Status page vs incident page explained: one shows always-on service health, the other is the timeline for a single outage. When to use each and how they work together.
By H. Marcell, Freelance Software Developer
Updated July 17, 2026
H. Marcell is a freelance software developer who builds and runs web services and APIs, and writes about uptime monitoring, incident response, and status-page communication.
People use "status page" and "incident page" interchangeably, but they do different jobs. This guide draws the line: the status page is the always-on view of whether your services are healthy right now; the incident page is the focused, time-ordered record of one specific outage. Understanding the difference keeps your public communication easy to scan.
The status page serves the customer who wants a fast yes/no on whether a service works — they glance, get their answer, and leave. The incident page (or incident timeline) serves the customer who is actively affected and wants to follow along: what happened, what you are doing, and how it progressed. The same person may want both at different moments, which is why the two live together but stay visually distinct.
In practice, the status page is the front door and the incident timeline is the story behind a specific door that is currently red. A component shows "degraded"; clicking through reveals the incident with its chronological updates. Keeping component state and incident narrative separate lets each do its job: the component answers "now," the timeline answers "what is going on."
Use the Sandglass status page for live component state, backed by checks, so it is always current. When an incident occurs, its updates attach to that incident as a timeline — investigating, identified, monitoring, resolved — without cluttering the at-a-glance component view that customers rely on for a quick answer.
Combining every investigation note into the public status page makes it harder to scan when users only need current availability. The person checking "is checkout down?" should get that answer in one glance, not have to read through a running log of engineering hypotheses.
Decide which failures in this topic actually reach customers before adding any monitoring.
Match each risk to a single HTTP, content, TCP, SSL certificate, or heartbeat check instead of stacking duplicates.
Give each alert one owner and one destination — email, a Slack webhook, or a generic webhook.
Revisit intervals, thresholds, and ownership once a real incident shows what was missing.
Free plan, no credit card required.