Content and integrity checks
Nine checks on the body of the page rather than its head. Two of them - outbound link count and page language - are hack detection and are on by default, because a spam injection shows up as a link count going from four to three hundred, or a page that is suddenly in a different language. Both are pure counting, and both catch a compromise days before a human would notice. The remaining seven are noisier, off by default, and meant to be pointed at something specific.
Why counting beats scanning for hack detection
There is no malware scanner here and there will not be one in v1 - that needs the Safe Browsing API and is real work. What is here instead is the observation that the two most common visible symptoms of a compromised page are both arithmetic.
An injected spam payload adds links, usually hundreds of them, usually to one page nobody checks. A hijacked template renders in the attacker’s language. Neither requires understanding the content, and both are cheap enough to run on every fetch of every page. Both are documented failure patterns rather than hypotheticals.
The threshold checks are opt-in on purpose
Page size, time to first byte and word count all move on their own. A page whose byte size never varies is a page nobody is working on. Turning these on across a site produces noise; pointing them at a page that genuinely should be stable produces signal.
Text match and selector hash are the narrowest checks in the catalogue and the two that need the most setup. They exist for the case where the thing that must not quietly change is one specific value on the page - a price, a disclaimer, a phone number, a stock status - and everything around it is expected to move.
What is deliberately not here
| Not checked | Why |
|---|---|
| Malware detection | Needs the Safe Browsing API. Real work, not a v1 shortcut. |
| Core Web Vitals | Needs CrUX or Lighthouse. Real work, and noisy enough to drown the rest. |
| Hreflang reciprocity | Requires fetching every target. Genuinely valuable and genuinely expensive. |
| Orphan detection | Requires crawling the whole site. Out of scope by definition - this product watches a list. |
| Rendered (JavaScript) checks | Destroys the cost model. One rendered check runs at setup, and that is all. |
All 9 checks in this group
External outbound link count
on by default · per URL · confirmed over 2 runs
The number of outbound links jumped - the usual sign of a spam injection.
On by default because it is hack detection. A spam injection reads as the count going from four to three hundred on a page nobody visits.
Page language
on by default · per URL · confirmed over 2 runs
The page is suddenly in a different language - the other sign of a hack.
The other hack signal, and equally cheap: the page is suddenly in a different language from the one it was in yesterday.
Mixed content
on by default · per URL · confirmed over 3 runs
The page loads http:// resources over https://.
http:// resources on an https:// page. Browsers block them, so the page half-works and the console is the only place that says so.
Security headers
off by default · per URL · confirmed over 4 runs
A security header changed or disappeared.
Off by default. HSTS, CSP, X-Frame-Options, X-Content-Type-Options - a header disappearing is a protection that silently stopped applying.
Page byte size
off by default · per URL · confirmed over 4 runs
The page got substantially bigger or smaller.
Off by default. A large jump either way usually means a template changed or a section stopped rendering for everyone.
Time to first byte
off by default · per URL · confirmed over 4 runs
Time to first byte changed substantially.
Off by default. A substantial change is the server rather than the network - a cache that stopped working, or a query that stopped being fast.
Word count
off by default · per URL · confirmed over 4 runs
The amount of text on the page changed substantially.
Off by default. The amount of text moved past a threshold. A page that lost half its body copy looks fine until somebody reads it.
Text or regex present
off by default · per URL · confirmed over 3 runs
Text you asked us to watch for appeared or disappeared.
Off by default. The check you point at one specific thing - a price, a disclaimer, a phone number - that must not quietly change.
CSS selector content hash
off by default · per URL · confirmed over 3 runs
The contents of an element you selected changed.
Off by default. Watches the contents of one element you chose, by selector. The narrowest check here and the one needing the most setup.
Every check on this page is available on every plan, including the free one - limits are on sites and URLs, never on checks. CrawlWarden pricing, per site rather than per URL.