DEV3 Watchmoor – Uptime Monitoring & Status Page SaaS Laravel Script with Incidents, Escalation & SLA Reports

Watchmoor is an uptime monitoring and status page platform that you run as a multi-tenant SaaS, built by DEV3 Technologies on Laravel 12 and Filament 4. Workspaces watch their sites and APIs, confirm a failure before anyone is paged, run incidents with escalation, and publish branded status pages. You sell plans, and every workspace is isolated from the others.

What it does

• Seven kinds of check. HTTP with redirects and a slow limit, keyword, JSON path, TCP port, TCP ping, SSL expiry and heartbeat URLs for cron jobs. A new monitor runs its first check straight from the wizard.
• Confirmation across regions. A failure counts only when the configured number of regions agree (n of m, default 2 of 3). Flap damping groups noisy monitors into one summary.
• Incidents and escalation. Confirmed failures open an incident, group monitors that fail within two minutes, page the first step of an escalation policy and move on if nobody acknowledges. Manual incidents, updates, postmortems and auto-resolve are included.
• Public status pages. Three layouts, logo and accent colour, light and dark, Arabic right to left, 90-day uptime bars, maintenance notices, an Atom feed, password or IP-restricted pages, and subscribers with double opt-in and component filters. Pages are server-rendered and cached for 30 seconds.
• Maintenance windows. A calendar of planned work that pauses alerts for chosen monitors and is left out of the uptime maths.
• The Uptime Ribbon. One row per monitor and one bar per day for 90 days on the dashboard, with open incidents pinned above.
• SLA reports. Monthly and daily uptime, downtime minutes, MTTA, MTTR and response percentiles per monitor, as PDF and CSV.
• Alert channels. Email, SMS, signed webhook and chat webhook, with a verification step and a delivery log with retries.
• SaaS layer. Plans with limits (monitors, interval, regions, status pages, subscribers, SMS, API), trials, billing page, team roles (owner, admin, responder, viewer), an operator panel with workspaces, probe nodes, queue health, target blocklist, abuse reports, audit log and audited view-only impersonation.
• API (plans with API access): scoped keys hashed at rest, rate limits with headers, one error envelope and an OpenAPI document.
• Safe by design. Every outbound check goes through an SSRF-safe client that resolves the host once, pins the address, re-checks every redirect and refuses private, loopback, link-local and metadata addresses.

Install and demo data

A web installer checks the server, writes the configuration, migrates and loads either demo data or an empty install, then creates the operator account. The demo has 10 fictional workspaces, 420 monitors, thirteen months of uptime history, incidents with postmortems, maintenance windows, 18 status pages and about 4,500 subscribers. Every demo password is password. Node.js is not needed because compiled assets are included.

Good to know before you buy

• Probe regions are logical. Out of the box checks run from the server where you install it. The eu-west, us-east and ap-south regions are simulated from that same result with seeded latency offsets. To check from real places you run the small probe agent (php artisan watchmoor:agent) on servers elsewhere with a node token.
• "Ping" is a TCP connect, not ICMP. PHP cannot send ICMP without root, so the check is labelled TCP ping in the interface.
• Email and SMS alerts are simulated. They are written to a message log until you add a mail transport and an SMS provider driver. There are no voice calls.
• Webhook and chat-webhook channels are real, and go through the same SSRF-safe client as the checks.
• Custom domains need your TLS. Watchmoor verifies the DNS records of a status page domain but does not issue certificates; terminate TLS on your own proxy.
• Demo monitors target fictional *.example hosts that a simulated driver answers; they never leave the server. Real targets are checked for real.
• A cron entry is required. schedule:run every minute drives the checks. A queue worker is recommended; QUEUE_CONNECTION=sync works for small installs and is bounded per run.
• Subscriptions use a simulated billing gateway until you configure one. You are the merchant of record for your customers.
• Web only. There are no mobile apps.
• No hosted demo. The brands, people and places in the screenshots are fictional.

Quality checks

Watchmoor 1.0.0 passed the seven release gates of the DEV3 Laravel suite on the final code: static analysis (Larastan level 6), the Pest suite (412 tests), a front-end size budget, migrations and seeding on MySQL 8 and SQLite, a headless-browser pass with MySQL race checks in eight groups (scheduler claims, confirmation votes, incident grouping, quotas and others), an installer test from the package and a secret scan. A security review of the probe client, the state machine and the scheduler found eleven issues, all fixed before release.