We needed to confirm that a site had seven documents on it — terms, acceptable use, privacy, a contact page and a few others — because a payment provider was asking to see them before it would approve the account.
Every address returned HTTP 200. All seven were there.
Then, out of habit, we asked for a page that could not possibly exist. That returned 200 as well.
What was actually happening
The site is a single-page application. Its server answers every request with the same shell, and the application decides in the browser what to draw. That is a completely normal way to build a site.
The consequence is that the server will confirm the existence of anything you ask for. The seven policy pages each returned a success code and eight characters of content — the site name, and nothing else. The documents had never been written.
A health check that cannot fail is not a health check.
Why this is worse than being down
Had those pages 404ed, it would have been obvious in a second. Instead every automated signal said yes.
And the stakes were not theoretical. Submitting those links to the reviewer would have been worse than submitting nothing: they open them, find an empty application, and now you have answered a compliance question with pages that are not there.
The general case
“Up” and “working” are different questions, and almost all cheap monitoring answers the first:
- A form that loads perfectly and silently discards submissions.
- An API returning 200 with an empty results array because a filter is wrong.
- A scheduled export that writes a file every night, containing only headers.
- A search page that renders correctly and matches nothing.
- An inbox that accepts mail and routes it to a rule nobody owns.
What to check instead
- Ask for something that should not exist. If you get a success, your check proves nothing.
- Assert on content, not on status. “This page contains the word Refund” catches what “this page returned 200” never will.
- Check a number you can predict. A page of policy should be thousands of characters, not eight.
- Look at it the way the person who matters will. A reviewer, a customer, a regulator — not your dashboard.
We found it in about thirty seconds, by asking for a page that should not be there. It is the cheapest test there is and almost nobody runs it.