Who This Topic Is For
People who want external signals on a public URL without a firewall or a cleanup service.
A free external check, a $9 daily monitor, and a $79 snapshot that starts one Standard scan.
People who want external signals on a public URL without a firewall or a cleanup service.
Use this checklist to make sure the workflow guidance applies cleanly to your current task.
Use this section to set the right outcome before you start the workflow.
If the API key is missing, the check says it could not run. That is not a clean result. Other signals can still be listed.
The free checker is one URL. The monitor is $9 per month or $90 per year and repeats daily. The snapshot is $79 once and adds one Standard scan. Text hash on the monitor is off until you turn it on.
Follow these steps in order for a reliable and repeatable outcome.
Open /tools/site-compromise-checker and enter the public URL.
Go to /watch/compromise.
The first check is quiet. An extra site asks you to confirm the prorated charge.
Leave text hash off unless you want hash-change mail.
Use Buy $79 snapshot, pay, then Start snapshot.
Refund is available until that start. The HTML and PDF report open with the external signals from that run and a Do this next list built from the failing signals.
It does not remove malware or add a firewall. If that origin already has a Website Watch seat, the daily monitor uses that seat’s quiet hours, extra recipients, and mute list.
These scenarios show how the workflow looks in practice, including the result you should see.
The result includes Safe Browsing could not be checked.
The first monitor check stored the page title and script hosts and stayed quiet. The next day a new script host appears.
The $79 payment succeeded and Start snapshot has not been clicked.
Use this checklist to confirm the workflow was completed correctly.
If something does not match expectation, check these common failure modes first.
It does not. It reports external signals and, for the snapshot, Standard scan findings.
The $9 or $90 Stripe Price ID is missing or the amount does not match. An admin saves it under Website Watch settings before checkout can succeed.
Text hash is off unless you turn it on. When it is on, mail is for a changed hash of the title and script hosts, not for a malware cleanup.
Use these links to continue your workflow without losing context.
Common questions for this topic.
No. It reads public signals and, for the snapshot, runs one Standard scan.
Continue to the best next page based on where you are in your workflow.