What Changed in ScriptPatrol During Four Months of Open Beta

If you monitor a site with ScriptPatrol, you should now get far fewer emails from us. On the two Czech online shops we monitor, change emails fell from 69 in the 30 days to August 28 to two between August 30 and September 10. ScriptPatrol is a client-side security monitor and has been free in open beta since May 17, 2026. Over the summer we checked it on real websites and fixed what did not work as described. This post lists what changed.

Numbers for the 30 days to September 10

The figures below cover the 30 days before September 10, 2026. They come from two Czech online shops we monitor, 11 pages in total, among them two carts, a login page and two password-reset pages.

Fewer emails

Until August 29 our alert rule treated big changes as important ones. In the 30 days to August 28 it sent 69 change emails about script changes that nobody had to act on, and none of them was about code our detection had flagged. Security teams call the effect of that much noise alert fatigue: people stop reading the alerts.

Since August 29, once a site is past its first week of monitoring, an email goes out when a change looks like an attack or needs your decision. During the first week, while we learn what is normal for the site, only critical findings send an email. Everything else is recorded in the dashboard and counted in the weekly report. Why a Good Script Monitor Rarely Emails You lists the changes that still send an email and describes the two that did between August 30 and September 10.

Changed scripts are read to the end

Earlier this year our malicious-code checks looked only at the first part of each script. That is a known weakness, because an attacker can add a skimmer to the end of a large, legitimate library. Now a new or changed script is checked from beginning to end. In the 30 days to September 10 that covered all 9,715 new script versions.

After a site's first week, a changed script that can't be downloaded completely is reason enough to email you.

What it takes to close a change automatically

Magecart skimmers often imitate well-known third-party scripts. Microsoft described the trick in 2022, and Sucuri found it on a Magento store in 2025.

After a site's first week, a change is closed automatically only when there is evidence behind it, such as who actually serves the script or what its code contains. A decision to trust a script can be withdrawn automatically when a later version fails a check of its code.

When a scan can't see the page

Bot protection sometimes answers our scanner with a challenge page, a page that asks the visitor to prove it is human. We recognize the challenge pages of the bot protection services we know and mark the scan as blocked, so a scan that hits one of them never looks clean. An address that has never answered is paused and you get an email about it. We try it again once a day and turn monitoring back on when it responds. When a Scan Can't See the Page, It Should Say So has the details.

New detection

Skimmers try to hide what they do. Some write the names of card fields as escaped characters, or keep the address they send data to in a table of strings, so that a plain text search finds nothing. Others pack the whole skimmer into encoded data that unpacks itself in the browser. We added detection for these tricks this summer. We also extended our existing checks for malicious redirects and for code that quietly uses visitors' computers to mine cryptocurrency.

Before release, a new rule is run over more than 3,600 legitimate scripts and must not raise a single alert. The whole process is in How We Test a Detection Rule Before It Reaches Your Site.

Firewall setup and the Shoptet add-on

If your site sits behind a firewall or bot protection, the setup guide now shows how our scanner identifies itself, so you or your hosting provider can add it to the firewall's allow list. The guide then checks that the rule works, and if something still blocks the check, it names that protection when it can tell. We also rebuilt the installation and sign-in of our Shoptet add-on to follow Shoptet's developer documentation. The add-on is still in pilot, and we onboard pilot shops ourselves.

What still doesn't work

Some bot protection blocks automated visitors no matter how carefully they behave. In that case the result says the page was blocked when we recognize the block page, and the fix is to let our scanner through. Integrations for other e-commerce platforms are in development; until they are ready, sites on any platform are monitored from the outside, with nothing to install.

If you already use ScriptPatrol

Nothing needs to change on your side. Your weekly report counts the changes we reviewed and closed for you and the emails that saved. If a page shows as blocked, open Scanner Access under Settings in your dashboard. It gives you the firewall rule to add and checks that the rule works.