Changelog

All notable changes to Hoppla are documented here. For detailed API changes, see the API documentation.

September 2026

• Breaking: webhook deliveries no longer carry the legacy X-Hoppla-Signature and X-Hoppla-Timestamp headers. Read X-Webhook-Signature and X-Webhook-Timestamp, which carry the identical values. See Webhooks
• MCP can now change things, not just read them. The first write actions on the AI integration: acknowledge an open incident (which stops the on-call escalation), post an update to an incident timeline or resolve it, snooze a single check for up to 7 days, run a check now instead of waiting for its schedule, schedule a maintenance window, publish a status page update, end a check's snooze early, turn a check on or off, open an incident by hand, edit or snooze/archive one, create and change monitors (including pausing them), and reschedule a maintenance window. Writes need a token scope ending in :write, target exactly one team, are rate-limited per action, and are recorded in your audit log — refused attempts included. It needs a token with the incidents:write scope, targets exactly one team, and is recorded in your audit log — refused attempts included. Every other MCP tool stays read-only, and nothing deletes. See MCP Server
• Fixed: the audit log's filter dropdown offered entity types it then refused to filter by — impersonation actions, cancellation and withdrawal requests, and MCP actions all appeared in the list and returned an error when picked
• MCP can now read every check type. Lighthouse scores, the GEO/AI-discoverability audit, Core Web Vitals, security headers, domain expiry, robots.txt, sitemap, redirect chains, mixed content, DNS blacklists, ping, TCP and application health were all visible in the dashboard and invisible to an AI assistant; one new tool covers all thirteen. Access-log analysis and the audit log are readable through MCP too — visitor IP addresses in the log's top-talkers view are withheld unless explicitly asked for, since they are your visitors' personal data
• MCP now works on the free plan's read-only API access, and for a paused team. Both could previously call nothing at all — not even to list the available tools — because every MCP request is technically a write even when it only reads
• Saving now confirms itself everywhere in the dashboard. Every screen that saves — account and team settings, monitors, notification channels, escalation policies, on-call schedules, team management — now shows a clear confirmation, and says so when something fails. Previously many screens saved silently, leaving you unsure whether the change had taken
• Migration now imports from eight providers: Oh Dear, UptimeRobot, Better Stack, Pingdom, Statuspage.io, StatusCake, Cronitor and Healthchecks.io. The wizard can shadow your existing provider before you switch over, and cron/heartbeat monitors come across too. StatusCake, Cronitor and Healthchecks.io are marked beta in the picker until each has been proven against a live account
• SSL checks now tell a distrusted certificate apart from a site that is simply unreachable, and read the TLS failure cause from the connection instead of inferring it from the error text
• A hostname that serves no HTTPS at all no longer shows a green SSL check
• Redirect checks name the broken apex that a redirect chain was hiding, instead of reporting the chain as healthy
• New DNSSEC check, with its status shown on the monitor's DNS tab
• Cron monitors can be given a readable name
• A monitor's URL can be changed after it has been created
• Check results now have a page per check type instead of raw JSON
• Monitor lists and detail pages show when a check run is queued or currently running
• Lighthouse results are calibrated against PageSpeed Insights (median of three runs, Lighthouse 13), and every result carries its runner context, an Agentic Browsing score and a page profile
• robots.txt checks explain why they warned instead of only reporting "issues"
• Status pages: per-page control over search-engine indexing, and the public page and its robots.txt now refresh as soon as you change the page
• White-label: the dark logo renders in dark mode, and a link to a reseller portal now produces a proper preview when shared
• Reseller plans repriced, with Pro capped at 250 monitors
• Self-hosted: Lighthouse and DNSBL checks now ship, and scheduled maintenance tasks (including result pruning) actually run — they were dormant on every self-hosted install before this
• Security: 24 dependency advisories patched
• Alerting reliability: an incident can no longer be paged twice by overlapping escalation runs, and a check job that never ran is no longer recorded as a failed job
• API reference: restored 34 error responses that were being suppressed, and documented what POST /site-audits/claim returns on success
• Fixed: enabling, disabling or deleting a notification channel, escalation policy or on-call schedule could fail without reporting anything, so a failed change looked exactly like a successful one
• Fixed: removing a custom SMTP configuration could fail silently and leave the old settings in place

August 2026

• Result history extended: Starter now keeps six months of check results (previously three), and reseller accounts two years (previously one). Pro is unchanged at one year
• GEO Audit: recognises the anthropic-ai crawler token the way sites actually write it, and no longer discards robots.txt directives, figures containing non-breaking spaces, or a character set declared only in the HTTP header

July 2026

• New guide: Monitoring behind a firewall or WAF — how to allowlist Hoppla in Cloudflare (and other WAFs) so security rules don't block your checks
• SSL checks: a connection timeout to your site (for example a firewall temporarily blocking the probe) is now reported as a non-paging warning instead of a false "certificate invalid" incident — reachability is measured by the uptime check

June 2026

• Monitor templates (check presets): save a reusable set of checks and pick it when adding a monitor — you supply only the URL, the template decides the checks. Set a team default; resellers can pre-load a check policy for the teams they provision. See Monitor Templates
• Account-security emails and the active-sessions list now show the real visitor IP address when running behind a proxy/CDN, instead of an internal address
• AI access via a built-in MCP server: connect Claude and other AI assistants to your monitoring data (read-only) — 24 tools, and a single token can reach every team you belong to
• Redesigned API keys: clearer, type-prefixed tokens (e.g. sk-…) shown once at creation and masked in the list afterwards
• Escalation policies and on-call schedules: multi-step escalation with rotations, time windows, and automatic "who's on call right now" routing
• New Operator and Viewer team roles, plus active-session management, organisation-wide 2FA enforcement, and "remember this device"
• Deleting a monitor now preserves its history in reports while removing it from live dashboards and uptime numbers
• Core Web Vitals monitoring (field data from the Chrome UX Report) alongside Lighthouse lab audits
• A status-first dashboard overview and a mobile bottom-tab navigation
• Zone-aware DNS checks: Hoppla now detects the authoritative zone apex, reads records directly from the zone's authoritative nameservers, and tracks propagation across resolvers
• Added CAA to the monitored DNS record types (A, AAAA, MX, CNAME, NS, TXT, CAA)
• Added authoritative nameserver-change detection with alerting, plus a new dns.nameserver_changed reseller webhook event

May 2026

• Added migration tooling to import monitors from Oh Dear and UptimeRobot, including a guided /migrate flow
• Added white-label reseller branding: custom brand name, alert prefix, logo, colors, and per-reseller SMTP
• Status pages gained a three-way visibility model -- Public, Unlisted (secret link), and Private

April 2026

• Added the GEO Audit check, scoring a page's readiness for AI/LLM citation
• Added TCP port and ICMP ping checks for network-level monitoring
• Added security headers, mixed content, redirects, sitemap, and robots.txt checks

March 2026

• Added knowledge base with full English and German documentation
• Added agent monitoring for server metrics (CPU, memory, disk)
• Added partner application workflow for reseller program

February 2026

• Added broken link crawler with Cloudflare WAF retry handling
• Added DNSBL blacklist monitoring
• Improved notification templates for incidents and warnings
• Added safe URL validation for redirects

January 2026

• Launched reseller platform with API, impersonation, and webhooks
• Added status pages with custom domain support
• Added maintenance window scheduling
• Introduced audit logging for team activity

December 2025

• Initial release with uptime, SSL, DNS, cron, and Lighthouse monitoring
• Multi-tenant architecture with PostgreSQL Row-Level Security
• Dashboard with real-time WebSocket updates