# Know when yourWireGuardserver goes down. We run the real protocol handshake, not a ping. 11 VPN protocols, alerts the moment a server is confirmed down. [Start Free Trial](https://app.tunnelhq.com/register) [Test a config free](https://tunnelhq.com/test/) Every plan is free for 14 days. Cancel before day 15 and you pay nothing. Every check runs the real handshake for these protocols ## Multi-protocol engine A port ping calls a VPN server healthy when nobody can connect. TunnelHQ checks at the protocol layer: wrong keys, expired preshared secrets, SNI blocks, REALITY misconfig, UDP shaping. ### Paste a link or a config TunnelHQ reads the protocol, host, port and keys, and fills in the tunnel for you. More: https://docs.tunnelhq.com/concepts/monitors/#paste-a-config-recommended ### 11 protocols From WireGuard and OpenVPN to VLESS, Hysteria2 and TUIC. ### Config, link or login WireGuard and OpenVPN take a config file, VLESS and Trojan a share link, IKEv2 and OpenConnect a host and login. More: https://docs.tunnelhq.com/protocols/ ### A real handshake on every check Each check brings the tunnel up. When one fails, you see which stage broke and why. More: https://docs.tunnelhq.com/concepts/monitors/#the-test-journey ## Instant alerts ### 20 alert channels Slack, PagerDuty, Telegram, email and more, plus signed webhooks. Turn one on for a whole project, or per tunnel or check. More: https://docs.tunnelhq.com/alert-channels/ ### Down, then back up One alert when a second check confirms the failure, another when the server recovers. More: https://docs.tunnelhq.com/concepts/incidents/#getting-notified ### Every incident keeps its log When it went down, how long it lasted, who acknowledged it and when it recovered. More: https://docs.tunnelhq.com/concepts/incidents/#the-activity-log ## Team workspaces ### Roles for everyone Invite teammates as Admins, Managers or Viewers. Viewers never see a tunnel's VPN credentials. More: https://docs.tunnelhq.com/team/ ### Groups Sort tunnels by provider, location or customer. Each group shows its worst status. More: https://docs.tunnelhq.com/concepts/monitors/#groups ### Credentials stay encrypted Keys and passwords are encrypted with AES-256-GCM before they reach the database. The free tester keeps nothing. ## Uptime monitoring Websites, APIs, hosts and cron jobs, in the same projects and alert channels as your tunnels. Uptime checks are free during the beta. ### Response times and availability Every check charts its response times and reports availability for the last day, week, 30 and 90 days. More: https://docs.tunnelhq.com/uptime/checks/#availability ### Five kinds of check Website, keyword, ping, TCP port and DNS, every 20 seconds to every 30 minutes. More: https://docs.tunnelhq.com/uptime/ ### One incident, one alert A failed check waits out its confirmation period, two minutes by default, and checks again. Only a second failure alerts. More: https://docs.tunnelhq.com/uptime/checks/#how-a-check-goes-down ### SSL and domain expiry Website and keyword checks warn up to two months before a certificate or domain expires. More: https://docs.tunnelhq.com/uptime/checks/#ssl-and-domain-expiration ### Heartbeats for cron jobs A job calls its heartbeat address each time it runs. A missed call, or one that reports a failure, sends the alert. More: https://docs.tunnelhq.com/uptime/heartbeat/ ## Developer API ### REST API 34 endpoints for tunnels, tests, incidents and usage, with an OpenAPI file. More: https://docs.tunnelhq.com/api/ ### MCP for AI assistants Claude, ChatGPT, Cursor and VS Code connect by signing in. You choose the project and the access. More: https://docs.tunnelhq.com/mcp/ ### Set up by your AI assistant One prompt finds the sites, APIs and jobs in your project, asks before adding them, and tests each one. More: https://tunnelhq.com/ai/ ### Signed webhooks Down, degraded and up, plus incident opened and resolved, each signed with HMAC-SHA256. More: https://docs.tunnelhq.com/webhooks/ ### thq CLI Test a config, link or subscription from your terminal, or add a tunnel. It saves nothing on a test and exits 1 on a failure, so CI can stop a bad config. More: https://docs.tunnelhq.com/cli/ ## Pricing Every plan runs the real handshake on all 11 protocols. Start with 14 days free. ### Starter For a small VPN service or a side project. $12per month Billed monthly [Start 14-day trial](https://app.tunnelhq.com/register?plan=starter&cycle=monthly) VPN tunnels 20 Tunnel checks Every 5 min Tested from Any checker Uptime checks Free in beta History 90 days Includes: - 3 team members, 3 projects - 5 alert channels - 3 subscription URLs - 50 on-demand tests a month - REST API, CLI and MCP server ### Pro Most popular For a VPN service with users in many countries. $39per month Billed monthly [Start 14-day trial](https://app.tunnelhq.com/register?plan=pro&cycle=monthly) VPN tunnels 100 Tunnel checks Every 2 min Tested from Up to 5 countries Uptime checks Free in beta History 1 year Everything in Starter, plus: - Pick the countries a tunnel is tested from - Unlimited alert channels - 10 team members, 10 projects - 10 subscription URLs - 500 on-demand tests a month ### Business For large fleets that need every minute covered. $99per month Billed monthly [Start 14-day trial](https://app.tunnelhq.com/register?plan=business&cycle=monthly) VPN tunnels 500 Tunnel checks Every minute Tested from Up to 12 countries Uptime checks Free in beta History 2 years Everything in Pro, plus: - Unlimited team members and projects - Unlimited subscription URLs - Unlimited on-demand tests - 120 API requests a minute ### Enterprise For fleets bigger than Business. Custom Talk to sales for a quote [Talk to sales](mailto:sales@tunnelhq.com?subject=TunnelHQ%20Enterprise) VPN tunnels Talk to us Tunnel checks Every minute Tested from Any number Uptime checks Free in beta History 2 years Everything in Business, plus: - Any number of test countries per tunnel Every plan includes - Real handshakes on 11 protocols - 20 alert channels - Uptime checks, free in beta - REST API, CLI and MCP - Encrypted credentials 14 days free on every plan. Your card is charged on day 15, and you can cancel any time before. [Compare every plan](https://tunnelhq.com/pricing/#compare) ## Questions ### What VPN protocols does TunnelHQ support? All 11: WireGuard, AmneziaWG, OpenVPN, OpenConnect, IKEv2, VLESS, VMess, Trojan, Shadowsocks, Hysteria2, and TUIC — including V2Ray/Xray share links and subscription JSON. URI-based protocols auto-detect from the scheme; config-based protocols take the full config (with credentials where needed). ### Do you actually do the VPN handshake, or just ping the port? We do the real handshake. For WireGuard we run a key exchange against the peer. For OpenVPN we negotiate TLS and auth-user-pass. For VLESS / VMess / Trojan / SS / Hy2 / TUIC we open the real transport and complete the protocol handshake. A reachable UDP port is not enough. A dead peer with an open firewall port still fails for us and alerts you. ### Do I need to give you my WireGuard private key? Yes. That's the only way to run a real handshake. Credentials are encrypted at rest with AES-256-GCM and never logged. Best practice: use a dedicated monitoring peer with its own keypair, separate from your production client keys. ### How fast are the alerts? Each tunnel can be checked as often as every 5, 2 or 1 minutes, depending on the plan (Starter, Pro, Business). The first failed check opens an incident straight away. With the default 2 retries, the next failed check confirms the tunnel down, and the alert goes out at once: email, Slack, Telegram, Discord or any of the 20 channels. ### What are the API rate limits? 30 req/min on Starter, 60 on Pro, 120 on Business. The same API covers instant checks, batch testing, server CRUD, incident management, and usage analytics. We also run an MCP server: Claude, ChatGPT, Cursor and VS Code connect by signing in, and can manage your fleet directly. ### Is there a free plan? Not for new signups — instead, every plan now starts with a 14-day free trial: full plan features, all 11 protocols. You add a card at checkout, right after you create your account, and it isn't charged until day 15, and you can cancel anytime before that. Existing free workspaces keep their plan. Paid plans start at $12/mo. ### How is your /test/ page different from paid monitoring? The free tester runs one real handshake against a config you paste and keeps nothing. Monitoring runs that handshake as often as every 5, 2 or 1 minutes, depending on your plan, keeps the history, opens incidents, sends alerts, and works through the REST API, the CLI and AI assistants. ### Can I test Shadowsocks or VLESS behind a censor-friendly transport? Yes. Our checker supports REALITY, XTLS-Vision, WebSocket + TLS, gRPC, and uTLS fingerprints for the URI-based protocols. Full handshake runs through whatever transport the URI specifies. ### Can TunnelHQ also monitor my website, API or cron jobs? Yes, with Uptime checks. Website checks alert when a URL goes down or returns an unexpected status code, keyword checks when a page loses or gains a word, and ping, TCP port and DNS checks watch hosts and name servers. For a cron job or backup, a heartbeat alerts when the job stops checking in. Uptime checks sit in the same projects as your tunnels, alert through the same channels, and are free during the beta, without counting toward your tunnels. ### What happens when I hit my tunnel limit? Adding a tunnel past your plan's limit is refused, with a link to upgrade. The tunnels you have keep running. Uptime checks don't count toward it during the beta. ### Can I self-host TunnelHQ? No. TunnelHQ is a managed service. If you need self-hosting, open-source monitoring tools exist, but none checks VPN protocols out of the box. ### How do I migrate from UptimeRobot or Better Stack? Use Bulk import: paste share links and configs, or upload .ovpn and .conf files, and each server becomes a tunnel. A V2Ray or Xray subscription URL brings in a whole fleet and keeps it in sync. You can also create tunnels through the REST API. Source: https://tunnelhq.com/