Scriptwatcher

Script integrity monitoring

Who changed
your checkout?

Somebody edited a script on your payment page last Tuesday. A supplier pushed a new build. A tag manager pulled in something new. Do you know which, and who said it was alright?

Watch a page free How it works

One page free, no card. £199 a month for a whole site.

pulseandcocktails.co.uk/checkout 3 Oct 04:00 7 files js/app.4f91c2.js own on record js.stripe.com/v3 3rd on record cdn.vendor.io/widget.js 3rd CHANGED — HELD FOR REVIEW + new destination collect-metrics.io + new capability reads form fields klaviyo.js 3rd routine rebuild, cleared

An illustration, not a real customer's page

 How it works

Nothing goes
on your site.

No tag, no plugin, no agent. ScriptWatcher requests your pages over the public internet like any other visitor, so there is nothing to install and nothing to keep updated.

It learns the page

You give it a URL. It fetches the page, lists every script the HTML loads, and stores that list and the response headers as the baseline.

It keeps a copy

Each file is downloaded, hashed and stored. That is what makes a real comparison possible later, rather than just "something changed".

It checks daily

A new script, one gone missing, a changed header or a changed file are all recorded with the time they were seen.

You sign it off

You read the change, write down why it is fine, and approve it. The reason and the person are kept, so the record answers the question months later.

The hard part

Most changes are nothing. Flag them all and you train people to ignore you.

So when a file's contents change, the stored copy is compared against the new one and exactly two things are measured.

Destinations

Every domain mentioned anywhere in the file, compared with the version before. A name that was not there before is the clearest signal that data could now go somewhere new.

Capabilities

What the code is able to do: send data out, read form fields, listen to keystrokes, read cookies, build code from strings. Compared with what the previous version could do.

Neither grew? Logged as routine. Nobody is interrupted.
Either grew? Held for review, with the host or capability named, and both versions ready to read side by side.

The limits

It cannot tell you your site is secure. Be wary of anything that says it can.

This compares one version of a file against the version before it. It says nothing about code that was always there, and it cannot see data going to a host the file already used. Anything it cannot compare, because there is no earlier copy, is held for review rather than waved through.

Pricing

Two plans.
That is the whole menu.

Monthly, cancelled from your own billing page. Excludes VAT where it applies. Nothing is withheld between the plans except how much you can watch and how long it is kept.

Free

Free

One page, checked daily. Enough to decide whether this is worth paying for.

  • Daily check on one page
  • Script inventory and change alerts
  • Stored copies of 5 versions per file
  • 30 days of history
Start free

Business

£199 / month

One site, watched properly, with the whole record behind it.

  • Up to 100 pages on one site
  • Stored copies of 40 versions per file
  • Read the difference between any two
  • Approval records and the full audit trail
  • Your whole team, with roles
  • CSV and print exports
  • 3 years of history
  • Priority email support
Choose Business

More than one site, or something built to your own requirements? A more robust setup can be put together to order. Get in touch and say what you need.

Questions

The ones worth answering honestly.

Do I have to install anything?
No. It requests your pages over the public internet like any other visitor. It only sees what an anonymous visitor sees, which does mean it cannot look at pages behind a login, or scripts that only load once a card is entered.
How often does it check?
Once a day on every page in your account, and by hand whenever you want — which is what you need straight after a deployment.
Does it help with compliance work?
It can form part of a wider toolkit. An inventory of the scripts on your payment pages, and a written record of why each is there and who approved it, is the kind of evidence that comes up. We will not tell you it makes you compliant with anything: that depends on your whole environment and on your assessor, not on us.
What about scripts a tag manager loads later?
It reads the HTML your server sends, so it sees scripts in the markup. It does not run a browser, so code injected later by other code is not in the inventory. The container script itself is, and a change inside it is exactly what gets held.
Can I get my data out?
Yes. The register, the approval record and the check history all export to CSV on every plan, and the pages print properly. Close the account and the records go too.
Who handles payment?
Stripe. Card details are entered on Stripe's pages and never touch our servers.

Start with
one page.

Point it at your checkout and see what it finds. No card.

Create an account