflect current plan tiers (Free, Pro, Growth, Business, OSS Hero) with accurate core limits (status pages, monitors/page, check interval, subscribers).

Improvement
  • Refactored the event email tester UI and enhanced functionality.
  • Refactored trial welcome email logic to use user IDs and improved message formatting.
  • Enhanced billing management with manually-set plan metadata.
  • Implemented AJAX receipt downloads and updated receipt button behavior.
New
  • Added Telegram notifications for disputes and payment failures.

Improvement
  • Improved billing period handling and receipt download logic in user billing.
New
  • Added a setting to automatically start new signups on a Pro trial.
  • Added a new SaaS monitoring/status stack landing page template (Feb 21).

Fixed
  • Resolved an edge case where a previously deleted status page slug could remain incorrectly blocked beyond its intended protection window.
  • Fixed an edge case where a user's email address could remain flagged as undeliverable after the underlying issue had been resolved.

Improvement
  • Status pages
    improved maintenance display layout and styling for better readability in the default status page template and the hour incidents popover.
  • Public site
    updated footer and navbar branding across marketing landing pages and pricing page.
  • Public site: robots.txt is now served per-component
    the status-pages component serves a dedicated robots_status_pages.txt, while the marketing site serves the standard robots.txt; in dev (all-in-one) mode the correct file is selected based on request host and custom-domain headers.

Fixed
  • On-Call schedule detail
    member/override AJAX calls now include CSRF headers (prevents 403s).
  • Monitor auto-incidents
    on-call assignment email now sends for monitor-created incidents (when an active linked schedule exists).
Improvement
  • On-Call schedules
    added a direct “On-Call” entry in the user dashboard menu.
  • On-Call schedules
    timezone is now a searchable IANA timezone dropdown.
New
  • Docs
    added On-Call scheduling guide: /docs/incidents%20&%20maintenances/on-call-scheduling.

Fixed
  • Account closure
    cancel an active trial when a user closes their account.
New
  • Docs
    added an account closure guide: /docs/account%20&%20billing/account-close-account.
Updated
  • Docs
    clarified trial/subscription behavior on account closure: /docs/account%20&%20billing/account-reactivation-grace-period.

Improvement
  • Monitors
    show the existing critical-action spinner overlay while deleting a monitor, with the message “Deleting a monitor...”.
  • Status pages
    prewarm newly-created pages (and verified custom domains) via a DB-backed queue + scheduler worker to avoid first-hit cold-start/TLS delays.
Updated
  • Status pages
    component card uptime now defaults to 1y, with a hover popover showing 1d/7d/30d/90d/1y (including 1y coverage as X/365 days) and improved popover styling/z-index.
  • Status pages
    added a visual setting to choose the default uptime window shown on component cards.

Fixed
  • Monitors
    fixed an issue where deleting a monitor could fail with a server error in some cases (including disabled monitors).

Fixed
  • Locales
    ensured runtime locale JSON files end with a newline.
New
  • i18n
    added Croatian (hr) language support across standardized translations and runtime locale bundles.
  • Teams
    added Settings History UI with localized strings.
  • Public Website
    added a new “European Alternative” landing page.
Updated
  • i18n Tooling
    improved locale verification/merge tooling and regenerated language completeness.

New
  • Notifications
    added PagerDuty integration support in notification channels.
  • Docs
    added a PagerDuty integration article.
Updated
  • Pricing
    added and displayed notification-channel logos (Pushover, Rocket.Chat, Webhook, PagerDuty).
  • i18n
    expanded translations across locales for the new integration.

Improvement
  • Asset Pipeline
    improved asset bundling and PurgeCSS integration to reduce frontend payload and improve page performance.
  • Public Landing Pages
    added ROI comparison UX and a monthly vs annual ROI period toggle.
Updated
  • Build Assets
    refined optimization flow for static resources to produce leaner production bundles.
  • Public Landing Pages
    updated styles and content, and improved asset path handling.
  • Docs
    updated deployment safety guidance and zero-downtime deployment notes.

Fixed
  • User Billing API
    tightened refund eligibility checks to prevent refund requests for zero-amount first charges.
  • Account Deletion Flow
    clarified cancellation notice behavior and related translations.
New
  • Public Website
    added a new Languages & Translations page with community translation tooling and multi-language support details.
  • Public Website
    added a new Press & Media page with brand assets, press mentions, and contact details.
  • Public Website
    added a DEV.to organization verification route and template.
  • Billing (User)
    added active subscription details, including pricing and billing cycle visibility.
Updated
  • Billing UI
    expanded subscription detail presentation and plan-change/billing-cycle messaging.
  • i18n
    added and updated translation keys across multiple locales for billing and account flows.
  • Tooling
    improved external translation push script behavior for more reliable repository handling.

Fixed
  • Monitoring
    deploy restarts could cause external agents to report self-hosted services as DOWN, artificially lowering uptime percentages.
  • Monitoring
    added a deploy guard (single-row deploy_guard table) so agent-reported DOWN results for self-hosted targets are suppressed while a deploy is in progress.
Improvement
  • Deploy
    make deploy now uses restart-rolling (website → status-pages → user → admin → scheduler) instead of restarting all services simultaneously.
  • Deploy
    deploy guard has a 5-minute TTL safety net (auto-expires if not cleared).
  • Scheduler
    shutdown now cancels the scheduler context first; HTTP shutdown timeout increased from 5s to 10s.
  • Code
    exported scheduler.IsSelfHostedTarget() for reuse in deploy-guard suppression.

Fixed
  • Auth
    hardened cookie flags in production (Secure + HttpOnly) for admin JWT session cookie, status page private auth cookie, and the user logout defensive cookie expiry.
  • Auth
    login no longer overrides session cookie options with Secure: false in production.
  • Security
    removed the missed debug logging from server logs.
New
  • Docs
    added an internal Backup and Disaster Recovery runbook with current DB backup approach, restore steps, RTO/RPO targets, monitoring, off-site sync options, and periodic restore testing.

Improvement
  • Developer experience
    improved API key workflows for managing and rotating keys.
New
  • User/API
    added API key management functionality.

Fixed
  • Scheduler
    corrected response_time_ms expected-condition semantics so operators/ranges reflect expected success thresholds consistently.
Improvement
  • Security
    tightened SSRF protections for server-side URL fetching/checking.
  • Auth
    refactored authentication logging to be clearer and more consistent.
New
  • User
    added a Notification Hub page to review notification channels across status pages, backed by a matrix API.
  • User Dashboard
    added auto-refresh summary + response-time degradation trends (7-day vs prior 7-day), surfaced directly on the dashboard.
  • Status Pages
    added a component “map” view/data (Status Page → groups → components → monitors) to make dependency structure easier to audit.
  • Docs
    added new guides for Notification Hub and for understanding plan limits/quota tracking.
Updated
  • Onboarding
    added an explicit “skip onboarding” action and a soft gate to route incomplete onboarding users back to onboarding until mandatory steps are done.
  • Dashboard/UI
    refreshed templates and added shared partials (quota badge, mobile action bar, degradation alert).
  • Analytics (Teams)
    improved error handling to distinguish not-found from unexpected failures.
  • i18n
    updated translations/locales to cover new UI strings.

New
  • Docs
    added an Advanced Expected Conditions guide covering ALL (AND) / ANY (OR), condition types, and common configuration pitfalls.
Updated
  • Docs
    JSONPath monitoring guide now links to the Advanced Expected Conditions guide and clarifies success (UP) vs failure (DOWN) semantics.

Improvement
  • Admin translations
    bulk-approve now coalesces requests and enqueues each affected language once.
New
  • Translation suggestions
    approving a suggestion enqueues a per-language apply request; the scheduler component drains the queue and runs the existing apply pipeline (backup → apply → merge/verify → git commit/push).
Updated
  • Ops
    added rollout toggles STATUS_TRANSLATIONS_AUTO_APPLY (default on), STATUS_TRANSLATIONS_AUTO_APPLY_DEBOUNCE_SECONDS (default 15), STATUS_TRANSLATIONS_AUTO_APPLY_RETRY_SECONDS (default 120).

Fixed
  • Backend
    fixed internal handler visibility for dependency state calculation (WorstDependencyOverallStateByStatusPageID).
  • Monitors
    fixed monitor DOWN/RECOVERED notifications being unintentionally coupled to auto-incident settings (alerts now send on state flips even when auto_incidents is disabled, respecting notification preferences).
Improvement
  • Onboarding UI
    replaced the large sidebar button with a non-intrusive, pulsating Floating Action Button (FAB) for completing onboarding.
  • Dashboard
    removed the persistent "Onboarding complete" success alert to reduce visual noise.
  • Monitor alerts
    improved DOWN/RECOVERED email formatting (plain-text intro line + clean markdown details).
  • Notification configs
    when using the new linked-channel UI, legacy notification_configs are now auto-synced so sending stays consistent.
New
  • Dashboard
    added dependency awareness; dashboard now warns if any configured 3rd-party dependencies (vendors) are experiencing outages, even if no direct incidents are open.
  • Status pages
    added per-monitor impact controls (full / degrade_only / none) so some monitors can be low-impact or excluded from overall status; group headers can show a configurable softened-impact badge when impact changes the displayed state.
  • Status pages
    added per-component notification overrides (inherit vs override-only) so a component can use different notification channels than the parent status page.
  • Notification channels
    added Google Chat, Mattermost, and Rocket.Chat channel types (webhook-backed).
  • Email deliverability
    added a per-user “send alerts anyway” override for accounts flagged as undeliverable.

Fixed
  • UI
    fixed keyboard shortcut contrast in translator mode dialog.
  • Database
    updated monitors.component_id foreign key to ON DELETE SET NULL to prevent cascade deletion issues.
Improvement
  • Backend
    refactored translation suggestion application logic and backup generation.
  • Docs
    improved documentation for translation progress.
New
  • Translation Mode
    enabled in-app translation mode for dashboard users to suggest and edit translations live.
  • i18n
    added new translation locale files and assets.

Fixed
  • i18n
    updated Serbian translations for "slug" to "identifikator".
  • UI
    fixed string interpolation for error and success messages in user templates (Historical analytics, trial widgets, team details).
Improvement
  • Code structure
    refactored i18n object keys and documentation.
  • Templates
    cleaned up various user templates to support new translation keys.
New
  • i18n
    added translations for domain age, settings, custom domain verification, delete confirmations, palette management, templates, invitations, and historical data access in Spanish, French, Brazilian Portuguese, and Serbian.

Fixed
  • Incidents list
    created-date sorting now uses real timestamps to ensure correct descending order.
  • Analytics share tokens
    Create Token action now localizes correctly.
Improvement
  • Notifications
    localized the status-page notification channels UI.
  • i18n
    improved Spanish locale support (regional Spanish tags map to es).
New
  • Incidents
    archive resolved incidents to hide them from status page lists while keeping the direct link accessible; optional public archive reason; unarchive support.
  • Docs
    added incident archiving documentation.

Fixed
  • Spanish locale bundle
    added missing newline at end of file.
Updated
  • Locales
    expanded French, Brazilian Portuguese, and Serbian translations (heartbeat monitors, security, and common UI terms).

Improvement
  • Subscribers
    improved subscription email validation and user feedback.
  • Trial emails
    messaging updated for clarity and consistency.
  • Trial comparison and widget templates
    improved layout and feature details.
New
  • Trials
    expiry warning email and related database migrations.
  • Dashboard
    uptime checks, monitors, and incidents statistics.
  • Sessions
    session version added for improved session management.

Fixed
  • Security keys (WebAuthn)
    registration (attestation) endpoints now enforce CSRF, and the frontend includes X-CSRF-Token for begin/finish.
  • Security keys (WebAuthn)
    user/admin removal requests now include the CSRF header for consistency.
New
  • Status pages
    changing/setting/removing the status-page password now triggers a security alert email to the account owner.

Fixed
  • Dependency providers
    Zendesk/Webex/Google (Cloud + Workspace Chat) fetching updated to match upstream API formats.
  • Dependency providers
    RSS/Atom providers now report operational when there are no recent items.
  • Status page dependency cards now render the correct status color (operational/degraded/outage/etc) instead of always gray.
  • Admin
    dependency provider batch save no longer 403s due to CSRF header mismatch.
  • 2FA enable no longer rejects valid OTP codes (input normalization + tolerant validation).
  • Backup codes endpoint now returns stored codes.
Improvement
  • Status page dependency cards are aligned using a responsive grid and include shadow-sm for better scanability.
  • WebAuthn (user/admin)
    step-up verification required to register/remove security keys (password, OTP, or backup code).
  • 2FA disable flow now supports step-up verification (password, OTP, or backup code).
New
  • Account security
    security alert emails for sensitive actions (2FA enable/disable, security key add/remove, password set/reset).
  • 2FA setup
    first-party QR-code PNG endpoints for OTP provisioning (/user/otp/qr, /admin/otp/qr) to avoid third-party secret leakage.
Updated
  • Dependency provider fetch type options expanded to include google_incidents, zendesk, and webex.
  • Docs
    dependency providers article now includes the supported providers list + icons.

Improvement
  • Faster /user/dashboard initial load by moving overall uptime calculation to an async endpoint and rendering a lightweight placeholder while it loads.
  • Reduced dashboard DB load by batching per-status-page monitor counts (avoids N+1 queries).
  • Analytics dashboard rendering is more resilient (better error handling).
  • Improved the time-range scans on large monitor_results tables.
New
  • Dependency providers
    scheduled refresh + snapshot storage for richer dependency history.
  • Public pages
    read count support on comparison/marketing pages.

Improvement
  • Monitors
    faster metrics hydration by deduplicating monitor IDs.
  • Email deliverability checks
    reduced unnecessary work for activated users.
  • Status page shell caching
    ensures cache directory exists before writes.
  • Outgoing emails
    unsubscribe URL support to improve deliverability.
New
  • Email logs
    new admin view for troubleshooting email delivery.

Improvement
  • IndexNow
    improved key verification handling and endpoint selection for submissions.
New
  • Admin invite links management page.

Fixed
  • Invite acceptance page no longer falls back to the login form due to template dispatch.
  • Invite acceptance no longer fails during user creation in edge cases.
Improvement
  • Improved onboarding flow for invited users to ensure accounts are secured before accessing the app.
  • Onboarding monitor creation now uses the same UI as the dashboard “Add Monitor” flow.
New
  • Admin dashboard registry for dependency providers (global vendor definitions
    name/logo/API URL).
  • Invited-user onboarding “Secure account” step requiring password and/or OAuth linking before proceeding.
Updated
  • Added i18n keys for new monitor form labels/buttons and status page label (translated across supported locales).

Improvement
  • IndexNow admin
    new button to add all visible URLs and improved selection handling.
New
  • IndexNow
    resubmission scheduler plus admin UI for managing submissions.
  • IndexNow admin
    filter option for selected URLs.
Updated
  • IndexNow submissions now track success/error details for clearer diagnostics.

Improvement
  • SEO
    added contextual internal links to /wordpress-plugin from high-intent pages (tools, integrations, pricing, and a key status page guide) to help WordPress users find the plugin landing page.

Fixed
  • Blog read tracking
    corrected slug assignment and added stronger logging/error handling to diagnose slug mismatches.
  • Migrations
    restored missing down migrations after an accidental deletion.
Improvement
  • User status pages
    real-time monitor status aggregation and a visible “last checked” timestamp for clearer freshness.
  • Monitoring queries
    optimized latest monitor status retrieval using a lateral join.
  • Blog & Docs
    improved internal link title fetching (better title resolution for docs links).
  • Migrations
    added rollback scripts and improved safety around removing database elements.
New
  • Admin
    aggregation status endpoints and dashboard UI to monitor daily aggregation jobs and their results.
  • Public
    email notification channel confirmation now has a dedicated success page.

Fixed
  • Incident creation modal
    fixed CSRF validation error when creating a new component via the component creation dialog on /user/incidents/new. The XHR fetch request now includes the CSRF token in the X-CSRF-Token header.
  • Status page day ticks
    restored incident details in tick popovers (including multi-day progress) by merging historical incidents from shell cache with live incident data.
Improvement
  • Blog & Docs
    enhanced Goldmark link processing to handle Linkify-generated anchors, replacing path-based link text with article/document titles.
  • Link processing
    added smart punctuation handling to strip trailing punctuation from slug lookups (handles cases like /blog/post-name. at end of sentences).
  • Cross-referencing
    blog posts can now reference docs and vice versa, with automatic title resolution from both catalogs.
  • Health checks: updated response format to include dependency status map ({"status":"ok|degraded|error", "component":"...", "dependencies":{"database":"ok|degraded|error"}}). Returns HTTP 200 with degraded status instead of error codes for partial failures. Uses permissive model where /healthz/:component path is informational
    always returns the actual running component's status regardless of path.
New
  • Blog & Docs
    automatic internal link conversion with title fetching. Plain text internal links (e.g., /docs/status%20pages/status-pages-web-analytics) are now automatically converted to properly formatted anchor tags with fetched document titles, improving readability and user experience.
  • Health check endpoints
    extended /healthz to support component-specific queries via /healthz/:component. Uses permissive model where any component path returns the actual running component's health (e.g., https://statuspage.me/healthz/user returns website component health when accessed through public proxy). Main server now probes database connectivity (shallow check) and includes dependency health in response. Scheduler's /healthz endpoint also supports component parameter for consistency.

Fixed
  • Status page
    fixed missing tick and improved tick hydration to remove duplicates and align with daily bars.
  • Status page
    fixed “no data for today” by fetching today’s live data using UTC date truncation and adding date filtering in relevant queries.
  • Status page caching
    improved caching strategy for the live status endpoint and incident cache invalidation behavior.
  • Monitoring queries
    fixed monitor_id type casting and corrected timestamp selection in monitor results.
  • Logging/deploy
    removed noisy 404 debug logs and fixed deployment health-check script path.
Improvement
  • Status page live-status hydration
    improved fetch state management, error handling, and slug handling.
  • Status page incidents UI
    improved hour-incidents popover behavior (dynamic event binding + accessibility) and improved incident tick delegation.
  • Ops/debuggability
    added build fingerprint headers and server time to responses.
  • Ops/systemd
    added service files and a sync script; updated service files to load environment variables.
  • Email
    allow sending weekly reports to users with “undeliverable” email status if verified.
Updated
  • Website
    added component routes and service configuration.
  • Dodo environment
    improved normalization and expanded tooltip details.

Miscellaneous
  • No user-facing changes.

Fixed
  • Status page
    ensured Bootstrap Icons assets are loaded so UI icons (including external-link) render reliably.
  • Status page
    removed caching from /api/status-page/:slug/live-status (skeleton hydration + auto-reload endpoint) to prevent stale status indicators (e.g., showing "Degraded" after issue resolves).
  • Status page settings
    component edit/delete buttons no longer submit the main settings form.
  • Components API
    validates component names (non-empty) and URLs (optional, absolute http/https only).
  • Public pages
    fixed crawlability/accessibility issues (removed javascript:void(0) links in nav, added a proper <main> landmark, improved link/tap-target affordances).
  • Blog
    removed a duplicated docs link line in the privacy-first analytics article.
Improvement
  • Status page UX
    stabilized hour/day pill popover positioning (no flicker/jump on hover-scale) and fixed the ghost/no-data popover resize jitter.
  • Status page rendering
    ensured component URLs are available across cached render modes (MISS/HIT/SHELL-HIT/SKELETON) so the external-link icon appears consistently.
  • Status page auto-reload
    refreshes per-component status dot/pill alongside charts to avoid “cached-looking” component states.
  • User dashboard
    improved component editing UX to edit component name and optional URL in one modal.
  • Public marketing pages
    improved Lighthouse/PageSpeed by deferring non-critical JS, preloading key CSS/fonts, and lazy-hydrating below-the-fold embeds.
  • SEO
    strengthened internal link clustering across the Monitoring blog series (consistent relative internal links + related-article cross-links).
New
  • Status page
    optional per-component external-link icon next to the component name when a component URL is configured (opens in a new tab).
Updated
  • Blog
    refreshed internal links across Monitoring articles to point to canonical on-site routes (e.g. /blog/monitoring/..., /docs, /pricing).
  • Changelog
    linked the 2026-01-11 blog series entry to the actual articles.

Improvement
  • Historical Uptime UI
    added quick date presets, uptime charting, and monitor filtering for easier navigation.
New
  • Analytics
    added Historical Uptime dashboard pages under Analytics, including page/monitor granularity and CSV/JSON export.
  • Team permissions
    status page owners can choose which team roles can access Historical Uptime (default Owner/Admin).

Improvement
  • Admin
    user summary and tables show additional user details and status indicators.
  • Pricing/plan comparison
    improved layout behavior (sticky navbar offset + overflow handling).
New
  • User sessions
    track last_login and last_active for improved account/session visibility.
Updated
  • Docs/articles
    published additional status-page articles (draft → published).

New
  • Docs
    added Zero-Downtime Deployment documentation and solution architecture overview.

Miscellaneous
  • No user-facing changes.

Fixed
  • Alternative page template
    removed an unnecessary safeJS wrapper around JSON-LD scripts.
  • Plan limit persistence
    admin saves now upsert newer plan limit columns (2FA/security keys/postmortems, heartbeat min/max/grace, team seats, settings audit).
Improvement
  • Landing pages
    added social links and improved image handling for light/dark themes.
  • Test coverage
    added comprehensive tests across auth/config/db/utils and expanded Makefile testing commands.
  • Public templates
    refactored asset URLs to use the shared assetPath helper.
New
  • Pricing and billing
    plan features now reflect the actual plan limits configured in the admin UI (including grouped feature rendering).
  • Admin plan limits
    expanded edit + compare UI to include additional plan limits (team seats, heartbeat limits, settings changes audit).
  • Plan features
    refactored feature handling to support grouping and improved visibility.
  • Competitor comparisons
    added SEO FAQ functionality with structured data support.
Updated
  • UI copy
    renamed “GA Tracking” to “Web Analytics”.

Improvement
  • Blog system
    improved article parsing/catalog and related handler logic.
New
Updated
  • Blog
    refreshed existing status page content and templates for incident communication.

Fixed
  • Active discounts API
    treat client-side context cancellations as non-critical (returns HTTP 408 instead of 500).
  • Incident updates no longer overwrite the initial incident message; updates are now appended while preserving the original "Investigating" entry.
Improvement
  • Enhanced status page incident timeline
    connector alignment and segment collapse for long sequences.
  • Improved incident update readability with preserved line breaks (pre-wrap) across templates.
  • Expanded team management capabilities and audit logging for administrative actions.
New
  • Team seat limits
    Each plan now defines how many members (seats) can be invited per team. The subscription owner doesn't count toward the seat limit.
  • Billing page usage snapshot
    Added Teams, Seats per Team, and Heartbeat Monitors usage cards with progress bars.
Updated
  • Documentation
    Teams article clarified plan-based limitations (teams enabled, team count, seats per team).
  • Documentation
    Billing article added Usage Snapshot section explaining all tracked resources.
  • Documentation
    Web Analytics article updated to reflect team-admin access on shared pages.

Improvement
  • Multiple UI/UX improvements across dashboard and public pages.
  • Backend refinements across handlers and services.
Miscellaneous
  • General stability updates and minor fixes.
New
  • Added translations for English, French, and Serbian.

Fixed
  • Fully self-hosted Twemoji PNG assets by updating the local Twemoji runtime to load from /static/vendor/twemoji/assets/ instead of cdn.jsdelivr.net.

Fixed
  • Fixed subscription modal JavaScript error by moving modal HTML and script to end of body tag, ensuring DOM elements exist before script execution.
Improvement
  • Replaced info color scheme (cyan) with primary color scheme (purple) across 57 template files for better brand consistency in alerts, badges, and background highlights on dashboard, public pages, and admin panel.
  • Added cache-busting timestamps (v=20260107193100) to all CSS references to prevent browser caching issues.
  • Removed demo.css references from all templates (previously unused demo asset).
  • Updated future 24-hour tick colors on status pages to be much lighter in light theme (#e8e8e8 with reduced opacity) while maintaining current appearance in dark theme for better visual hierarchy.
Updated
  • Updated Frest Admin Template CSS to latest version (May 2025) from source SCSS files.
  • Established proper SCSS compilation workflow using make scss-build for future CSS updates.

Fixed
  • Fixed HTTP 500 internal server error when subscribing to status updates with an undeliverable email address.
Improvement
  • Added manual override prompt for subscriptions blocked by email validation, allowing users to confirm and force subscription if they believe the address is valid.

Improvement
  • Auth page styling and layout improvements.
New
  • Auth pages
    theme toggle support.

Improvement
  • Self-hosted 19 third-party JS/CSS libraries (twemoji, sweetalert2, chart.js stack, leaflet, jdenticon, sortablejs, apexcharts, marked, tagify, confetti, popper, tippy, bootstrap) under static/js/css/vendor to remove CDN runtime dependencies.
  • Added vendor copy automation (bin/scripts/copy-vendor-libs.js) wired into npm postinstall/make assets-full; templates now load local paths across admin/user/public/status pages.
  • Kept external-only analytics (Plausible, GoatCounter, etc., Sapat) by design.
New
  • Added Swetrix as a web analytics provider for status pages (header-only, requires project_id).
Updated
  • Web analytics settings UI, placement rules, and support docs now include Swetrix.
  • Clarified web analytics copy/docs to note analytics work on custom domains and hosted subdomains (statuspage.me, sp.fyi, hostedstatus.page).

Fixed
  • Disable footer placement for Plausible Analytics and always inject Plausible scripts in the page header.
  • Disable footer placement for Umami Analytics and always inject Umami scripts in the page header.
  • Fix web analytics enablement not persisting after saving analytics configuration, which prevented tracking snippet injection on public status pages.
  • Fix status pages list activity timestamps
    show seconds for <60s and auto-refresh on each status page's monitor interval.
  • Fix scheduled SSL monitor emails not sending reliably; now sends 30/15/5 day warnings and a renewal confirmation email.
Improvement
  • Admin tools
    added a "Realign Next Check (UTC)" action to force-align enabled tool monitors to the next UTC boundary.
  • Add RSS/Atom feed autodiscovery tags (<link rel="alternate">) to public status page HTML.
  • Redesign the user dashboard “Your Status Pages” table into an operational view (health, active incidents, affected monitors, latest activity).
  • Show monitor type/target/interval and last check time in status page settings → Monitors.
  • Live-update the affected row in “Your Status Pages” when new monitor check data arrives.
  • Allow Plausible script_src to be provided as either a full URL or just the pa-*.js filename (auto-expanded to https://plausible.io/js/...).
  • Align Simple Analytics install snippet with the official embed (remove defer).
  • Lock analytics script placement for providers with official placement requirements/recommendations (e.g., Cabin footer-only; Fathom/Pirsch/Simple header-only).
  • Auto-disable SSL tool monitors after 15 consecutive invalid/expired certificate checks and email the user with re-enable instructions.
New
  • Add public status page feeds at /rss.xml (RSS 2.0) and /atom.xml (Atom 1.0) to follow incident and maintenance updates.
  • Surface RSS/Atom feed links in the status page “Subscribe to Updates” modal.
Updated
  • Update Plausible Analytics service configuration to accept a site-specific script src URL/path (e.g. https://plausible.io/js/pa-XXXXX.js) rather than a domain-only setup.
  • Update tool monitors scheduling
    DNSBL + SSL run daily aligned to 00:00 UTC; Email Auth runs every 6 hours aligned to 00/06/12/18 UTC; manual checks no longer shift the next scheduled run.

Fixed
  • Password field focus on protected pages now retries on load/pageshow to avoid browser skip cases.
  • Uptime tooltips on day ticks now show four-decimal precision to avoid rounding away small downtime.
  • User Tools monitors (SSL/DNSBL/Email Auth) now run reliably via the scheduler even when only the user component is deployed.
Improvement
  • Password-protected status pages now autofocus and select the password field on load for quicker access.
  • Public status pages can optionally show monitor type badges (API/DNS/Site) before monitor names.
  • Public status pages now render monitor type badges with a visible badge background and center the availability period controls.
  • Status page settings now include a "View your status page" button next to Save, with an unsaved-changes prompt before viewing.
New
  • Added a per-monitor toggle to exclude it from overall status and global uptime calculations.
Updated
  • Status page hourly history now renders as a compact segmented progress bar (with per-hour hover details) instead of large numbered pills.
  • Future hours in the Today (UTC) bar now render as solid gray to clearly signal upcoming time slots.
  • Status page day ticks now render downtime as hard-stop vertical fills with bad color anchored at the bottom instead of diagonal gradients.
  • Day tick popovers now include a visual notice when a day was unhealthy or had downtime, even if no incidents are listed.

Fixed
  • Fallback to the default status page template when the optional Daisy/test templates are missing, preventing blank renders for /test routes and gated views.
  • Private and blocked status pages now set X-Robots-Tag and meta noindex to stay out of search results.
New
  • All status subdomains and custom domains now serve /robots.txt to satisfy crawlers.
2025 · 7 releases

Improvement
  • Made upgrade page for Incident Templates dynamic
    the required plan name is now fetched from the plan limits cache instead of being hardcoded
  • Refactored incident_templates handlers to use the new features package for upgrade data
  • Upgrade pages now support dynamic feature names, descriptions, images, and custom benefits
New
  • Created internal/features package with reusable feature gates system for plan-gated features
  • Added templates/user/partials/upgrade_feature.gohtml reusable partial template for upgrade CTAs
  • Added dict, strList, and or template functions for better template composition

Fixed
  • Added the admin tools CSRF token to stop 403 responses when running the Auto-Heal action for free tools.
  • Corrected the Auto-Heal DKIM/SPF query to target the existing dkim_spf_monitors table, preventing 500 errors.
  • Fixed /user/analytics/:id deep-links not auto-loading charts/data by force-loading the default 90-day view on page load.
  • Fixed the dashboard “Service health” overall badge showing UNKNOWN by returning and using the same live overall status semantics as the public status page.
Improvement
  • Converted the landing page "Featured On" SaaS directory widgets into a single-row scrolling carousel to match the existing logo treatment and avoid grid wrapping and ensured both homepage logo rows (customers and SaaS directories) auto-scroll by initializing every carousel track, not just the first and reduced the logo height to 50px for a tighter strip layout.
  • Landing page signup analytics now attributes signups by activation intervals (based on recorded template activation times) instead of relying on the users.landing_template snapshot.
  • Dashboard quick-start and zero-status-page callouts now use Frest card/icon patterns, and the Activity action control adopts the Frest icon-only style for consistency.
  • Tools dashboard now includes a Frest-style quick-start bar and uses label badges for all tool tiles to match the updated dashboard visual language.
  • Replaced remaining Boxicons on user dashboard-related templates/partials with Bootstrap Icons to avoid missing assets and keep styling consistent.
  • Monitor add/edit forms now use Frest-style headers, alert treatments, and padded containers for a consistent dashboard UX.
  • Applied comprehensive Frest UI/UX beautification across all 70+ user dashboard templates and partials:
  • All pages now use consistent container-xxl flex-grow-1 container-p-y wrapper.
  • All cards now have shadow-sm for subtle depth.
  • Card headers feature icon badges with bg-label-* rounded-circle styling.
  • All solid badge backgrounds (bg-success, bg-danger, etc.) replaced with label variants (bg-label-success, bg-label-danger).
  • Action buttons converted to icon-only pill style
    btn btn-sm btn-icon btn-text-secondary rounded-pill.
  • Alerts now use subtle backgrounds
    bg-info-subtle, bg-warning-subtle, bg-danger-subtle, bg-success-subtle with matching borders.
  • All FontAwesome (fa-*), Boxicons (bx bx-*), and Tabler (ti ti-*) icons replaced with Bootstrap Icons (bi bi-*).

Improvement
  • Inject privacy-friendly analytics snippets on public status pages with placement control, exclusion rules, and a custom-domain-only disclosure.
  • Add self-exclusion option for status page owners
    when enabled in Account Settings > Notifications > Privacy, logged-in owners won't be tracked by their own status page analytics, keeping visitor data clean and accurate.
  • Add UI disable/enable behavior for analytics configuration section
    when the "Enable web analytics" toggle is off, all configuration fields are visually dimmed (50% opacity) and disabled from interaction.
  • Add owner self-exclusion backend logic in public status page handler
    checks if logged-in viewer is the page owner with self-exclusion enabled before injecting analytics scripts.
  • Add privacy settings toggle in user account notifications page for self-exclusion preference management.
  • Add database migration (0229) to support owner self-exclusion
    new exclude_self_from_analytics boolean column on users table.
  • Create comprehensive WEB_ANALYTICS_IMPLEMENTATION.md documentation covering database schema, models, API endpoints, privacy features, user guide, and security considerations.
  • Create user-facing documentation article "Configuring Web Analytics" with step-by-step setup guide, service comparison, troubleshooting, and compliance information.

Fixed
  • Monitor creation for DNSBL/SSL/DKIM-SPF now sets next_check_at into the future immediately (6 hours ahead) to prevent "Next Check" showing past times.
  • Analytics print styles improved so charts render correctly in print/PDF.
Improvement
  • Brand palette and Custom CSS injection applied to live status pages and archives; UI polish for palette controls (auto-save, disable when off, remove flow).[Fixed]
  • Fixed critical bug where InsertAlert() was never called in the scheduler's alertOnStatusChange() function, causing the alerts table to remain empty and the /user/monitors/{id}/alerts page to always show "No alerts for this monitor"
  • Alerts are now recorded for ALL monitors on status change, not just those attached to components (auto-incidents still require component attachment)
  • Fixed cascade failure issue
    Local scheduler now skips checks for self-hosted infrastructure (statuspage.me, hostedstatus.page) to prevent false "down" events when the local status-pages service crashes. External agents are used exclusively for monitoring our own infrastructure.
  • Fixed critical scheduler goroutine bug causing tool monitors (SSL, DNSBL, DKIM/SPF/DMARC) to stop executing after 18+ days locally and 1+ month in production. The scheduler goroutine was exiting immediately after starting all schedulers because it had no blocking mechanism, causing deferred cleanup to run and kill all child goroutines. Added <-ctx.Done() to keep the goroutine alive until context cancellation.
  • Fixed analytics dashboard failing on production with "Failed to load analytics data" error. The /api/analytics/status-pages/:id route was registered on the root router without session middleware, so GetUserFromContext() returned nil. Added route to userGroup for authenticated users while keeping the root route for token-based stakeholder access.
  • Fixed analytics showing incorrect uptime percentages for recently created status pages. The system was counting days before monitors existed as 0% uptime (e.g., 90-day period for a 30-day-old monitor showed ~38% instead of ~100%). Now clamps the analytics start date to the earliest monitor creation date for the status page.
  • Reduced Caddy load balancer failover timing from 15s (5s interval + 10s duration) to 7s (2s interval + 5s duration) for faster automatic failover when status-pages service is unavailable
  • The embed API, public API, and homepage routes now failover more quickly to the user service when status-pages is down
  • Added "Next Check" column to DNSBL and Email Auth monitoring tables to show when the next automated check will occur
New
  • Admin Tools page with Auto-Heal actions to normalize next_check_at across DNSBL, SSL, and DKIM/SPF monitors.
  • Added SELF_HOSTED_DOMAINS environment variable (comma-separated) to configure which domains are self-hosted. Defaults to statuspage.me,hostedstatus.page. Monitors targeting these domains skip local region checks to prevent cascade failures.
  • Added custom favicon upload for status pages
    users can now upload their own PNG, JPG, SVG, or ICO favicon (max 100KB) to personalize their status page branding. Requires Custom CSS plan feature.
  • Added automatic brand color palette extraction from logo
    users can extract dominant colors from their uploaded logo using k-means clustering, with suggested palettes for primary, secondary, accent, background, and text colors. Dark mode colors are auto-derived.
  • Added color palette editor with live preview in status page settings
    includes color picker inputs, hex value editing, and real-time preview of how brand colors will appear on the status page.

Fixed
  • Analytics share token management aligns with database schema and no longer queries non-existent columns.
  • Revoked or expired analytics share links now render a clear "access revoked" message instead of failing unexpectedly.
  • Analytics share token usage counting is performed on token-based analytics API access.
  • Added a legacy /user/analytics/statuspage route that redirects to the current analytics JSON endpoint to prevent older/cached clients from failing with 404.
  • Plan upgrades/changes initiated from the billing pricing UI now redirect back to billing with success=true, ensuring the purchase thank-you modal shows after successful plan changes.
  • The plan purchase client script now handles successful plan-change responses that return a redirect URL instead of a Dodo checkout payment link.
  • Adaptive Post‑Incident Monitoring eligibility now correctly detects non-free plans even when the stored plan key casing differs (e.g., GROWTH).
Improvement
  • Analytics dashboard now requires selecting a status page before loading metrics (no automatic fetch on page load).
  • Analytics downtime-only filter now affects both the chart and component health table.
  • Shared analytics links open a simplified read-only analytics view.
  • API/HTTP monitors can now mark DOWN when response time is greater or less than a threshold via Advanced Conditions.
Updated
  • Added new Analytics documentation articles (dashboard + sharing).

Fixed
  • Dashboard tool history now records entries even when a lookup is served from cache.
  • Tools dashboard pages now reliably show the plan badge across /user/* routes.
  • Fixed incident visibility leak where componentless incidents could potentially be exposed to unauthorized users.
  • Fixed automated incident creation failures when incident state lookup returned empty values.
  • Fixed issue where incidents could be created without being linked to any status page (orphaned incidents).
  • Automated incident creation now respects plan limits for auto_incidents feature.
  • Status page activity checks now work correctly for both component-based and componentless incidents.
  • Fixed email recipients not displaying on first dialog open when editing email notification channels.
  • Monitors no longer disappear from public status pages when their component assignment is cleared; they now render under a standalone "Monitors" section
  • Fixed monitor status-page resolution in dashboard models so component-less monitors are correctly attributed to their status page (including uptime calculations and downgrade preview).
Improvement
  • Response Time Percentiles
    daily_monitor_aggregations table now computes and stores P95 and P99 response time percentiles during nightly aggregation job via PostgreSQL PERCENTILE_CONT() function
  • Print-Optimized Reports
    Analytics dashboard includes @media print styles for landscape tabular output, enabling users to generate monitoring reports without PDF export
  • Added visible "Recent checks" history to the dashboard Domain WHOIS and Domain Age tools.
  • Added pagination and an items-per-page picker to "Recent checks" for the Domain WHOIS and Domain Age dashboard tools.
  • Non-subscribed users see up to 3 recent checks; paid users see unlimited history.
  • Recent checks update immediately after running a new lookup.
  • Recent checks show whether results were cached or fresh.
  • Blog post pages now use their cover image for social previews (OpenGraph/Twitter) when available.
  • Standardized more dashboard pages to render via the shared renderUser helper so plan/CSRF context is consistently available.
  • Incident creation form now includes direct status page selection for better UX.
  • Improved incident validation to ensure all incidents are properly linked to a status page.
New
  • Analytics Dashboard
    Comprehensive historical monitoring analytics for status page owners with time-series charts, customizable date ranges (7/30/90/365 days or custom), and print support
  • Analytics Metrics
    Display key performance indicators: uptime percentage, average/min/max/p95/p99 response times, MTBF/MTTR, incident count, and downtime duration
  • Component Health Breakdown
    Per-component analytics showing availability, response time percentiles, incident frequency, and operational status (up/degraded/down)
  • Dual-Layer Analytics Cache
    Redis hot cache (7d/30d periods, 30min TTL) + file-based cold cache (90d/365d periods, 6h TTL) + in-process LRU (500 entries) for optimal performance
  • Analytics Share Tokens
    Secure token-based access for stakeholders with optional expiry dates, read-only flags, and usage tracking (foundation for Q2 2026 stakeholder feature)
  • Team Members Stub
    Database table created for future Teams feature enabling role-based access control (owner/editor/viewer)
  • Made blog and Help Center tags clickable with SEO-friendly tag pages (e.g. /blog/tag/monitor/, /docs/tag/monitor/).
  • Component selection is now optional when creating incidents – create general status-page-wide incidents.
  • Added "Verify" button for unverified email notification channels to manually resend verification emails.
Updated
  • Added user dashboard sidebar "Analytics" entry linking to /user/analytics (auto-redirects to the first active status page).
  • Registered public Analytics page at /analytics/:id?token=... for stakeholder access (read-only) and ensured the template passes the token to API calls.
  • Wired GET /api/analytics/status-pages/:id in the server and initialized an analytics cache (Redis + file) for performance.
  • Implemented full token management UI
    list, create, and revoke share tokens with optional expiry and read-only flags; includes copy-to-clipboard share URL generation and usage tracking.
  • Token management accessible at /user/analytics/:id/tokens with ownership enforcement; routes
    GET /user/analytics/:id/tokens (list), POST (create), DELETE/:token_id (revoke).

Fixed
  • Fixed malformed checkbox HTML in Domain WHOIS tool where CSS code was incorrectly mixed into the label element.
  • Added missing template variables (user, isUserLoggedIn) to Domain WHOIS and Domain Age tools for proper user dashboard rendering.
  • Double-reading of HTTP response body during monitor checks now avoided with shared body content
  • SLA report template panic when switching months (float/int comparisons in template logic)
  • Incorrect daily downtime attribution that could exceed 24 hours on a single day for long-running incidents
Improvement
  • Monitor onboarding wizard now displays CDN detection warnings with actionable recommendations
  • Monitor test runs now include metadata storage in JSONB column for CDN detection results
  • Status page settings UI with ownership transfer tab and pending transfer status
  • OSS Hero application form automatically restores draft data after failed submissions
  • Failed OSS applications now trigger admin Telegram alerts with error details and IP address
  • SLA report month navigation updated to use explicit Month + Year dropdowns (stable template rendering)
  • Aligned dark theme styling of WHOIS raw output on the user tools page to match the public tool for better readability.
New
  • Public changelog page with date-based markdown entries at /changelog
  • CDN detection system for monitoring checks (Cloudflare, Akamai, Fastly, CloudFront, Sucuri, Imperva)
  • Status page ownership transfer system with email invitations and single-use tokens
  • Educational warnings when monitors detect CDN usage to prevent false positive HTTP 200 responses
  • Blog post explaining CDN false positives and health check endpoint best practices
  • OSS Hero application form now auto-saves drafts on submission failures
  • Admin Telegram notifications for OSS Hero application submissions (success and failure)
  • Automated SLA breach email notifications with deep links to the relevant monitor SLA report
  • One-off SLA incident metrics backfill utility for recomputing daily aggregates over a date range
Updated
  • Added Tools submenu links for Domain WHOIS and Domain Age in the user dashboard for easier access with the option to flush cache.