A change detector compares a representation of a website with an earlier or expected state. The representation matters: selected text, a screenshot and a server file contain different information.
Before relying on a check for defacement detection, establish what goes into the comparison. A change to information outside that input may not be observed.
Selected-text checks
Visual Sentinel's basic content-checking path fetches HTML, applies configured CSS selections and extracts text. Exclusions can remove irrelevant regions. The extracted text is combined and hashed to support change comparison.
That is not the same as comparing all HTML attributes or inspecting every script for malicious behavior. Changing an image source while keeping selected text the same may not change that text comparison. The default HTML fetch also does not execute JavaScript; text inserted only during browser execution may require another checking approach.
Verify the actual extracted result on your page. Do not assume that text extracted from HTML always matches what a visitor sees. Use the content setup guide for a controlled change and recovery workflow.
Screenshot comparisons
A screenshot records the captured page appearance under particular conditions. Comparing it with an approved capture can reveal a replacement page, an overlay or a changed layout.
Legitimate updates can change appearance, and some unauthorized changes may fall outside the captured view or comparison threshold. Review the evidence and the site's authorized change history.
The visual monitoring methodology explains the published fixture evidence. The bDifferent case study shows a documented real incident. Neither should be generalized into a promise to detect every compromise.
File-integrity observations
A file-integrity system compares files or their recorded properties within its configured scope. That requires access and setup appropriate to the system being observed. An external screenshot or selected-text check should not be presented as equivalent server-side file monitoring.
When evaluating a tool, ask which files or fields it covers, how expected updates are approved and where its evidence is retained. This article does not claim that Visual Sentinel provides a server file-integrity agent.
What a hash establishes
A hash comparison concerns the input supplied to it. A changed value can indicate a difference in that representation; it does not explain whether the change was malicious. Information that was not included in the input cannot be validated by comparing that hash.
For monitoring, the useful questions are therefore what was selected, whether extraction succeeded and what happened when you introduced a known change. Avoid treating a hash as a guarantee of site safety or ransomware prevention.
Combine observations with investigation
Choose checks that match the change you need to observe, test them on a page you control and assign an owner to the alert. When something unexpected appears, preserve the evidence and follow the investigation workflow.
Check current plan availability for your selected methods. A single expected-text setting is available on every plan. Must contain and must not contain rules require Starter or higher.
To keep an eye on your own site, see how Visual Sentinel checks a whole website, including pages that load but look broken.
Check your site while you read
Run a free check for regional reachability, response time, redirect handling, TLS evidence, and DNS resolution. No account is required.
Check a site freeCommon questions
Does selected-text hashing inspect every script and attribute?
No. It compares the selected extracted text.
Does a changed hash prove malicious activity?
No. It indicates a difference in the compared input, which still needs interpretation and investigation.
Can visual and text checks replace file-integrity monitoring?
They observe different representations and scopes.
