What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A defaced page is a visible warning, not a complete measure of website security. To detect less obvious tampering, compare critical files and configuration with a protected, known-good baseline, then investigate alerts alongside authentication records, logs, processes, accounts, and network activity. A page that looks normal does not prove the server is intact.
What counts as website defacement or an unauthorized change?
Defacement is one possible sign of a broader integrity incident. An attacker may replace or alter public pages, but unauthorized changes can also affect application code, web-server files, configuration, accounts, or installed software without producing an obvious visual change.
NIST NCCoE defines integrity as “guarding against improper information modification or destruction and ensuring information non-repudiation and authenticity.” Its SP 1800-26 Volume A discusses unauthorized insertion, deletion, and modification as integrity concerns. In practice, a clean-looking homepage is only one observation; it cannot establish that the underlying host and application are unchanged.
How to detect unauthorized changes
1. Establish a known-good baseline
First verify that the server and site are clean, then record a reference state for the files and settings that matter to your threat model: public content, application code, critical web-server files, and relevant configuration. A file-integrity monitor can compare current checksums or cryptographic hashes against this reference and flag differences.
#1 Best Overall
The baseline is only useful if it is trustworthy. If you create it from a system that is already compromised, you may record the attacker’s changes as normal. Store the reference database offline or otherwise separately from the monitored host, so an attacker who can alter the site cannot silently rewrite the evidence used to judge it. Use stronger checksums than 32-bit CRC.
2. Monitor meaningful files and system activity
Monitor selected critical files and relevant application and server configuration for changes. Route alerts to a responsible administrator or response team, and retain timestamps and contextual logs. NIST SP 800-44 Rev. 2 describes host- and network-based detection capabilities, including monitoring critical files and recording useful event details; see NIST SP 800-44 Rev. 2.
File alerts are more useful when considered with activity around them. Review authentication events, privileged accounts, services, processes, and network behavior. A new account or process near an unexplained file modification is more concerning than either observation alone, but neither automatically proves compromise.
3. Triage each alert against authorized work
Compare the alert’s time and affected files with the release calendar, patch records, and administrator activity. Deployments and legitimate maintenance can change hashes, so an integrity mismatch is a lead to validate, not a verdict. If no authorized change explains it—especially when there are unusual logins, new accounts, software, services, processes, or network activity—investigate under your incident-response plan.
NIST SP 800-44 recommends nightly checks on selected system files affected by compromise. That is a recommendation in this publication, not a universal modern cadence; choose monitoring frequency according to the system, risk, and operational needs.
4. Preserve evidence and respond through your plan
Keep relevant logs and artifacts for analysis rather than relying on a screenshot or the currently visible page as a forensic record. Document what changed, when the alert occurred, what authorized activity was checked, and which related host or network events were found. Follow your organization’s incident-response and reporting procedure for containment and investigation. CISA’s guidance on technical approaches to uncovering and remediating malicious activity discusses preserving and analyzing artifacts and logs.
Rank #3
Warning signs to investigate
- A hash or checksum mismatch on a critical file.
- Unexpected edits to public pages, scripts, application code, or server configuration.
- Changes outside expected release or maintenance windows.
- New privileged accounts, software, services, or processes that lack an authorized explanation.
- Unusual authentication patterns or network activity around the same time as a file change.
Each item can also have a legitimate cause. Use change records and cross-source context to distinguish routine work from possible compromise; do not treat any single signal as proof.
Host monitoring, network monitoring, and visual checks
| Approach | What it can show | Limits and trade-offs |
|---|---|---|
| Host-based monitoring | File and system activity on a monitored server, including changes that may not be visible in a browser. | Uses server resources and is tied to the host operating system. If the host is compromised, an on-host monitor may also be at risk. It remains useful where encrypted web traffic limits network inspection. |
| Network-based monitoring | A broader view of traffic that can cover multiple hosts. | Placement and visibility matter, and encryption can reduce what traffic inspection reveals. It does not directly establish whether a server’s files have changed. |
| Visual page monitoring | What a visitor-facing page looks like at capture time; useful for spotting obvious content alterations. | It cannot establish the integrity of server files, configuration, accounts, or processes. Dynamic content and normal site changes can also affect the appearance. |
These approaches complement one another rather than provide interchangeable guarantees. Detection quality also depends on current signatures where used and on the team’s ability to handle false positives. NIST’s web-server guidance is foundational, but its specific recommendations should be applied in the context of current systems and risk.
Use screenshots as a visual signal, not an integrity check
Automated captures can help identify visible page changes, such as altered text or unexpected replacement content, especially when compared with a known expected appearance. They do not replace file-integrity monitoring or log review: a screenshot cannot reveal a hidden account, modified server configuration, or an altered script that has not changed the captured view.
For a do-it-yourself visual check, capture the same URL repeatedly with a consistent viewport, wait condition, and page state, then compare the resulting images and investigate meaningful differences against release records. Keep the original captures and timestamps with your incident records. Treat visual differences as triage evidence, not proof of a breach.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Or skip the browser setup
ScreenshotNeo can capture a page with one GET request; its cookie-banner, popup, and chat-widget cleanup can make recurring visual checks less cluttered. Its response identifies page verdict and billing status: bot checks or CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed. ScreenshotNeo also provides an MCP server with screenshot tools for AI agents.
See the ScreenshotNeo API documentation for request options and response details.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorscurl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com -o shot.webpScreenshotNeo includes 1,000 screenshots a month free with no card; paid plans start at $5 for 3,000. These captures can help watch what visitors see, but they do not validate the server’s file or configuration integrity. Sign up for 1,000 free screenshots a month—no card required.
Best Value
Troubleshooting integrity alerts
The hash changed after a deployment
Check the release and patch records for the affected path and time. If the change is authorized, update the reference through a controlled process only after validating the deployed state. Do not automatically accept every changed file into the baseline.
The page looks normal, but a monitor reports changes
Inspect the affected files and configuration directly, and correlate the alert with account, authentication, process, service, and network events. A normal visual appearance does not rule out changes that do not alter the captured page.
The monitor reports many changes at once
Determine whether a planned release, patch, configuration management run, or other authorized operation accounts for the timestamp and scope. If not, preserve relevant logs and artifacts and escalate through the incident-response plan rather than resetting the baseline to silence alerts.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →You cannot trust the baseline
Do not use an unverified or potentially compromised state as the reference. Re-establish a known-good system state, validate it, and create a protected baseline from that state; preserve available prior records for investigation.
Frequently Asked Questions
Does a screenshot prove that a website has not been hacked?
No. It records a rendered view at a particular time and cannot establish the integrity of server-side files, configuration, accounts, or processes.
Does every file-integrity alert mean an attacker changed the file?
No. Releases, patches, and other authorized maintenance can also change files. Validate the alert against approved change records and related system activity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
