---
title: Page integrity monitoring: catch defacement and injected scripts
description: An injected card skimmer, a login form that posts elsewhere or hidden spam links leave your page returning 200 OK, so uptime checks stay green. Page integrity…
canonical: https://watchfor.io/changelog/2026-09-25-page-integrity-monitoring
---

[All updates](/changelog/page/2#2026-09-25-page-integrity-monitoring) ✨ New Security Sep 25, 2026 · v 8.7.6

# Page integrity monitoring: catch defacement and injected scripts

An injected card skimmer, a login form that posts elsewhere or hidden spam links leave your page returning 200 OK, so uptime checks stay green. Page integrity compares your key pages with a baseline you accepted and alerts on new script sources, changed script code, hijacked forms, redirects, tamper words and weakened security headers, while your own builds stay quiet. Browser mode adds runtime scripts and screenshots. Accept changes in one click, or from your deploy pipeline via the API, MCP or SDKs. From the Starter plan.

Findings first, then every watched page against its accepted baseline.

Open a page to see what changed, then accept it if the change was yours.

## Why uptime checks miss it

A card skimmer next to your payment form or a login form that now posts to another site leaves the page answering 200 OK, so every uptime check stays green. You hear about it from a customer.

## What it compares

You choose the pages an attacker would pick, such as login and checkout. The first check records a baseline for each, and every later check is compared with it, so a change keeps showing until someone looks. It reports:

- a script from a host that isn't yours or trusted, or a vendor script that now serves different code;

- a form that submits to another site, or a redirect to a different host;

- tamper words such as "hacked by", plus any you add;

- a removed or weakened security header, such as CSP or HSTS;

- visible text that changed more than the page allows, and a burst of new external links.

Your own deploys stay quiet: renamed bundles on your own site never count as a new script source.

## Example

On Friday afternoon a compromised analytics vendor starts serving extra code on /checkout . The script keeps its address, but its contents changed, so the next check opens a critical incident naming the script and the page. If the change turns out to be yours, Accept as new baseline closes it.

To keep releases quiet, end your deploy with one POST /v1/monitors/{id}/baseline (or the same call from MCP or the SDKs).

Browser mode renders each page in Chrome, so scripts added at runtime count too, and keeps baseline and current screenshots side by side. Page integrity starts on the Starter plan, browser mode on Pro. See [Page integrity](/docs/monitors/integrity).

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-09-25-page-integrity-monitoring · Site guide: https://watchfor.io/llms.txt