Uptime Kuma is great. Here's what it can't tell you.

Uptime Kuma has four limits that matter once it’s monitoring a business rather than a homelab: it runs on your own infrastructure, so a provider outage takes the monitor down with the app; an HTTP 200 says nothing about disk, CPU, or failed backups inside the box; it sends notifications but has no on-call rotations, escalation, or acknowledgements; and a perfect uptime graph says nothing about whether the server is compromised.

None of this is a knock on the tool. Uptime Kuma might be the most-recommended tool in self-hosted communities, and the recommendation is earned: one Docker command, a genuinely pleasant dashboard, dozens of notification providers, and no bill. For a homelab it’s close to perfect. But a pattern repeats: the tool that was perfect for the homelab quietly becomes the uptime monitoring for a business - the side project that got customers, the agency’s client sites, the startup’s production. At that point its limits stop being trivia. They’re worth knowing while it’s still a calm Tuesday.

1. The watcher shares fate with the watched

Kuma runs on your infrastructure - frequently on the very host, VPS provider, or network it monitors. When that layer fails, the monitoring fails with it, and a dead monitor is silent in exactly the way “everything is fine” is silent. The canonical failure: provider outage takes your app and your Kuma instance down, and the first notification comes from a customer.

Self-hosters patch this with a second Kuma watching the first from elsewhere - at which point you’re administering a monitoring estate, and the “who watches the watcher” recursion has begun. External monitoring isn’t a premium feature; it’s the definition of the job. The check has to come from infrastructure whose failures aren’t correlated with yours.

2. Up-or-down is the shallowest question

An HTTP 200 means the load balancer answered. It does not mean the disk isn’t at 97%, a process isn’t eating every core, the nightly backup ran, or the certificate renews before Saturday. Kuma covers some of this surface (cert expiry, keyword checks) but it fundamentally sees your servers from the outside - a status light, not a diagnosis. The questions that determine whether tomorrow has an outage are inside-the-box questions, and answering them takes an agent on the host, not a probe at the URL.

3. “Send a notification” is not “wake the right human”

Kuma posts to Telegram, Slack, or fifty other places. It lacks the layer that makes notifications survive contact with a team: on-call rotations, escalation policies, acknowledgements. Who is on duty? Who escalates if the first person does not ack in ten minutes? Did the 3 AM ping land in a muted channel? With one operator, these are trivia. With three, they determine whether an alert becomes an outage report. Bolting an escalation layer on top of Kuma adds another tool. That is how the DIY pile starts.

4. Up is not the same as safe

A server hosting a crypto miner shows a perfect uptime graph - miners are careful about that. A compromised box with an attacker’s SSH key in authorized_keys returns 200 on every check for months. Uptime monitoring and security monitoring are different senses, and no uptime tool - Kuma included, AlertKick included - substitutes for knowing who logged in, what changed on disk, and what your hosts are talking to. If the box matters enough to monitor, it matters enough to watch from the kernel.

5. The maintenance is real, just deferred

Kuma updates, database growth, backups of the monitoring itself, TLS on the dashboard, the reverse proxy in front. Each task is trivial. Together they are a standing tax on your attention. The software is free. The operator is not.

Keep Kuma. Or graduate deliberately.

If the stakes are homelab-sized, keep Kuma. The graduation moment is when the answer to “what happens if this is down for four hours and nobody notices?” involves money or customers.

AlertKick’s shape for that moment: external uptime checks and heartbeats from managed infrastructure (whose failures don’t correlate with yours), the agent answering the inside-the-box questions, rotations and escalation built in, and eBPF security covering the up-but-owned scenario - one platform instead of a pile. The free tier covers 10 monitors and heartbeats with no card, and unlike most free tiers, commercial use is allowed - so the graduation doesn’t have to start with an invoice.

Start free, point it at the things Kuma watches, and let the two run side by side. The comparison that matters is which one you trust the week something actually breaks, not the feature lists.