statuspost.org · 21 checks, all shown · first reading, 25 Aug 2026, 11:45 PM ET
The watchman keeps a page on the watchman, held to the same rules: real
readings, nothing hidden, mistakes written down. Once per-minute watching begins, this page
updates like every member page.
6 of 6probes answered on the first reading
One reading so far, six cities, every one answered. The percentage arrives
when there is a denominator worth the name.
Website100%all good
Name lookup100%all good
Browser protections100%all good
Domain & certificate100%cert 89d · domain 364d
all goodneeded a humanbefore watching began
First answer, from six cities, first reading
Los Angeles, US0.18s
São Paulo, BR0.23s
Helsinki, FI0.09s
Tokyo, JP0.33s
Sydney, AU0.33s
Lagos, NG0.14s
Everything watched
Held to the same standard we hold every member to. Trends appear at the second
reading; inventing them from one data point is exactly what this product refuses to do.
www variantanswers alongside the bare domainall good
Plain httppolitely forwarded to the secure address (fixed 25 Aug, and logged below)all good
Reachability
Name lookupthe address resolves cleanlyall good
Second opinionan independent resolver agreesall good
Modern networksreachable over IPv6all good
Email
Email recordsno email is sent from this domain yet; SPF, DKIM, DMARC and mail routing arrive with the mailbox, and this row will hold them to itnot set up yet
Browser protections, all six by name
Insist on the padlockthe browser remembers to only ever use the secure connection (HSTS)on
Refuse to be framedno other site can wrap this one in an invisible frame to steal clickson
No file-type guessingthe browser takes files at their word instead of guessing (nosniff)on
Content rulesthe page declares what it is allowed to load, and the browser enforces it (CSP)on
Referrer courtesywhen someone follows a link away, only the site name travels with them (Referrer-Policy)on
Feature permissionsthis site will never ask the browser for the camera, microphone, or location (Permissions-Policy)on
Trust signals, optional but worth knowing
Note for researchersa standard file telling security researchers who to contact (security.txt)present
Certificate rules (CAA)a record naming which authorities may issue certificates for this domainnot set up, optional
Signed name lookups (DNSSEC)cryptographic proof that DNS answers were not tampered withnot set up, optional
Machine endpoints
robots.txtthe file that tells search engines the rules200, plain text
Domain registrationpaid through 24 August 2027364 days away
Reading log
Our own mistakes go here first. A status page that hides its own findings is
not worth trusting with yours.
24 Aug, eveningsteadywatch.org registered, homepage deployed, and the three founding member status pages went live on their own domains.
25 Aug, 1:30 AMA full audit found these pages serving none of the browser protections they grade other sites on, and the content policy silently blocking the page analytics. Both fixed and verified within the hour.
26 Aug, 11:15 AMRenamed from SteadyWatch to StatusPost, because the old name was repeatedly misheard as "study watch". The site moved to statuspost.org in a V2C-owned account; steadywatch.org now permanently redirects, so no link ever shared has broken.
25 Aug, 2:05 AMA second look found plain http serving the page instead of forwarding to the secure address. The forward is now in place. Both findings are also in the RSS feed.
Follow these updates:RSS feed·add it to Slack:/feed subscribe https://status.status.statuspost.org/feed.xml
Watching the watchman is not a gimmick; it is the deal. Every rule a member page
follows, this page follows, including the embarrassing parts.