Why "the site opens" does not see a defacement

A ping and a simple URL check do one useful thing: they say the machine on the other end is alive and the page returned an answer. That is enough for a hosting outage. It is not enough for foreign text on your domain. A defacement is convenient for the person who put it there: for the check the site "opens", for the visitor it is already someone else's.

Three situations a tick glues together

• The server does not answer. That is downtime. An availability check sees it.
• The server answers with the host's holding page or a short foreign page. For a visitor this is no longer your site. For a ping it is a successful answer.
• The certificate expired or the lead form points elsewhere. The page can still open while trust and orders are already gone.

Threat monitoring therefore does not collapse into "is the address alive". Beside that, someone looks at whether the page is still the one you agreed on. If it is not, the night is no longer about availability. It is about the first hours after a defacement.