The reality: A 200 OK on your homepage does not mean users can log in. The fix is a real-browser login monitor that signs in as a test user and asserts the post-login page rendered. Start for free.
Login is the single page in your SaaS that breaks the most ways and shows up the least in standard monitoring. Your homepage and your marketing pages are static, cached, and boring. Your login page touches an auth provider, a session store, a CSRF token, a cookie domain, a redirect chain, and often a CAPTCHA. Any one of them can fail while the homepage stays green. Standard uptime monitors point at the homepage and report all clear. The first signal something broke is a support ticket from a frustrated user who cannot get in.
This walks through what actually breaks in a SaaS login flow, how the major auth patterns fail, and how to set up a free browser login monitor that signs in as a real user every 15 minutes from the region of your choice and tells you the moment login stops working. For the broader founder-grade picture, see the uptime monitoring guide for SaaS founders .
Why your homepage being up tells you nothing about login
No, a 200 OK on your homepage does not mean your login page is working. Per RFC 9110 section 15.3.1, a 200 OK status code means the request succeeded, not that the content is correct. A login page that renders an error message in the body, or a redirect that lands the user back on the login page instead of the dashboard, still returns 200 OK. That is why status-only uptime monitors miss most SaaS login failures. A browser login monitor can assert what is actually on the page.
The spec language is unambiguous ( RFC 9110 section 15.3.1 , verified 2026-05-02): "The 200 (OK) status code indicates that the request has succeeded." Nothing about the body being useful. Nothing about the user being able to do anything with what came back. The request succeeded. Period. That is the entire guarantee. We unpack the broader pattern in why uptime monitors miss outages .
On a SaaS login page, four code paths run independently and any one can fail. The auth provider can return a fresh error code that your callback does not handle. The session store can lose Redis connectivity and silently fail to write. The redirect chain can loop if a cookie domain attribute drifts after a deploy. The CAPTCHA challenge can fail to load if Cloudflare Turnstile has a bad afternoon. Each of those leaves the homepage perfectly fine and the login page in a state your status monitor cannot describe.
Real SaaS auth incidents standard monitoring missed
Three recent incidents make the case better than any abstraction. All three left homepages returning 200 OK while real users could not sign in.
Cloudflare November 18, 2025: Access auth and Turnstile both broke
Cloudflare's November 18, 2025 outage post-mortem ( Cloudflare blog , verified 2026-05-02) documents two auth-killing impact windows. Access authentication failures were widespread from the start of the incident through the 13:05 UTC rollback. Turnstile failed to load entirely from 11:30 to 13:10 UTC and again from 14:40 to 15:30 UTC. Any SaaS using Cloudflare Access for SSO or Turnstile as a CAPTCHA on its login form watched that login form silently break for hours. Cloudflare's own framing: "all failed authentication attempts resulted in an error page, meaning none of these users ever reached the target application."
Slack October 19-20, 2025: login plus 2FA email failed together
Slack's October 19, 2025 status post ( Slack status , verified 2026-05-02) reported a multi-hour outage that started around 12:13 PM PDT on October 19 and resolved at 3:51 PM PDT on October 20. The impact list named login and SSO together with the delivery of two-factor authentication emails. Two attack surfaces at once: users who already had a session were probably fine, users whose session expired during the window could not get back in, and users who had to verify a 2FA email could not complete the flow at all because the email never arrived. The root cause was an upstream cloud infrastructure vendor.
Where email and password login breaks
Looks the simplest of the auth patterns. It is not. Six things can break in a SaaS email-and-password login flow, and any of them leave the homepage green:
Password hash backend down. If your auth code calls a database to verify the bcrypt or argon2 hash and the DB connection pool is exhausted, every login fails with a 500 the status monitor never sees. Session store unreachable. Your handler accepts the credentials, signs the user in, and tries to write the session to Redis. Redis is down. The session never persists. The user is bounced to login on the next request. Session cookie domain or SameSite drift. Per RFC 6265 section 5.3 (verified 2026-05-02), browsers reject cookies whose domain attribute does not include the origin server. Move from app.example.com to dashboard.example.com without updating the cookie scope, or flip a SameSite attribute from Lax to Strict during a framework upgrade, and every login silently drops on the next page load. CSRF token mismatch. A cache layer that strips or alters the form's CSRF input. Login submits, server rejects, user sees an opaque error, support ticket. CAPTCHA failure. Cloudflare Turnstile or reCAPTCHA cannot load (see Cloudflare November 2025 above). Login form blocks submission with no clear message. Subscription state out of sync. User logs in, billing state was supposed to flip to active when their last payment succeeded, the Stripe webhook never landed, the account page renders an expired view. Adjacent topic covered in monitor your Stripe webhooks .
OWASP's guidance on HttpOnly cookies (verified 2026-05-02) is a sane default for the session cookie itself, but it does not save you from a misconfigured domain attribute or a missing Secure flag.
What actually monitoring the login flow means
A real login monitor makes five assertions, in this order:
The login page loads and the form renders. The form accepts credentials and submits. The server-side redirect lands on the expected post-login URL. A session cookie is set with the right Secure and HttpOnly attributes. A piece of post-login content (the user's name, a logout button, the dashboard heading) renders only when authenticated.
A cURL request and an HTTP status check can do exactly one of those five (assertion one, sort of). A browser login monitor does all five because it runs a real browser, executes JavaScript, handles redirects, persists cookies, and reads the rendered DOM. That is also why it catches Turnstile failing to load, a CSRF token getting stripped by an over-helpful CDN, or a session cookie domain misconfiguration.
For things a status check can correctly cover (a JSON health endpoint, a public REST resource, a static page) see monitor a REST API health endpoint . That is the right tool for that job. It is the wrong tool for login.
How to monitor your SaaS login with Velprove
Six steps, ten minutes. Free plan, no credit card. The HowTo schema embedded in this page mirrors the steps below verbatim.
Create a low-privilege test account
Provision a dedicated test user inside your own SaaS with the smallest role you have. No billing data, no team membership, no admin permissions. If the monitor's credentials ever leak, the blast radius is one inert account. Never use your admin account, never use a real customer's account, never use a shared team-lead login.
Set up a browser login monitor pointing at your login URL
In Velprove, click new monitor, pick the Browser Login type, and paste your login URL. Supply the test account's email and password in the credential fields. Velprove drives a real browser for every check, types the credentials, clicks submit, and follows whatever redirect chain your auth produces.
Add a post-login assertion that proves you actually logged in
Pick a piece of text or a CSS selector that only renders when a user is signed in. Common picks: the user's name in the navbar, the dashboard heading, the logout button. The monitor passes only when that element is present after the redirect lands. This is the assertion that defeats the 200 OK trap. The login page can render an error message and still return 200; the post-login element will not be there, and the monitor will fail.
Pick regions and check interval
All five Velprove regions are available on every plan including free, but each browser login monitor runs from one region at a time. Pick the region closest to most of your users. The free plan runs your browser login monitor every 15 minutes; Starter unlocks 10-minute browser intervals and Pro unlocks 5-minute browser intervals. (HTTP and multi-step API monitors run at 5-minute / 1-minute / 30-second minimums on the same three tiers.) Fifteen-minute browser checks are plenty for any SaaS under a thousand active users.
Wire alerts to email, Slack, or a webhook
Email alerts are included on every plan, free included. Starter unlocks Slack, Discord, Teams, and outbound webhooks. Pro adds PagerDuty. Pick the channel that wakes the right person up, not the channel they already ignore.
Test the failure path by intentionally breaking credentials
Before you trust the monitor, prove it can fail. Temporarily change the test account's password in Velprove to a wrong value and confirm the monitor flips to a failed state and the alert lands in your inbox. Restore the correct password and the monitor recovers on the next check. A monitor you have never seen fail is a monitor you do not trust.
What standard uptime tools miss (and why this matters)
The reliable way to monitor a SaaS login is a browser-based monitor that opens a real browser, navigates to the login page, signs in as a low-privilege test user, and asserts the post-login page renders content only authenticated users see. A status-only HTTP monitor cannot simulate that flow and will miss most SaaS login failure modes.
Most uptime tools in this category charge for browser-based checks. Velprove includes one browser login monitor on the free plan with commercial use allowed, email alerts, and your choice of any of five regions, at a 15-minute interval. Two upgrade levers, depending on monitor type. HTTP and multi-step API checks step from 5 minutes free to 1 minute on Starter at $19 to 30 seconds on Pro at $49. Browser login monitors step from 15 minutes free to 10 minutes on Starter to 5 minutes on Pro, and the per-plan browser-monitor caps go 1, 3, 10. No team plans, no minimum seats, no "contact sales," no quote.
| Failure mode | Status-only HTTP monitor | Browser login monitor |
|---|---|---|
| Homepage 200, login throws 500 | Misses | Catches |
| Login page renders an error in the body (still returns 200) | Misses | Catches |
| Turnstile or reCAPTCHA fails to load | Misses | Catches |
| Session cookie domain drift | Misses | Catches |
| CSRF token stripped by CDN | Misses | Catches |
| Static marketing page is down | Catches | Catches |
Frequently asked questions
Can I monitor my SaaS login page for free?
Yes. Velprove's free plan includes one browser login monitor that simulates a real user signing in, running every 15 minutes from any one of 5 global regions. No credit card required, commercial use allowed.
What HTTP status code does a broken login page actually return?
Often 200 OK, which is the trap. Per RFC 9110 section 15.3.1, 200 OK means the request succeeded, not that the content is correct. A login page that renders an error message in the body still returns 200 OK. That is why status-only monitors miss broken logins. A browser login monitor can assert what is actually on the page after sign-in.
How is a browser login monitor different from a regular HTTP uptime check?
A regular HTTP check sends a request to a URL and reads the status code. A browser login monitor drives a real browser, navigates to the login page, fills in credentials, submits the form, follows redirects, and asserts that a logged-in element renders on the post-login page. It catches JavaScript-driven login forms, Turnstile or reCAPTCHA challenges, and session cookie misconfigurations that an HTTP check cannot see.
How often should I monitor my SaaS login page?
Every 5 to 15 minutes is enough for most early-stage SaaS. Below 1,000 active users, a 15-minute interval surfaces real failures within an acceptable alert cycle without generating false positives from transient backend hiccups. Velprove's free browser login monitor runs every 15 minutes; Starter unlocks 10-minute browser intervals and Pro unlocks 5-minute browser intervals. HTTP and multi-step API monitors run at 5-minute / 1-minute / 30-second minimums on the three tiers.
What credentials should I use for the monitor account?
A dedicated low-privilege test account. Never your admin account, never a real customer's account. Create a member-tier user with no billing data, no team membership, and no production access. If the monitor's credentials ever leak, the blast radius is one inert test account.
What is the cheapest way to know my login is broken right now?
Sign up for the free plan, create one browser login monitor, point it at your login URL, add a post-login text assertion, and pick whichever of the five regions is closest to your users. Total setup is under 10 minutes and costs nothing. You will know within 15 minutes the next time login breaks, instead of finding out from the support inbox.
Next step
Login is the page in your SaaS that fails the most ways and gets the least monitoring. Browser login monitors close the gap. Free plan, your choice of five regions, browser login monitor every 15 minutes, commercial use allowed, no card. Set up a free browser login monitor with Velprove . If you want the broader picture first, the uptime monitoring guide for SaaS founders covers where browser monitors fit alongside HTTP, API, and multi-step monitors.
