The shortest supported VPS deployment for changedetection.io is a Docker container with a persistent /datastore volume, bound to localhost and published through a TLS-terminating reverse proxy. Start with the HTTP-only container, then add the project’s Playwright/browser service only for pages that need JavaScript rendering or browser actions. This layout keeps watches and history across container updates while avoiding direct exposure of the application port.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What you are building
changedetection.io is a self-hosted website-change monitoring service. A watch stores a URL, the fetching method, comparison rules, schedule, and notification destinations. The application fetches the page at the interval you choose, compares the new result with the previous state, and sends an alert when the selected content changes.
As an Amazon Associate I earn from qualifying purchases.
On a VPS, the practical architecture has four parts:
- Docker Engine and Compose support: the runtime that starts and restarts the service.
- changedetection.io: the main web application and HTTP fetcher.
- A persistent datastore: the mounted
/datastoredirectory containing watches, snapshots, and application state. - A reverse proxy: Nginx, Caddy, Traefik, or an equivalent proxy that accepts public HTTPS traffic and forwards it to
127.0.0.1:5000.
JavaScript-heavy targets add a fifth part: the Playwright/browser-fetcher service documented by the project. Keep that service optional. It consumes more CPU and memory than ordinary HTTP fetching and increases the number of containers you must operate.
#1 Best Overall
- REAL-TIME NOISE MONITORING DEVICE FOR AIRBNB & SHORT-TERM RENTALS: Privacy-safe decibel meter tracks sound 24/7 and sends instant alerts when noise crosses your threshold. Enforce quiet hours, stop parties, and avoid neighbor complaints and fines.
- AI OCCUPANCY SENSOR & PARTY DETECTOR WITH RADAR MOTION DETECTION: 3rd-gen radar estimates head count and flags unusual activity, so you catch overcrowding early. Get intruder and motion alerts plus guest-counting and room-usage insights.
- SMART DASHBOARD WITH DATA HISTORY & REMOTE ACCESS: Layla tracks room temperature and logs noise and occupancy trends over time. Review historical reports, spot peak-hour disturbances, enforce quiet hours, and manage properties remotely from one app.
- PRIVACY-FIRST DESIGN, NO CAMERAS OR AUDIO RECORDING: Layla measures decibel levels only and never captures conversations or personal data, keeping you compliant with Airbnb, VRBO, and local rules. Privacy Shield mode disables motion on demand.
- NO SUBSCRIPTION, NO HIDDEN FEES, PAY ONCE AND OWN YOUR DATA: Every feature unlocked forever, including AI insights, unlimited history, real-time alerts, and quiet-hours automation. Easy setup, works with Alexa & Google Home.
Choose HTTP-only or browser-enabled deployment
Begin with the smallest architecture that can fetch your targets. Many pages expose the data in their initial HTML and work with the standard HTTP fetcher. Enable a browser only when the page is assembled client-side, requires a login flow, needs clicking or scrolling, or otherwise cannot be evaluated correctly by a normal HTTP request.
| Deployment | Containers | JavaScript rendering | Screenshots and browser steps | Resource and operational cost |
|---|---|---|---|---|
| HTTP-only | One changedetection.io container | Limited to content available from ordinary HTTP fetching | Basic page comparison; no browser automation service | Lowest CPU/RAM demand and simplest upgrades |
| Browser-enabled | changedetection.io plus the project’s Playwright/browser service | Yes, for watches configured to use the browser fetcher | Supports browser-based rendering and documented browser actions | Higher CPU/RAM demand, more moving parts, and additional logs to monitor |
There is no authoritative minimum VPS size or universal watch-count guarantee published in the project’s canonical material. Actual demand depends on page weight, fetch frequency, browser usage, screenshots, and concurrent work. Treat any resource estimate as a test result for your workload, not a promise.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Prepare the VPS
Use a current Linux installation
Provision a current Linux VPS with a public hostname you control. The project’s deployment documentation assumes Docker or Python; it does not prescribe one distribution’s package commands. Install Docker Engine and Docker Compose support by following the official instructions for your VPS distribution, then confirm both commands work:
docker --version
docker compose versionIf your distribution still provides the older standalone docker-compose command, use the syntax available on that system. The examples below use the current Docker Compose plugin form, docker compose.
Create a dedicated application directory
Keep the Compose file and operational notes in a directory that is easy to back up. For example:
sudo mkdir -p /opt/changedetection
sudo chown "$USER":"$USER" /opt/changedetection
cd /opt/changedetectionA named Docker volume is sufficient for the datastore. A host bind mount is also valid if you prefer to see the files directly. Whichever method you choose, back up the datastore before upgrades or migrations.
Point DNS at the VPS
Create an A or AAAA record for the public hostname you will use. Allow DNS to propagate before requesting a certificate. Keep the application itself private; the public listener should be the reverse proxy, not Docker’s port 5000 binding.
Rank #2
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Install the official container
Standalone Docker command
The project documents this standalone invocation:
docker run -d --restart always
-p "127.0.0.1:5000:5000"
-v datastore-volume:/datastore
--name changedetection.io
dgtlmoon/changedetection.ioThe 127.0.0.1:5000:5000 mapping is intentional. Docker publishes the container’s port 5000 only on the VPS loopback interface, so scanners on the internet cannot connect directly. The named volume mounted at /datastore is equally important: removing and recreating the container does not remove that volume, so watches and their state remain available.
Verify the container
docker ps
docker logs --tail=100 changedetection.io
curl -I http://127.0.0.1:5000/You should see the container in a running state and an HTTP response from the local curl request. A redirect or an application-specific status is acceptable; a connection refusal means the container is not listening or has exited. Check the logs before changing configuration.
Use Docker Compose for repeatable upgrades
Compose makes restart policy, volumes, environment variables, and additional services explicit. A minimal HTTP-only file is:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsservices:
changedetection:
image: dgtlmoon/changedetection.io
container_name: changedetection.io
restart: always
ports:
- "127.0.0.1:5000:5000"
volumes:
- datastore-volume:/datastore
volumes:
datastore-volume:Save it as /opt/changedetection/compose.yml, then start it:
cd /opt/changedetection
docker compose up -d
docker compose psPin an image tag when your change-control process requires repeatable deployments; otherwise, record which image you deployed before each update. The project’s official Compose configuration is the authority for browser-service image names, variables, and dependency wiring. Copy that browser block rather than guessing at an image or endpoint, and keep the changedetection service on the same internal Compose network.
Update without losing watches
- Back up the datastore (instructions below).
- Pull the image used by your Compose file:
docker compose pull. - Recreate the service:
docker compose up -d. - Watch startup output with
docker compose logs -f changedetection. - Open the public URL and confirm a known watch, its history, and notification settings are present.
Do not run docker compose down -v during a routine update. The -v option removes named volumes and can erase the datastore.
Put Nginx or another reverse proxy in front
Terminate public TLS at a reverse proxy and forward requests to the loopback listener. This keeps certificate handling, HTTP-to-HTTPS redirects, and security headers outside the application container.
Recommended Free Tools
Rank #3
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Nginx proxy layout
Inside the HTTPS server block for your hostname, proxy to the local service:
server {
listen 443 ssl;
server_name monitor.example.com;
# Configure ssl_certificate and ssl_certificate_key here.
location / {
proxy_pass http://127.0.0.1:5000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
}
}
server {
listen 80;
server_name monitor.example.com;
return 301 https://$host$request_uri;
}Use your proxy’s normal certificate issuance and renewal procedure. The exact directives differ between Nginx, Caddy, Traefik, and other proxies, but the requirement is the same: the proxy must preserve the original host, protocol, and client-forwarding headers.
Set the public URL and forwarded-header handling
When notification messages contain links back to changedetection.io, set BASE_URL to the public HTTPS URL. Set USE_X_SETTINGS=1 so the application honors forwarded host, prefix, and protocol headers from the proxy. In Compose, add these under the changedetection service:
environment:
BASE_URL: https://monitor.example.com
USE_X_SETTINGS: "1"Replace the hostname with the URL users actually open. If you serve the application under a path prefix rather than its own hostname, make sure the proxy forwards that prefix and configure it exactly as described in the project’s deployment documentation; an incorrect prefix produces broken links and redirects.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Test the proxy before sharing the URL
- Open the HTTPS URL from a separate network, not only from the VPS itself.
- Confirm the browser shows a valid certificate and no mixed-content warnings.
- Check that a generated notification link uses the public HTTPS hostname rather than
127.0.0.1. - Review proxy and container logs for repeated 4xx, 5xx, or redirect loops.
Add JavaScript rendering only when a watch needs it
Ordinary HTTP fetching cannot see content that appears only after JavaScript executes in a browser. For those targets, add the Playwright/browser service from the project’s official Compose configuration and configure the changedetection container to use the documented browser endpoint. The official configuration also defines the service dependency so the application starts in the correct order.
Do not expose the browser service on a public interface. It should be reachable only over the private Compose network. Keep the application’s public port bound to localhost and let the reverse proxy remain the sole internet-facing entry point.
When to switch a watch to a browser
- The initial HTML is an empty shell and the data appears after page scripts run.
- The target requires clicking a tab, expanding a section, scrolling, or completing a browser step.
- A screenshot or rendered visual state is the meaningful change you need to track.
- HTTP mode returns a login page or a challenge while a permitted browser session can load the content.
Use browser mode selectively. Each browser page can consume substantially more memory than an HTTP request, and many concurrent browser watches can exhaust a small VPS. Start with one difficult watch, observe CPU and memory, then increase concurrency gradually.
Rank #4
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Create and configure your first watch
- Sign in to the web interface through the HTTPS hostname.
- Choose Add a new watch and enter the complete target URL.
- Select the fetch method appropriate to the page. Leave simple pages on ordinary HTTP fetching; choose the browser/Playwright method only when rendering or browser interaction is required.
- Choose a selector, filter, or extraction rule that isolates the content that matters. Watching a stable price, availability element, or article region produces fewer false positives than comparing an entire page containing rotating timestamps or advertisements.
- Set a polling interval that respects the site and your VPS. The minimum interval is constrained by
MINIMUM_SECONDS_RECHECK_TIME; do not schedule aggressive checks merely because the interface permits frequent polling. - Save the watch, run an initial check, and inspect the recorded result before enabling notifications.
If the first result contains a cookie banner, random token, clock, or other changing decoration, refine the selector or filter before treating every check as a meaningful change.
Configure notifications
Notifications are set per watch. In the watch’s edit interface, add one or more notification URLs using the Apprise URL syntax supported by the project. The project’s installation documentation summarizes the workflow as setting one or more notification URLs in the watch’s edit tab.
For automation, API v1 exposes notification endpoints that also use Apprise notification syntax. Keep notification credentials out of shell history and public Compose files; use a protected environment file or a secrets mechanism supported by your deployment process.
Validate delivery
- Save the notification URL on a low-risk test watch.
- Trigger a known change or use the interface’s test facility if available.
- Check the changedetection logs for connection, authentication, or formatting errors.
- Verify that links in the message point to the configured
BASE_URL.
Tune polling, limits, locale, and proxies
The official Compose configuration exposes several environment variables. The values below are documented defaults, not capacity guarantees or recommended settings for every VPS.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Variable | Documented default or role | What to consider |
|---|---|---|
FETCH_WORKERS |
10 workers by default |
More workers can process simultaneous checks faster but raise CPU, memory, and outbound-request pressure. |
MINIMUM_SECONDS_RECHECK_TIME |
3 seconds by default |
Sets the minimum recheck interval. Use a slower schedule where the target site or VPS workload requires it. |
PAGE_WATCH_LIMIT |
100 watches by default |
This is a configurable application default, not a published universal limit or performance promise. |
TZ |
Timezone setting | Choose the IANA timezone that makes schedules and timestamps understandable to your operators. |
LC_ALL |
Locale setting | Set a locale appropriate to the text normalization and display conventions you need. |
SCREENSHOT_MAX_HEIGHT |
16000 by default |
Large screenshots consume memory and storage. Lower the value if visual captures are oversized. |
HTTP_PROXY, HTTPS_PROXY, NO_PROXY |
Optional outbound proxy controls | Use these when requests must traverse a corporate or regional proxy; include internal hostnames in NO_PROXY as needed. |
Set environment values in Compose, then apply them with docker compose up -d. Change one group of settings at a time and observe queue length, response times, container memory, and failed checks.
Back up the datastore and recover safely
The datastore is the part you must protect. It contains the watches and state that make monitoring useful. A container image can be downloaded again; an unbacked-up datastore cannot be reconstructed reliably.
Back up a named volume
Stop writes briefly for a consistent archive, then stream the volume to a compressed file:
cd /opt/changedetection
docker compose stop changedetection
docker run --rm
-v datastore-volume:/datastore:ro
-v "$PWD":/backup
alpine tar czf /backup/changedetection-datastore-$(date +%F).tar.gz -C / datastore
docker compose start changedetectionReplace datastore-volume with the actual volume name shown by docker volume ls. Copy the archive off the VPS and periodically test that it can be listed and extracted. If you use a host bind mount instead, stop the service and archive that directory with your normal backup tool.
Best Value
- FIRST MONTH FREE + EASY ACTIVATION: Kickstart your Safety+ journey with a simple activation call before use. Get the first month's service absolutely free upon activation. Then, only $40/month all-inclusive subscription: 24/7 Monitoring, Fall Detection, GPS Location, Nationwide 4G Coverage, Mobile App, and access to Safety+'s exceptional features. FREE Activation, No hidden fees, 1st Month FREE. Subscription after the 1st free month subject to our Terms and Conditions
- 24/7 NATIONWIDE EMERGENCY MONITORING: Our 4G mobile-enabled Safety+ Medical Alert provides constant security at home and on the go. Instantly connect to our US-based Emergency Monitoring Center by pressing the help button. Trained operators ensure swift assistance (less than 9 seconds average response time), sending help (if needed) to your exact location and notifying family. Caregivers, enjoy peace of mind and monitor activity via the app. Life alert system for seniors. Multi Language Support.
- FALL DETECTION INCLUDED: The integrated fall detection feature enhances your safety. A potential detected fall sends an instant signal to our 24/7 emergency monitoring center. Monitoring Center then calls (avg response time under 9 seconds) the device to ask (via integrated speaker and microphone) if help is needed and dispatch if necessary. Ideal for seniors, individuals with mobility challenges, post-surgery recovery, or anyone 55 and above. Fall Detection is included.
- CAREGIVER FEATURES VIA MOBILE APP: FREE Caregiver App keeps family (or others) informed about your safety. Our included mobile app boasts a comprehensive dashboard offering real-time insights into your location, morning activity, step count, and battery status. Activate push notifications for instant emergency alerts, ensuring family/caregivers stay informed and you stay safe. Create a Care Circle and Loved Ones and Caregivers can share information, tracking, and alerts.
- MULTIPLE WAYS TO WEAR: Wear on the included lanyard around your neck or on the (sold separately)
Restore after a failed upgrade
- Stop the changedetection service.
- Preserve the current datastore by renaming or copying it; do not overwrite your only recovery point.
- Restore the archive into the mounted volume with ownership and permissions intact.
- Start the previously working image version and inspect the logs.
- Only after the watches load correctly should you retry the upgrade.
Secure the public service
- Keep Docker’s application binding on
127.0.0.1; do not change it to0.0.0.0unless you have a specific, protected network design. - Allow only SSH and the reverse proxy’s HTTP/HTTPS ports through the VPS firewall. Restrict SSH by source where practical and use key authentication.
- Use HTTPS for the public hostname and renew the certificate automatically.
- Protect the changedetection interface with the authentication controls available in your deployed version and avoid sharing administrator credentials.
- Keep Docker, the host operating system, the changedetection image, and the browser service updated on a planned schedule.
- Review outbound proxy settings and notification URLs because they may contain credentials or permit access to internal destinations.
- Monitor disk usage: snapshots and screenshots can grow the datastore even when CPU usage is low.
The project does not publish one universal hardened-VPS checklist. Apply the controls required by your threat model, organization, and hosting provider before making the hostname public.
Troubleshoot common failures
The page loads locally but not through HTTPS
Confirm the container is listening on 127.0.0.1:5000, the proxy points to that exact address, the firewall permits ports 80 and 443, and DNS resolves to the VPS. Check proxy error logs and docker compose logs changedetection for the first failing request.
Links redirect to localhost or the wrong scheme
Set BASE_URL to the public HTTPS URL and set USE_X_SETTINGS=1. Ensure the proxy sends Host and X-Forwarded-Proto headers. Recreate the container after changing environment variables.
Watches disappeared after an update
Inspect the volume mounted at /datastore. A new, empty volume or a changed mount path means the application is not using the original datastore. Restore the known volume or backup, and avoid docker compose down -v.
A JavaScript page is blank or incomplete
Verify that the browser service is running, that the changedetection container can reach its internal endpoint, and that the watch is configured for the browser fetcher. Review both service logs. If only one site fails, test its login, consent, navigation, and anti-bot requirements separately rather than increasing global concurrency.
Checks are delayed or the VPS is overloaded
Lower FETCH_WORKERS, lengthen watch intervals, reduce screenshot height, and disable browser mode for watches that do not need it. A high worker count is not automatically faster when CPU, memory, or the target site is saturated.
Notifications do not arrive
Recheck the Apprise URL syntax, credentials, and outbound DNS/connectivity. Trigger a test change, then inspect application logs. If the message contains a broken link, correct BASE_URL and forwarded-header handling first.
Operational checklist
- Docker Engine and Compose support installed from your Linux distribution’s official instructions.
- changedetection.io bound to
127.0.0.1:5000, not publicly exposed. /datastoremounted on a named volume or backed-up host directory.- Reverse proxy serving a valid certificate and forwarding host and protocol headers.
BASE_URLset to the public HTTPS address when notification links need it.USE_X_SETTINGS=1enabled behind a proxy that supplies forwarded headers.- Playwright/browser service added only for watches that require JavaScript or browser actions.
- Polling intervals, worker count, watch limit, timezone, locale, screenshot height, and proxy variables reviewed for the workload.
- At least one tested datastore backup stored away from the VPS.
- Restart, update, rollback, firewall, certificate-renewal, and notification checks documented.
For most VPS users, the reliable path is therefore: deploy the official Docker image with persistent storage, keep it private behind a TLS reverse proxy, and add the documented browser service only when a real watch demonstrates that HTTP fetching is insufficient. That arrangement preserves monitoring state through container recreation while keeping resource use and operational complexity under control.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
