A client's website can respond successfully while showing visitors something the owner never approved. Monitoring availability answers whether the site responds. Reviewing page appearance and selected content adds evidence about what it serves.
For an agency, the practical challenge is keeping that evidence useful across many changing websites. Start with a small, repeatable process for each client before expanding coverage.
Choose pages with an owner and a purpose
Create a register with the client, monitored URL, business purpose, approved baseline date and person responsible for an alert. Include the homepage and the pages where an unexpected message, overlay or missing form would matter most. A single homepage check does not cover every page, device state or visitor experience.
Ask who can approve a redesign and who can investigate an unexpected change. An alert without a responsible person can sit unread even when detection works correctly.
Establish an approved baseline
Open each chosen page and confirm that the starting screenshot represents the intended experience. Record expected cookie notices, rotating promotions and other changing areas. Keep the capture conditions consistent when comparing images. Otherwise, normal differences can distract from the change you wanted to detect.
Visual Sentinel's visual monitoring compares captures over time. Its published methodology explains the reproducible fixture evidence and its limits. That evidence should inform your evaluation; it does not prove that every compromise will be detected.
Separate appearance from selected text
A screenshot can reveal an unexpected overlay or replacement page. A content check can help track a chosen text region. These checks answer different questions. Content inserted only after JavaScript runs may also need a different checking approach.
Test the specific change you care about on a page you control. Record the change, the next check result and the alert received. Do not test by changing a live client page without their permission.
Make alerts useful for the person receiving them
Include the site, changed URL and evidence in the investigation workflow. On receipt, compare the current page with the approved version, check the deployment history and determine whether the change was expected. Avoid automatically accepting a new baseline simply to silence an alert.
For planned redesigns, review the released page before approving the replacement baseline. For unexplained changes, follow your incident response process and preserve relevant evidence before restoring the site.
Show clients the work you performed
Report what you monitored, what changed, whether the change was expected and what action followed. A quiet reporting period means no qualifying change was observed by those checks; it is not a certification that the website was free of vulnerabilities.
The bDifferent case study provides a real example of why page appearance matters alongside availability. Use the documented example to explain the service without promising the same detection timing for every site.
Start with one client workflow, verify an alert, then choose a plan that fits the number of sites and visual checks you need. Solo supports 10 monitors and visual checks for one site, so an agency portfolio needs a capacity choice that fits its workload.
Run a website of your own? Read about keeping watch over your own website, so an alert tells you when something on it breaks.
Check your site while you read
Run a free check for regional reachability, response time, redirect handling, TLS evidence, and DNS resolution. No account is required.
Check a site freeCommon questions
Does an uptime check detect defacement?
An uptime check can report a successful response while the page contains unauthorized material. Appearance and selected-content checks provide additional evidence, with their own coverage limits.
Should every client page use the same threshold?
Review each page's normal changes and test a meaningful controlled change. One threshold can behave differently on a stable information page and a frequently changing storefront.
Does visual monitoring remove malware?
No. A change alert supports investigation. Removal, access recovery and fixing the underlying compromise belong to the site's incident response process.