HTTP 401 means the target requires authentication before serving the requested resource. WebCheck does not turn a public monitoring target into an authenticated browser session or ask you to put passwords into a URL.
Where 401 responses appear
A login-protected dashboard, private API route or origin behind access authentication may return 401 to WebCheck. A login page itself can still be a valid public HTTP target if it is intended to be reachable without credentials.
What to check
- Confirm that the monitored path is meant to be public.
- Check whether a deployment or proxy rule added authentication unexpectedly.
- Review the response headers and application or gateway logs.
- Use a public, deliberately designed health endpoint when private dependencies need monitoring.
- Do not put passwords, access tokens or authorization headers into monitoring configuration.
Why changing the expected status is not always the fix
You can configure an expected HTTP status range, but accepting 401 may only confirm that an authentication wall exists. It does not prove that the protected application is healthy for an authenticated user.
Limitation
WebCheck public-page monitoring does not submit login forms, store arbitrary credentials or execute an authenticated checkout journey.