LoginSign Up
← Back to all sparks
O

Oh Dear

INFRA · APIS
Velocity5.0

Website monitoring service covering uptime, broken links, certificates and scheduled tasks

ohdear.app ↗

Oh Dear adds free public tools after five weeks of security fixes

uptime-monitoringfree-toolssecuritystatus-pageswebhooks
◆Current state
Oh Dear, an uptime and site monitoring service, publishes a changelog each week. The 6 November entry adds free public tools, a cron expression editor, SSL certificate checker, redirect checker and DNS watch, and fixes confusing wording on passing certificate checks. The weeks before brought custom webhook headers, 30 to 90 days of status page history and AI fix prompts in Broken Links alerts, along with fixes for a high-severity SSRF, a status page CNAME takeover and scoped API token access.
◆Where it's heading
After a run of security fixes, Oh Dear is adding top-of-funnel tools that let non-customers test one thing for free. Product work is otherwise steady small improvements to notifications and status pages.
◆Prediction
More free single-purpose tools are likely, along with continued weekly notification and status page polish.

◆Recent moves

  1. 7d ago

    Changelog: 2026-11-06

    Oh Dear adds free tools for cron expressions, SSL certificates, redirects and DNS, plus clearer wording for passing certificate checks and accessibility fixes. A shift from security patching to tools that bring in new users.

    View source ↗
  2. 14d ago

    Webhook custom headers, uptime header rules, reseller teams page

    Webhook destinations accept custom headers, uptime checks gain shared header rules that can be tested separately, and resellers get a teams page. Guest access also becomes read-only across the web app, API and MCP tools, the fifth weekly security item in a row.

    View source ↗
  3. 21d ago

    AI fix prompts in Broken Links alerts, PHP CVE warnings

    Broken Links notifications now include AI fix prompts, and Oh Dear emails owners of sites on PHP versions affected by two new CVEs. Security fixes cover a reflected XSS in crawler pages and CLI credential file permissions.

    View source ↗
  4. 22d ago

    Scoped tokens locked out of team-wide endpoints

    Scoped API tokens can no longer reach team-wide endpoints, an API leak of existing status page IDs is closed, and webhooks failing for 48 hours pause automatically. The MCP URL now shows a landing page in a browser.

    View source ↗
  5. 28d ago

    High-severity SSRF fixed in uptime checks and AI fetches

    Fixes a high-severity SSRF: uptime checks and AI page fetches now only connect to public addresses, even after redirects. Application health checks also get a configurable frequency.

    View source ↗
  6. 1mo ago

    Longer status page history; MCP consent and CNAME fixes

    Status pages can show 30, 60 or 90 days of history with custom state colours, and check intervals now go up to 24 hours. Security fixes cover the MCP consent screen hiding redirect destinations and a possible status page CNAME takeover.

    View source ↗