Screenshots: detect defacement and unwanted changes
A hacked website usually keeps answering with 200, so availability stays green. A screenshot monitor (visual) has a real browser (Chromium) capture the address every hour, in the desktop view (1280 pixels wide) and optionally also mobile (390 pixels), and compares the image pixel by pixel with the reference screenshot. Animations are frozen, lazy images are triggered by scrolling, and the capture goes down to 3000 pixels. The first run saves the reference.
If more than the threshold differs (2 % of the area by default, adjustable from 0.1 to 50 %), DomainWarn stores the capture with a difference image and repeats the run after 45 seconds; only the confirmation opens the incident visual_changed. The dashboard shows before, after and the differences marked in red. If the change is intended, “Accept as new reference” turns the capture into the reference and the next run closes the incident.
Two signals work without the image comparison: typical phrases of a taken-over page (“hacked by”, “defaced”, “gehackt von”) that were not in the reference are reported as critical (visual_defaced); if title, main heading and almost all text are new, that is a warning (visual_content_replaced). If the page answers with an error status, there is no comparison: the website monitor reports that.
Add changing areas such as sliders, dates, live tickers or ads as CSS selectors (for example .hero-slider); they are painted over before the capture. DomainWarn paints over common cookie banners (Cookiebot, Usercentrics, Borlabs, OneTrust and others) by itself. A new address, new excluded areas or a changed cookie setting discard the old images. Per page, the reference and the last ten differences of the last 90 days are kept. The browser identifies itself as “DomainWarn-Visual”. From the Agency plan with three pages per domain, Agency Pro ten; in the dashboard the row “Screenshots” sits in the “Website” tab of the domain.