What does Lemwatch monitor?

Lemwatch runs 20+ automated checks per site: uptime, response time, SSL/TLS expiry, domain expiry, DNS changes, sitemap health, broken links, content changes, SEO audits, mobile usability, security headers, and more.

Yes. The free tier monitors up to 5 sites. Pro is $19/month for 50 sites and Agency is $59/month for 100 sites, both with full feature access.

How is Lemwatch different from UptimeRobot or Pingdom?

Lemwatch bundles uptime, change detection, SEO audits, security scans, and a public API in one platform — features competitors charge separately for. It also includes team workspaces, white-labelled status pages, and a webhook system out of the box.

Does Lemwatch send alerts?

Yes. Lemwatch supports email, browser push, webhooks, and per-site notification routing so the right person hears about the right incident.

Is there a public API?

Yes. Pro and Agency plans get a public REST API with webhooks for sites, checks, incidents, and reports.

Cloudflare Error 526: Invalid SSL certificate on the origin

Cloudflare completed the handshake with the origin but refused its certificate — expired, self-signed, or not matching the hostname — because the SSL mode is Full (Strict).

Short answer

Cloudflare completed the handshake with the origin but refused its certificate — expired, self-signed, or not matching the hostname — because the SSL mode is Full (Strict).

What Cloudflare Error 526 means

Full (Strict) validates the origin certificate. 526 means that validation failed. Switching to Full stops the error but also stops the validation, so it is a workaround rather than a fix.

Causes and fixes, most likely first

The origin certificate expired. Renew the origin certificate and reload the origin's web server.
The origin uses a self-signed certificate under Full (Strict). Install a Cloudflare Origin Certificate, which Full (Strict) trusts, or a publicly trusted certificate.
The origin certificate does not cover the hostname. Reissue the origin certificate with the correct hostname in its SAN list.

How to stop it happening again

Track origin certificate expiry with the same alerting as public certificates; nothing visible to visitors warns you first.

Check your own domain

The SSL check reports the origin certificate's expiry, issuer and covered hostnames — the three things Full (Strict) validates.

Frequently asked questions

Should I switch to Full to fix 526?

It removes the error but also removes origin certificate validation, leaving the Cloudflare-to-origin leg unauthenticated. Fix the origin certificate and stay on Full (Strict).

Lemwatch — All-in-One Website MonitoringUptime, performance, SEO, security, and change detection in one platform. Free tier available.Pricing · Features · Sign Up