I use HetrixTools for uptime monitoring for both websites and servers (with their agent).

I don't use anything that scans for generic "vulns" (like "you're missing this header") and just use a WAF like Cloudflare for most stuff.