Skip to content
Security skills

Website security monitoring for scripts, headers and SSL

Most tampering doesn’t change how a page looks. Monity checks what it runs and how it is served on every check, and alerts you to new script origins, injected code, header changes and expiring certificates.

Free plan, no card. Or grade your security headers now for free.

  • On the free plan
  • No code to install on your site
  • Alerts on change, not noise

Signs of tampering

Most attacks on a website don’t change how it looks.

A defaced homepage is obvious. A script injected from a new domain, an iframe pointing somewhere unexpected or a base tag rewritten to send links off-site is not, and it is what most compromises look like. On every check, Monity reads the page in a real browser and compares its scripts and markup with the check before, so a new script origin or injected code is an alert, not a discovery months later.

  • Scripts from origins the page has not used before
  • Inline code that decodes or hides what it does
  • javascript: and data: iframes, base-tag hijacks, meta refresh to javascript:

Protection that quietly weakens

Security headers, compared on every check.

A CDN change, a new reverse proxy or a framework upgrade can drop your Content-Security-Policy or HSTS header without anyone noticing, and the site works exactly as before. Monity records the security headers the page is served with and alerts you when one is added, removed or changed.

  • Content-Security-Policy, Strict-Transport-Security, X-Frame-Options
  • X-Content-Type-Options, Referrer-Policy and Permissions-Policy
  • A security score out of 100, if you want a number to hold

One task, three watches

Certificate, domain and payment scripts on the same check.

Add the SSL certificate & domain watch to the same task and you also hear before the certificate or the domain expires and when the nameservers change. On payment pages, the Script & connection watch keeps an inventory of every script and data destination for PCI DSS 6.4.3 and 11.6.1. Each alert says which watch raised it.

  • Security signals and the SSL watch are on every plan
  • The Script & connection watch is on paid plans
PCI DSS script monitoring

Alert rules

The rules, and what each one catches.

Security signals and the SSL certificate & domain watch are on every plan. These are the defaults a new task starts with; each rule can be switched and tuned per task.

Security signals

Every plan, free included

Options Trusted script origins: a list of origins that never count as new

Rule New tasks Default What it catches
New injection signals On Any new signal A script from a new origin, suspicious inline code, an iframe or base tag pointing somewhere unexpected, or a Content-Security-Policy that was removed.
Security headers changed On Any change Content-Security-Policy, HSTS, X-Frame-Options or another security header was added, removed or changed.
Security score below Off 70/100 The security score for a check, from injection signals and header hygiene together.

SSL certificate & domain watch

Every plan, free included

Options Check the domain registration (RDAP): on · Check DNS (nameservers, MX, addresses, CAA): on

Rule New tasks Default What it catches
Days until the certificate expires On 14 days Automated renewals normally happen 30 days before expiry, so a certificate this close to it is one whose renewal failed.
Certificate invalid, expired or for the wrong host On Once, while it lasts Browsers show a full-page warning instead of the site. Alerts once while it lasts.
Certificate authority changed On Any change The certificate now comes from a different authority. Expected when you switch providers; otherwise worth a look.
Days until the domain registration expires On 30 days From the registry’s own record (RDAP). An expired domain takes the site and its email with it.
Nameservers changed On Any change Expected when you move DNS providers; otherwise it is how a domain hijack starts.
Mail servers changed Off Any change The domain’s MX records changed, so its email goes to different servers.
IP addresses changed Off Any change The host resolves to different addresses. Off by default: CDNs rotate addresses routinely.
Outdated TLS version Off Once, while it lasts The server negotiates TLS 1.1 or older, which browsers refuse and PCI DSS forbids.

Monity is not a vulnerability scanner, a firewall or a malware clean-up service. It watches your pages from the outside, the way a visitor’s browser sees them, and tells you when something that should not change does.

Examples

Ask for it in a sentence. Hear about the change nobody made on purpose.

Tell the assistant what to watch, or switch the skills on in a task’s settings. Alerts go to the channels you turn on for the task.

  • Watch northwind.example for injected scripts
    Slack · #security
    1 new injection signal (worst: critical severity) — Base tag pointing off-site. Found at 03:12, on a plugin update nobody had reviewed.
  • Tell me if the security headers on coastalcrm.com change
    Microsoft Teams · Platform team
    Security headers changed: Strict-Transport-Security "includesubdomains; max-age=31536000" → (none). A new CDN rule stripped the header; restored the same morning.
  • Warn me before the certificate on fieldnote.com expires
    Email · ops@fieldnote.com
    Days until the certificate expires: 6 days (threshold 14 days). The renewal job failed after a server migration.
  • Watch the client sites we host for tampering
    Discord · #client-sites
    Security headers changed: X-Frame-Options "DENY" → "SAMEORIGIN". An agency task per client site, all reporting to one channel.

Northwind, Coastal CRM and Fieldnote are example companies; the hosts are made up.

Free tools

Check a site now, then let Monity keep checking.

The free tools check once. Monitoring repeats the same checks on every visit and alerts you when something changes.

FAQ

Questions about website security monitoring

What does website security monitoring check?
On every check, Monity looks for signs of tampering in the page as a browser loads it (scripts from new origins, suspicious inline code, iframes and base tags pointing somewhere unexpected) and compares the security headers with the check before. With the SSL watch on the same task, it also tracks the certificate, the domain registration and the nameservers.
Is this a vulnerability scanner?
No. It does not probe your site for weaknesses or try to break in. It watches what your pages serve to visitors and tells you when that changes in a way that suggests tampering or weaker protection.
Do I need to install anything on my site?
No. Monity checks the page from outside, the way a visitor’s browser loads it. There is no script, plugin or agent to add.
What about defacement I can see?
That is Monity’s change monitoring: it compares each check with the one before and alerts when the page looks or reads differently. The security skills cover what changes without showing.
Will my own scripts and CDNs cause alerts?
Your own domain never counts as a new script origin, and you can list the origins you trust (a payment provider, a CDN) so they never do either. Header and certificate rules alert only on a change from the previous check.
Is it on the free plan?
Yes: Security signals and the SSL certificate & domain watch are on every plan. The Script & connection watch for payment pages needs a paid plan or the 7-day Business trial.

Related

Hear about the change nobody made on purpose.

Add Security signals and the SSL watch to the pages you care about, and Monity alerts you when scripts, headers or the certificate change.

Start free Talk to us
  • Free plan: 3 tasks, no card
  • 7-day Business trial
  • Every alert channel on every plan
Kamil, Alex and Martyna Median reply under 6 hours

Have a question?

Pricing, security, or scoping - pick a route and you will land in a real person's inbox.

S Talk to sales Pricing and scoping H Get support Help with a monitor D Book a demo 30-minute walkthrough