Documentation

Compromise signals

A free external check, a $9 daily monitor, and a $79 snapshot that starts one Standard scan.

Who This Topic Is For

People who want external signals on a public URL without a firewall or a cleanup service.

Prerequisites

Before You Start

Use this checklist to make sure the workflow guidance applies cleanly to your current task.

  • You can open Tools or sign in for the paid monitor and snapshot.
Expectations

What To Expect

Use this section to set the right outcome before you start the workflow.

Safe Browsing fails closed

If the API key is missing, the check says it could not run. That is not a clean result. Other signals can still be listed.

Three separate choices

The free checker is one URL. The monitor is $9 per month or $90 per year and repeats daily. The snapshot is $79 once and adds one Standard scan. Text hash on the monitor is off until you turn it on.

Playbook

Step-By-Step Guidance

Follow these steps in order for a reliable and repeatable outcome.

  1. Run the free checker.

    Open /tools/site-compromise-checker and enter the public URL.

  2. Start the monitor only if you want a daily repeat.

    Go to /watch/compromise.

    The first check is quiet. An extra site asks you to confirm the prorated charge.

    Leave text hash off unless you want hash-change mail.

  3. Buy a snapshot only if you want one Standard scan.

    Use Buy $79 snapshot, pay, then Start snapshot.

    Refund is available until that start. The HTML and PDF report open with the external signals from that run and a Do this next list built from the failing signals.

    It does not remove malware or add a firewall. If that origin already has a Website Watch seat, the daily monitor uses that seat’s quiet hours, extra recipients, and mute list.

Examples

Worked Examples

These scenarios show how the workflow looks in practice, including the result you should see.

Missing Safe Browsing key

The result includes Safe Browsing could not be checked.

Treat that row as a failure. Do not tell the site owner the page is clean.

A new script host after the baseline

The first monitor check stored the page title and script hosts and stayed quiet. The next day a new script host appears.

That new host can email. Quiet hours, extra recipients, and mutes are reused when this origin already has a Website Watch seat.

Refund before the snapshot starts

The $79 payment succeeded and Start snapshot has not been clicked.

Refund is still available. Starting the snapshot runs one Standard scan and closes the refund.
Validation

Validation Checklist

Use this checklist to confirm the workflow was completed correctly.

  • A missing key is a failure.
  • The monitor price is $9 or $90.
  • The snapshot is $79 and can be refunded before it starts.
  • No sentence promises malware cleanup or a firewall.
  • The first monitor day is quiet. Later days email a new failing signal.
  • Text hash stays off unless you turn it on.
Troubleshooting

Common Problems And Fixes

If something does not match expectation, check these common failure modes first.

I thought this removed the infection

It does not. It reports external signals and, for the snapshot, Standard scan findings.

Common failure mode

The monitor would not open checkout

The $9 or $90 Stripe Price ID is missing or the amount does not match. An admin saves it under Website Watch settings before checkout can succeed.

Common failure mode

Text hash mailed on every check

Text hash is off unless you turn it on. When it is on, mail is for a changed hash of the title and script hosts, not for a malware cleanup.

Common failure mode
FAQ

Compromise signals FAQs

Common questions for this topic.

No. It reads public signals and, for the snapshot, runs one Standard scan.

Next Recommended Action

Continue to the best next page based on where you are in your workflow.