Node.js Express health check endpoints monitors can trust

Express needs explicit health routes

Express apps default to 404 on /health — load balancers and Kubernetes mark instances unhealthy when developers forget dedicated routes. Implement GET /health returning 200 JSON quickly without heavy logic. Separate GET /ready checking database mongoose.connection.readyState or pg pool connectivity returning 503 when not ready.

Uptime Monitor on public health URL after every deploy — internal localhost curl insufficient for ingress path.

Avoid doing too much in health handlers

Synchronous dependency checks on every health poll exhaust connection pools under monitor cadence. Cache dependency status with five-second TTL updated by background interval. Health handler reads cache — sub-millisecond response.

Kubernetes probe timeout two seconds — one slow MongoDB ping fails entire pod repeatedly.

Cluster mode and PM2 monitoring

Node cluster mode and PM2 fork multiple workers — health on one worker passes while others stuck. Load balancer health checks single instance — verify all workers via process manager metrics plus external HTTP.

PM2 graceful reload drops connections — expect brief monitor blip; tune alert thresholds.

Middleware ordering traps

Global auth middleware applied before health routes blocks monitors with 401. Register health routes before app.use(authMiddleware) or exclude paths explicitly. HTTP Header Checker on 401 versus 503 guides fix during incidents.

Rate limiters on /api/* should exclude /health and /ready.

Graceful shutdown and readiness

On SIGTERM, set readiness to failing before draining connections — Kubernetes stops sending traffic. Implement shutdown flag health routes read returning 503 during drain. External monitors may briefly flap during deploy — acceptable with tuned thresholds.

Document expected flapping duration in runbook — prevents panic rollback during normal deploy.

Environment and secrets validation

Express app starts with missing DATABASE_URL then crashes on first request — health at startup returns 200 if route registered before connection attempt. Lazy connection validation in ready handler catches this.

After secrets rotation, Website Down Checker on ready endpoint before closing ticket.

Checklist for Node teams

Routes: /health live, /ready dependencies. CI smoke: curl health, assert JSON. Weekly SSL Checker on API domain. External Uptime Monitor production URL. Link all free monitoring tools in README for on-call. Pair with Kubernetes guide for ingress-layer verification.

Graceful shutdown and event loop lag

Express apps under load shed health checks when event loop lag exceeds thresholds — monitor returns 503 while process technically alive. Track event loop delay metrics internally and expose degraded status in /health JSON before hard failure. PM2 cluster mode requires health per worker or aggregate — load balancer may hit unhealthy worker repeatedly while others serve.

Graceful shutdown on SIGTERM must drain connections before exit — Kubernetes sends SIGTERM before SIGKILL; readiness should fail immediately while liveness allows drain period. External Uptime Monitor during rolling deploy validates zero-downtime claim — flapping during deploy indicates probe timing misconfiguration.

Node.js memory leaks manifest as gradual latency increase before OOM kill — Ping Test latency trending up over days warrants heap profiling before restart masks root cause. Separate /live and /ready in Express router mounted before middleware that can block — auth middleware on health route causes false unhealthy during auth provider outage.

Pre-launch and quarterly review checklist

Mount /live and /ready before auth middleware that can block health routes during auth provider outage. Track event loop delay internally and expose degraded status before hard 503 — monitors return failure while process technically alive under event loop saturation.

Verify graceful shutdown during Kubernetes rolling deploy — readiness fails immediately while liveness allows drain period. Ping Test latency trending up over days warrants heap profiling before OOM restart masks memory leak root cause.

Document cluster mode health aggregation when PM2 or Node cluster module serves requests — load balancer may hit unhealthy worker repeatedly while others serve successfully. External Uptime Monitor during deploy validates zero-downtime claims.

Reliability habits that compound

Teams that treat external verification as a release gate recover faster than teams that treat monitoring as insurance purchased once and forgotten. Assign ownership for every monitor URL, review alert noise monthly, and delete checks for decommissioned hostnames before they erode on-call trust. Website Down Checker snapshots during triage provide evidence for post-incident timelines and vendor escalations when providers dispute impact scope.

Free tools remove budget as an excuse for skipping customer-visible layers. Bookmark Uptime Monitor, Ping Test, and all free monitoring tools before launch week — not during the incident when every minute of downtime carries revenue and reputation cost. Consistency beats perfection: weekly five-minute reviews catch configuration drift that expensive suites miss when nobody logs into dashboards regularly.

Train support staff to request external confirmation before escalating to engineering — local DNS, VPN split tunneling, and corporate proxies generate false user reports daily. Engineers should resist dismissing customer reports because internal checks pass from office networks while CDN or regional failures affect users globally. Shared verification links resolve most tickets in minutes without waking on-call for non-incidents.

Incident communication and evidence collection

During confirmed outages, capture Website Down Checker and HTTP Header Checker snapshots before making changes — timestamps and status codes anchor post-incident timelines when vendors dispute impact. Update Status Page with honest customer-facing language even when root cause remains under investigation; silence erodes trust faster than temporary unavailability.

After recovery, rerun external checks from Uptime Monitor and Ping Test to confirm latency and status codes returned to baseline — not merely that one office browser loads the homepage. Assign one action owner per follow-up item from retrospectives; unowned monitor gaps guarantee repeat failures on the same blind spot.

Explore all free monitoring tools quarterly as a team drill — habits beat heroic incident response. SSL Checker and Domain Expiry Checker belong on the same calendar as application deploy reviews because TLS and registrar failures bypass application health entirely until they suddenly do not.

Incident communication and evidence collection

During confirmed outages, capture Website Down Checker and HTTP Header Checker snapshots before making changes — timestamps and status codes anchor post-incident timelines when vendors dispute impact. Update Status Page with honest customer-facing language even when root cause remains under investigation; silence erodes trust faster than temporary unavailability.

After recovery, rerun external checks from Uptime Monitor and Ping Test to confirm latency and status codes returned to baseline — not merely that one office browser loads the homepage. Assign one action owner per follow-up item from retrospectives; unowned monitor gaps guarantee repeat failures on the same blind spot.

Explore all free monitoring tools quarterly as a team drill — habits beat heroic incident response. SSL Checker and Domain Expiry Checker belong on the same calendar as application deploy reviews because TLS and registrar failures bypass application health entirely until they suddenly do not.

Frequently asked questions

How do I verify node.js express health check endpoints in 2026 without expensive monitoring software?

Qikot provides free on-demand checks from our remote servers — no account or agent install. Use the Uptime Monitor linked in this article, then confirm with related tools for SSL, DNS, or headers when symptoms persist.

Are Qikot checks accurate for website operators?

Checks simulate public HTTP paths customers use. They complement — not replace — internal metrics. External failure with internal green usually means DNS, CDN, TLS, or WAF issues between your origin and the internet.

How often should website operators run these checks?

Run tier-one URLs after every deploy and DNS change. Schedule weekly uptime and ping baselines, monthly SSL and domain expiry reviews, and always verify externally during incidents before closing tickets.

Does Qikot store my URLs or require login?

No user database. Checks are stateless and results cache briefly for performance. Do not submit secrets in URLs; use health endpoints without credentials in query strings.

What should I do when a check reports down?

Capture status code and timestamp, run complementary checks (headers, DNS, SSL), update your status page if customers are affected, and escalate to hosting with external evidence rather than browser screenshots alone.