Monitoring Wix Client Sites for Agencies: SSL, DNS, and Custom Domain Failures

Wix has made a deliberate transition over the past several years from a DIY consumer website builder into a platform marketed directly to agencies and web professionals. Wix Studio, the agency-focused product layer, offers multi-site management, collaborative editing, and structured client handoffs. The result is a growing number of design agencies and marketing shops that run 10, 20, or more client sites on Wix infrastructure.

The monitoring surface that comes with that portfolio is different from managing WordPress or custom-built sites. Wix controls the hosting, the SSL provisioning, and significant parts of the DNS lifecycle — but none of that removes the agency's responsibility when a client site goes down. This post covers how Wix's platform actually behaves around SSL and DNS, where failures occur, and what a Wix-specific monitoring setup looks like in practice.

How Wix Handles SSL

Wix provides SSL automatically for all sites, including those served on Wix's own subdomains (username.wixsite.com) and those with connected custom domains. For custom domains, Wix provisions certificates through Let's Encrypt once two conditions are met: the domain is connected in the Wix dashboard and DNS has propagated correctly to Wix's servers.

That sequence is where most SSL problems originate.

The certificate is not provisioned until DNS is correct. Wix does not pre-provision a certificate and wait for DNS to catch up. It checks that the domain is resolving to Wix infrastructure and then initiates the Let's Encrypt certificate request. If DNS is not fully propagated when Wix makes that check, the provisioning attempt fails — and the failure mode is often silent. The domain shows as connected in the Wix dashboard, but the certificate was never issued, and visitors see an insecure connection warning.

DNS drift breaks the certificate. Let's Encrypt certificates expire every 90 days. Wix renews them automatically, but the renewal process requires that DNS still resolves correctly to Wix's infrastructure at the time of renewal. If a client has made changes to their DNS records between the original certificate issuance and the renewal attempt — even partial changes — the renewal can fail. The site continues to serve content over the expired certificate until browsers begin blocking it.

Domain expiry ends everything. When a client's domain registration lapses, the registrar typically parks the domain and overwrites DNS records. Wix's certificate is gone, the site is unreachable on the custom domain, and the client's domain may be picked up by a third party during the grace period. This is one of the more severe failure modes because the path back to a working site involves domain recovery, DNS reconstruction, and SSL reprovisioning — all of which take time.

DNS Configurations Agencies Need to Watch on Wix Clients

The standard Wix custom domain DNS setup requires two records: a CNAME record for www pointing to Wix, and an A record (or Wix-specific alias record) for the apex domain. Wix's own DNS documentation specifies exact target values, and both records need to remain stable for the site to stay live.

In practice, agencies managing Wix client portfolios encounter DNS drift from several predictable sources:

Client registrar access. Many Wix clients retain access to their domain registrar, often through billing relationships established before the agency engagement. Clients who open their registrar portal to update billing information sometimes also change DNS records — accidentally or because another provider suggested it. The site breaks and the agency finds out from a client call rather than an alert.

Registrar migrations. A client moving their domain from one registrar to another expects the process to be transparent. DNS records are supposed to carry over, but the actual transfer frequently drops records, resets TTLs, or introduces subtle errors. The CNAME for www that pointed to Wix gets replaced with a generic CNAME or removed entirely. The site goes down within hours of the transfer completing.

Domain auto-renew failures. Domains that fail to auto-renew because of expired payment methods enter a grace period, then a redemption period, then expiry. At each stage, DNS behavior changes. Wix's hosting continues to be configured correctly from their side, but the domain is no longer pointing at it.

Third-party DNS manager conflicts. Some clients use Cloudflare, AWS Route 53, or other DNS managers in front of their registrar. Proxy settings in Cloudflare, in particular, can interfere with how Wix resolves SSL — Cloudflare's proxy terminates TLS before it reaches Wix, creating certificate chain conflicts that are difficult to diagnose without knowing the full DNS path.

What Wix Platform Incidents Look Like

Unlike self-hosted infrastructure, Wix clients run on shared platform infrastructure. Wix publishes status information at status.wix.com, and the incident history there shows the kinds of failures that affect all hosted sites simultaneously: CDN disruptions, editor availability issues, domain resolution failures, and SSL errors that affect specific regions or hosting zones.

For agencies, a platform-level Wix incident has a specific character that makes it different from a single-site failure. When Wix has an infrastructure event, it may affect multiple client sites at the same time. An agency without vendor status monitoring receives several simultaneous client calls, has no immediate explanation for why multiple sites are down at once, and spends the first 30 minutes of the incident investigating problems that are entirely outside their control.

Vendor status monitoring changes that response. If your monitoring setup is tracking Wix's status page alongside your individual client sites, you know within minutes whether a cluster of simultaneous alerts is the result of a platform-level incident or independent failures. That information determines whether you investigate client-side configuration or communicate the platform status to affected clients while waiting for Wix to resolve the issue.

The Subdomain Problem on Wix

Most Wix sites operate on the apex domain and www. But agencies that configure additional subdomains for client sites — a blog at blog.clientsite.com, a store section at shop.clientsite.com, or a booking tool at appointments.clientsite.com — create independent SSL and DNS chains that need independent monitoring.

Each subdomain requires its own DNS record pointing to the appropriate Wix infrastructure, and Wix provisions a separate certificate for each. If the DNS record for a subdomain drifts or the certificate on that subdomain fails to renew, the failure is isolated to that subdomain. HTTP uptime monitoring on the root domain returns a 200 while the subdomain is returning an SSL error — and the agency's generic monitoring shows nothing wrong.

This is a common blind spot in Wix agency monitoring setups. An agency that adds subdomains for e-commerce, booking, or content purposes needs explicit monitoring on each subdomain, not just the main domain.

Monitoring Approach for Wix Agencies

An effective Wix agency monitoring setup requires monitoring at multiple layers, not just a single HTTP ping per client.

Monitor the connected custom domain, not the Wix subdomain. The username.wixsite.com address always resolves correctly because it bypasses the custom domain DNS layer entirely. Monitoring the Wix address tells you nothing about whether the client's actual domain is working. Every check should target the custom domain.

Monitor SSL certificate expiry on both the apex and www. Wix provisions separate certificates for the apex and www versions of a domain. Both need to be monitored. Set an expiry threshold at 30 days — Wix renews automatically well before expiry, but a 30-day threshold shows you when the automatic renewal has failed with enough runway to investigate and resolve it before the browser warning appears.

Monitor the DNS A record and CNAME for changes. The A record for the apex and the CNAME for www should remain stable between your monitoring checks. Any change to either should trigger an alert to your internal team immediately. DNS change monitoring is the layer that catches registrar migrations, accidental client edits, and renewal-related DNS disruptions before they turn into full outages.

Monitor domain registration expiry. Domain expiry is a separate failure layer from DNS drift, but it produces similar results and is entirely preventable. Domain registration monitoring with an alert threshold at 60 days gives agencies enough time to notify clients and coordinate renewal before the domain lapses.

Monitor Wix as a vendor. Add Wix to your vendor monitoring setup so platform-level incidents are flagged to your internal team in the same interface where you see client-specific alerts. The distinction between a platform incident and a client-specific configuration problem changes your entire response workflow.

What a Wix Agency Monitoring Setup Looks Like in Merlonix

For each Wix client domain in Merlonix:

Add the custom domain as an asset and enable SSL certificate monitoring with a 30-day expiry alert threshold. Both the apex and www should be tracked separately.
Enable DNS change monitoring on the apex A record and the www CNAME. Configure immediate alerts on any detected record change so your team is notified before the change propagates fully and takes the site down.
Enable HTTP uptime checks on both the apex and www URLs for the client's domain. Verify that redirect chains are returning the expected destination without intermediate errors.
Add any additional subdomains (blog, store, appointments) as separate monitored assets with their own SSL and DNS checks.
Add Wix as a vendor in your vendor monitoring setup so platform status is visible alongside client-level checks.
Configure per-client alert routing so alerts for a specific client go to the team member or client Slack channel responsible for that account.

For agencies moving clients onto a maintenance retainer after a Wix build, this monitoring configuration is one of the clearest deliverables to include. The value is concrete: the agency knows before the client knows when something is wrong, and the alert history provides documentation of what happened and when. That changes the client relationship from reactive firefighting to proactive management.

The Agency Monitoring Guide covers how to structure onboarding for new clients across platforms, including Wix, and how to present monitoring as a line item in a retainer agreement.

Merlonix is built for agency portfolio monitoring — SSL expiry alerts, DNS change detection, domain registration monitoring, vendor status tracking, and per-client alert routing. Start a free trial and add your first Wix client domain.