PageCrawl can watch your site for the changes that signal tampering or a lapse in protection: a new script appearing on a page, a security header being weakened or removed, and an SSL certificate approaching expiry or being replaced. These live in the Security group of tracked element types, and you can add all three to a monitor in one click.
One-click setup with the Security Bundle
When you add a tracked element, open Show more types and choose Security Bundle from the Security category. This adds all three security elements to the monitor at once (Page Resources, Security Headers, and SSL Certificate) with sensible defaults, so you do not have to configure each one by hand. You can remove any of them afterwards if you only want part of the set.
If you prefer, you can add each element individually from the same Security category.
Detect injected scripts with Page Resources
The Page Resources element tracks what a page loads and alerts you when that set changes. It captures both scripts loaded from a URL and inline scripts written directly into the page, so a script injected through a compromised third party, a tag manager, or a direct edit shows up as a change on the next check.
It has three modes, chosen from the Monitor dropdown when you add the element:
- Scripts (default): every script on the page, so a newly added or swapped script is reported.
- Third-party domains only: the distinct external domains the page calls out to. Quieter than Scripts, and a good choice if your asset filenames change on every deploy (hashed bundle names would otherwise be reported as a change each release).
- Scripts and domains: both of the above.
A script that appears from a domain the page has never used before is the classic signature of an injected tag, and PageCrawl flags that case as the most important kind of change.
Watch security headers for weakening
The Security Headers element tracks the response headers that define your page's security posture and alerts you when one is weakened or removed. It watches Content-Security-Policy, Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the Cross-Origin policies.
Values that legitimately vary between responses, such as a per-request Content-Security-Policy nonce, are ignored, so a rotating nonce never counts as a change. Removing a header or loosening a policy (for example, a Content-Security-Policy that starts allowing inline scripts) is reported and treated as a serious change. No selector is required; the headers come from the page's own response.
Monitor the SSL certificate and get expiry reminders
The SSL Certificate element reads the certificate your host presents and tracks its issuer, serial number, expiry date, and the domain names it covers. A change of issuer or subject, which can indicate a replaced or misconfigured certificate rather than a routine renewal, is reported as an important change. The host is taken from the monitor URL automatically, so no selector is needed.
On top of change detection, PageCrawl sends expiry reminders as the certificate approaches its end date: an early heads-up at 14 days and a last-chance warning at 3 days. A routine renewal that simply pushes the expiry date further out is treated as unremarkable, so you are not alerted every time your certificate auto-renews.
If you only want to know when the certificate is replaced and not receive the expiry countdown, clear the Alert me before this certificate expires checkbox on the element. The reminders go to the same channels as the rest of your alerts, not email only.
How security alerts reach you
Security changes flow through your monitor's normal notification settings, so alerts reach whichever channels you have configured (email, Telegram, Slack, Discord, Microsoft Teams, webhooks). SSL expiry reminders use the same channels.
Alerts arrive when the next check detects the change. Checks run as often as every 2 minutes depending on your plan, so for a high-value page such as a checkout or login screen, a short check interval gives you the fastest notice. It is worth monitoring more than one page, since an injection often lands on a single template rather than the whole site.
What PageCrawl can and cannot see
PageCrawl checks a page the way a visitor's browser would, so it sees scripts that are injected at runtime, not only those written into the page source. One honest limitation applies to any external monitor: it sees what its own checks see. An injection that is served only to certain regions, devices, or logged-in users can hide from an outside check. If you know an attack was conditional in that way, you can point the checks through a matching location so they see what the targeted visitors see.