End user experience monitoring measures how a service performs from the user's side: how long pages take to load, whether requests fail, and how responsive the interface feels. It uses synthetic checks and real user measurements from browsers. Collect only what you need, because these signals can touch privacy.
What are the two ways to measure?
Real user monitoring records timings from actual visitors' browsers. Browsers expose standard interfaces for this. The W3C Navigation Timing specification defines how a page can read timing for navigation events, from the start of a page request through response and load completion. The W3C Resource Timing specification does the same for individual assets such as scripts, images and API calls.
Synthetic monitoring runs scripted visits from chosen locations at fixed intervals. It catches outages at three in the morning when no real users are online, and it gives repeatable baselines. It cannot reproduce the variety of real devices, networks and behavior.
You usually need both. Synthetic checks tell you something broke. Real user data tells you who is affected and how badly.
What should you measure?
- Load timing: how long until the main content appears, from navigation timing and related browser metrics.
- Errors: failed requests, script errors and failed transactions, such as a checkout that never completes.
- Responsiveness: delay between a click and a visible response.
- Availability by journey: not just whether the home page loads, but whether sign in, search and payment work.
- Breakdown by segment: browser, device, region and network type, because averages hide the users having the worst time.
Use percentiles, not averages. A median of two seconds can hide a tail where one user in twenty waits ten.
Constructed example: the slow checkout
A shop sees complaints but its server dashboards are green. Real user data shows that checkout page load in one region takes four times as long as elsewhere, and resource timing shows a third party script from a payment widget accounting for most of the delay. Synthetic checks from that region confirm it. The team moves the script to load after the main content and the regional gap disappears.
Server metrics could not have shown this, because the server was healthy. The problem lived between the user and the page.
What are the privacy and security concerns?
Monitoring scripts run in the user's browser, so they are part of your attack surface. A compromised monitoring script, or a vendor script you load, can read the page. Limit what you load, pin and review third party scripts, and use content security policy to restrict where scripts come from.
Data collected can include IP addresses, device details and URLs, which may contain tokens or personal data in query strings. Strip identifiers, avoid recording form contents, apply retention limits, and check the privacy rules that apply to your users. Do not capture screens or keystrokes unless users have been told and the law allows it.
Monitoring code is also software. Its dependencies and build need the same scanning as the rest of your application. Safeguard's dependency scanning and policies can cover the packages that go into a front end bundle, including a monitoring library.
How to check or apply this
- List the three to five user journeys that matter most, such as sign in and checkout.
- Add synthetic checks for each journey from the regions you serve.
- Collect real user timings with standard browser interfaces and sample if volume is high.
- Track percentiles by browser, device and region.
- Set alerts on journey failure and on tail latency, not only on averages.
- Remove personal data from URLs and payloads before storage, and set retention limits.
- Review third party scripts quarterly, and restrict them with content security policy.
Quick check
What is the difference between real user and synthetic monitoring?
Real user monitoring measures actual visitors. Synthetic monitoring runs scripted tests on a schedule. Synthetic finds outages early, and real user data shows who is affected.
Why use percentiles instead of averages?
Averages hide slow tails. Percentiles such as the 95th show what the unluckiest meaningful share of users experience.
Sources
Last reviewed: 18 October 2026.
