What does Lemwatch monitor?

Lemwatch runs 20+ automated checks per site: uptime, response time, SSL/TLS expiry, domain expiry, DNS changes, sitemap health, broken links, content changes, SEO audits, mobile usability, security headers, and more.

Yes. The free tier monitors up to 5 sites. Pro is $19/month for 50 sites and Agency is $59/month for 100 sites, both with full feature access.

How is Lemwatch different from UptimeRobot or Pingdom?

Lemwatch bundles uptime, change detection, SEO audits, security scans, and a public API in one platform — features competitors charge separately for. It also includes team workspaces, white-labelled status pages, and a webhook system out of the box.

Does Lemwatch send alerts?

Yes. Lemwatch supports email, browser push, webhooks, and per-site notification routing so the right person hears about the right incident.

Is there a public API?

Yes. Pro and Agency plans get a public REST API with webhooks for sites, checks, incidents, and reports.

Cloudflare Error 525: SSL handshake failed with the origin

Cloudflare reached the origin on port 443 but the TLS handshake failed. Nearly always the origin has no valid certificate, no certificate at all, or an incompatible cipher configuration.

Short answer

Cloudflare reached the origin on port 443 but the TLS handshake failed. Nearly always the origin has no valid certificate, no certificate at all, or an incompatible cipher configuration.

What Cloudflare Error 525 means

In Full and Full (Strict) modes Cloudflare connects to the origin over HTTPS. If that handshake fails, visitors see 525 even though Cloudflare's own edge certificate is perfectly healthy.

Causes and fixes, most likely first

The origin has no certificate installed on port 443. Install a certificate on the origin — a free Cloudflare Origin Certificate is the simplest option and lasts 15 years.
The origin's cipher suites do not overlap with Cloudflare's. Enable TLS 1.2/1.3 with a standard modern cipher list on the origin.
SNI is required by the origin but the Host does not match its certificate. Ensure the origin's certificate covers the hostname Cloudflare sends, or configure a matching default vhost.

How to stop it happening again

Monitor the origin certificate separately from the edge certificate — they expire on different schedules and only one is visible to visitors.

Check your own domain

An SSL check against the origin reveals whether it can complete a handshake at all, independently of Cloudflare.

Frequently asked questions

My site shows a valid certificate — why 525?

The certificate visitors see is Cloudflare's edge certificate. 525 is about the second leg, from Cloudflare to your origin, which has its own certificate.

Lemwatch — All-in-One Website MonitoringUptime, performance, SEO, security, and change detection in one platform. Free tier available.Pricing · Features · Sign Up