A defacement policy fetches the pages you list (paths on the asset's own host, / by default) from our isolated network, without cookies and without running JavaScript, and compares each with a baseline: the first successful fetch, or a state you accepted.
Alerts
- Defacement suspected (high): defacement wording, hidden spam text or link farms, obfuscated script patterns, a redirect to a host the page did not use before, a blank page, or a page whose title, structure and text were all replaced.
- New external resource: a script, frame or form now points to a host the baseline did not use. This is the pattern behind card skimmers. It is rated higher for frames, form targets, raw-IP or lookalike hosts, and for any new script on a page with a password or card field.
- Content changed: the share of changed text reached your sensitivity (low 60%, balanced 40%, high 20%). Smaller changes are recorded quietly.
What is ignored
Timestamps, "5 minutes ago", counters, CSRF tokens, CSP nonces, cache-buster query strings and script bodies do not count as changes. Add your own exclusions to a policy with ignored text (wildcards, for example Visitors today: *) or ignored patterns.
Review
Monitoring → Defacement shows what changed (added and removed text, new hosts, old and new title) and, per watched page, the baseline next to the current state.
- Accept current as new baseline makes the current page the new normal and closes its events (audited).
- Mark as expected change teaches the monitor: new hosts go on the policy's allow-list.
- Acknowledge only acknowledges.
Limits
Only the HTML your server returns is analyzed. Content that exists only in a visitor's browser (client-side rendering, tag managers) or only after login is not seen, and hiding through CSS files is not detected. A page is compared on its first 400 text blocks. This is a tamper and change detector, not a malware scanner.