Something changed on the page. Does it matter?
Four ways to watch a page for change, from one string that has to stay put to a fingerprint of the whole visible text. And then the part most tools leave out: what the change means, and the button that repairs it with ten minutes to change your mind.
The four ways, and what each one is for
They are not settings of one feature. Each answers a different question, and the column that matters is the last one: two of them mean the site is broken, and two of them mean something happened. Mixing those up is how a monitoring tool teaches people to ignore it.
| What you watch | Field | What it is for | Verdict |
|---|---|---|---|
| A string that must stay | expect_string | The footer copyright, a product name, anything that can only come from the database. If the page answers 200 and the string is gone, the content is not being served. | STRING_MISSING |
| A string that must never appear | forbid_string | Site under maintenance, Error establishing a database connection, a payment gateway notice. Its presence is an alert on its own, whatever the status code says. | STRING_FORBIDDEN |
| A text you are waiting for | watch_string | Tell it to warn you when a text appears, or when it disappears. This is the one you use to confirm that a publication actually went live, rather than asking the client. | Notification, not a failure |
| Any change at all | check_content | A fingerprint of the visible text. It catches a publication you did not know about, and it catches a defaced page, which look identical from the outside until you read them. | Notification, not a failure |
The field names are the database columns, not a label invented for this page. They are in src/Db.php, and the four are evaluated in src/Runner.php.
Two things it refuses to pretend
A page it could not read in full is not a page that failed
There is a limit to how much of a response gets read. When the proof string is missing from a page that hit that limit, the verdict is degraded with the reason spelled out, page too large to be checked to the end, and not an outage. The string may be three kilobytes past the cut.
A forbidden string is treated the other way round, on purpose. Its absence from a truncated page proves nothing, so it is never reported as good news; its presence is a certainty, so it is always reported. The asymmetry is written into the code with the comment explaining it.
A fingerprint that ignores everything a page changes by itself
The reason page-change alerts get switched off after a week is that they fire on things nobody edited. Before the hash is taken, this is removed:
<script>…</script> <style>…</style> <!-- comments -->
<link> and <meta>
nonce= csrf= token= _wpnonce= ver=
all remaining tags
times of day, then repeated whitespaceWhat is hashed is the visible text and nothing else. A rotating banner script, a cache-busting version number and a clock in the header all leave it untouched, which is what makes the alert worth keeping switched on. The function is contentHash(), in src/Runner.php.
String matching is deliberately forgiving in the same spirit: a straight apostrophe matches a typographic one, HTML entities are decoded both ways, and several acceptable variants can be separated with a pipe. A proof string that fails because a theme update curled a quotation mark is a false alarm, and a false alarm costs more than the check saves.
Then it tells you what to do, and offers to do it
A verdict on its own moves the work rather than doing it. Every failure the engine names carries a cause and a first thing to check, and where a repair is possible it is offered as a button, chosen according to the cause rather than shown on every screen.
| Repair | What it writes | Undo |
|---|---|---|
| Relearn the layout reference relearn | Clears the stored baseline and the silhouette, so the next run learns the page as it is now. | Ten minutes |
| Raise the slowness threshold raise_slow | Sets it from the p95 measured over seven days, times 1.4, rounded to 100 ms and capped at 60 s. Not a round number somebody liked. | Ten minutes |
| Stop watching the noindex ignore_noindex | For a staging site or a page that is meant to stay out of the index. | Ten minutes |
| Adopt the URL actually served adopt_url | After a 404 or a redirect. It refuses if no destination has been recorded yet, rather than guessing one. | Ten minutes |
| Pause for one hour snooze | While the host is working on it, so the alerts stop without the monitor being forgotten. | Ten minutes |
| Acknowledge the incident ack | Stops the alert reminders on an open incident. This one has no undo, because there is nothing to put back. | None, and none needed |
The undo is what makes a repair button acceptable on somebody else's site. Each repair puts the previous values aside before writing, hands back a token, and keeps the last five of them for ten minutes. Undoing writes the old values back; nothing was deleted in between. The six repairs and the undo are in api.php, and the rule that decides which buttons appear is in src/Triage.php.
The one worth reading the code for is raising the slowness threshold. It does not offer a round number: it reads the ninety-fifth percentile actually measured over the last seven days, multiplies by 1.4, rounds to the nearest hundred milliseconds and refuses to go past sixty seconds. A threshold set from what the site really does stops firing without stopping meaning anything.
What this does not do
It reads what the server returns. It does not drive a real browser through the page, so a change that only exists after JavaScript has run is invisible to it, and so is anything behind a click. Tools that drive a browser exist and one of the seven we compare ourselves to sells them; that row goes to them.
It also does not keep a copy of the old page, so it tells you that the text changed and not which words changed. Visual diff products do that and this is not one. What it gives instead is the same reading applied to layout, application errors, certificates and redirects on the same run, which is the part a diff tool does not do.
The seven tools side by side, including where they win, or what the client sees of all this, which is a short page with none of it on.
Questions that come up once it is running
How is this different from a keyword check?
A keyword check is one of the four, the one where a string must stay. The other three are a string that must never appear, a text you are waiting for, and a fingerprint of the whole visible page. Most tools sell the first one and stop there, which is why a maintenance notice left online can sit on a client site for a week without anything firing.
Will a content fingerprint alert on every visit?
No, and the reason is in the code rather than in a setting. Before hashing, it strips scripts, styles, HTML comments, link and meta tags, anything that looks like a nonce, a CSRF value or a version parameter, then all tags, then times of day, then repeated whitespace. What is left is the text a reader would see. A rotating advertisement or a cache-busting query string does not move it.
What happens if the page is too big to read in full?
It says so instead of inventing a failure. A missing string on a truncated page is reported as degraded with the reason that the page could not be read to the end, not as an outage: the string may simply be past the cut. A forbidden string that is present, on the other hand, is always reported, because finding one is a certainty and not finding one is not.
Do I have to set the strings up on every site?
No. The engine deduces a proof string from the page when a monitor is created, and the task list warns you about any monitor still running without one. You override it when the deduced string is a poor choice, which happens on pages whose whole content is generated by JavaScript.
Is the one-click repair safe on a client site?
Five of the six repairs hand back an undo token, valid for ten minutes, and the last five tokens are kept. Nothing that a repair changes is destroyed: the previous value is put aside first and written back on undo. The sixth, acknowledging an incident, has no undo because it changes nothing on the site or the monitor, it only stops the reminders.
Try it on a page you already suspect
One address, no account. The free check reads the same page the same way, and tells you what the status code was covering for.