Website Change Detection for Security Monitoring: What It Actually Needs to Catch

Search for "website change detection" and most of what comes back is tools like Visualping or Distill: point them at a page, and they email you when the visible text or layout changes - a price update, a new clause in a terms-of-service page, a competitor shipping a new feature. That's a real, useful job. It is not a security job, and it catches almost none of what a security team actually needs to know changed.

What a visual-diff tool can't see

A page-content differ works by rendering a URL and comparing what comes back. That means it only ever sees what a browser sees on the one page it's pointed at. It has no way to notice:

• A new subdomain appearing - staging., old-admin., a marketing microsite nobody decommissioned.
• A port opening on the server behind your domain that was never listening before.
• A DNS record changing - a new A record, an MX record pointed somewhere unexpected.
• A TLS certificate quietly nearing expiry, or replaced with one that doesn't match.
• The service behind an already-open port changing - a database exposed where a web server used to be.

None of these show up as a pixel or a sentence changing on a rendered page. They're infrastructure-level changes, and a tool built to diff HTML was never pointed at them in the first place.

Uptime monitoring doesn't cover this either

It's tempting to assume the existing uptime/status-check tool already has this covered - it's already watching the domain, after all. But an uptime check answers one question: is the site responding right now. A new port opening, a forgotten subdomain going live, or a certificate silently auto-renewing with the wrong details doesn't make the site go down - so it's invisible to a monitor that only watches for downtime. Security-relevant change and availability are different signals, and most tools are built to catch exactly one of them.

What security-relevant change detection actually needs to catch

The useful version of "did anything change" for security purposes has to cover the parts of a domain that are reachable from the public internet, whether or not anyone ever loads them in a browser: subdomains, DNS records, open ports, the services actually listening behind them, and TLS certificates. And it has to compare against a real previous snapshot, not just tell you the current state - the current state alone can't tell you whether that port has been open for a year or opened five minutes ago.

How SurfaceDiff does it

This is the exact gap SurfaceDiff's scan → normalize → diff → alert loop is built for. Each scan covers subdomains, DNS, open ports, TLS certificates, and live web services, normalized into one structured snapshot and diffed against the last one that actually ran - so what reaches you is what changed, not the full state repeated. Mark a finding reviewed once, with a reason, and it stops re-alerting until it genuinely changes again, with that decision kept on record for later.

More on the general approach on the external attack surface monitoring page, or see it applied to one specific signal in how to detect unexpected open ports automatically.

Want to see what it actually finds on a domain you manage? Run a free scan - free, no card required, just a DNS record to prove you own the domain.