Know when yourWireGuard|server goes down.

All 11: WireGuard, AmneziaWG, OpenVPN, OpenConnect, IKEv2, VLESS, VMess, Trojan, Shadowsocks, Hysteria2, and TUIC — including V2Ray/Xray share links and subscription JSON. URI-based protocols auto-detect from the scheme; config-based protocols take the full config (with credentials where needed).

We do the real handshake. For WireGuard we run a key exchange against the peer. For OpenVPN we negotiate TLS and auth-user-pass. For VLESS / VMess / Trojan / SS / Hy2 / TUIC we open the real transport and complete the protocol handshake. A reachable UDP port is not enough. A dead peer with an open firewall port still fails for us and alerts you.

Yes. That's the only way to run a real handshake. Credentials are encrypted at rest with AES-256-GCM and never logged. Best practice: use a dedicated monitoring peer with its own keypair, separate from your production client keys.

Each tunnel can be checked as often as every 5, 2 or 1 minutes, depending on the plan (Starter, Pro, Business). The first failed check opens an incident straight away. With the default 2 retries, the next failed check confirms the tunnel down, and the alert goes out at once: email, Slack, Telegram, Discord or any of the 20 channels.

30 req/min on Starter, 60 on Pro, 120 on Business. The same API covers instant checks, batch testing, server CRUD, incident management, and usage analytics. We also run an MCP server: Claude, ChatGPT, Cursor and VS Code connect by signing in, and can manage your fleet directly.

Not for new signups — instead, every plan now starts with a 14-day free trial: full plan features, all 11 protocols. You add a card at checkout, right after you create your account, and it isn't charged until day 15, and you can cancel anytime before that. Existing free workspaces keep their plan. Paid plans start at $12/mo.

The free tester runs one real handshake against a config you paste and keeps nothing. Monitoring runs that handshake as often as every 5, 2 or 1 minutes, depending on your plan, keeps the history, opens incidents, sends alerts, and works through the REST API, the CLI and AI assistants.

Yes. Our checker supports REALITY, XTLS-Vision, WebSocket + TLS, gRPC, and uTLS fingerprints for the URI-based protocols. Full handshake runs through whatever transport the URI specifies.

Yes, with Uptime checks. Website checks alert when a URL goes down or returns an unexpected status code, keyword checks when a page loses or gains a word, and ping, TCP port and DNS checks watch hosts and name servers. For a cron job or backup, a heartbeat alerts when the job stops checking in. Uptime checks sit in the same projects as your tunnels, alert through the same channels, and are free during the beta, without counting toward your tunnels.

Adding a tunnel past your plan's limit is refused, with a link to upgrade. The tunnels you have keep running. Uptime checks don't count toward it during the beta.

No. TunnelHQ is a managed service. If you need self-hosting, open-source monitoring tools exist, but none checks VPN protocols out of the box.

Use Bulk import: paste share links and configs, or upload .ovpn and .conf files, and each server becomes a tunnel. A V2Ray or Xray subscription URL brings in a whole fleet and keeps it in sync. You can also create tunnels through the REST API.