In the last 30 days, 96% of successful scans on the pages we monitor found at least one script that differed from the page's baseline (1,343 of 1,401 scans on two Czech online shops). If each of those changes triggered an email, the site owner would get several a day and would soon stop reading them.
Where the changes come from
A typical checkout or login page loads code from the shop platform, the theme, analytics, tag managers, chat, reviews and payment providers. Each of them releases updates on its own schedule, and many publish new builds or rename files without notice.
In the 30 days to September 10, 2026, those pages served 9,715 script versions we had never seen before. We read each one in full, and our malicious-code detection flagged none.
Attacks still happen. When one does, it is a single change among thousands of harmless ones, and the monitor has to pick it out.
What our own alerts looked like
Our first alert rule treated big changes as important changes. In late August we counted the emails it had sent in the 30 days from July 30 to August 28: 69 for those pages. None was about code our detection had flagged. Each described a real change, such as scripts that were updated, added, removed or reordered, and none required any action.
Part of the problem was scoring. If you add up points for every change, twenty harmless updates can end up rated high while a single injected line looks minor. So the rule now looks at the kind of change instead of its size.
The new rule went live on August 29. From August 30 to September 10 the same pages produced two change emails. One reported a rejected script that was still being served. The other reported 14 new scripts on a login page and a password-reset page, one of them from a host those pages had not used before.
Skimmers dressed up as Google Analytics
The easy way to cut noise would be to trust well-known names, and attackers know it. In 2022, Microsoft Threat Intelligence wrote:
“Attackers have also started masquerading as Google Analytics and Meta Pixel (formerly Facebook Pixel) scripts to trick site administrators or developers into thinking they're looking at non-malicious codes, thus evading detection.”
Looking like a known vendor is not a reason for us to trust a script. We look at who actually serves it and what its code contains, and we check again whenever the script changes.
Changes that still send an email
Once a site is past its first week of monitoring, an email goes out when a change looks like an attack or needs a decision only the site owner can make. For example:
- our detection flags code in a newly served script, on any page
- a script loads from a host the page has never used
- a security header gets weaker, for example a looser Content-Security-Policy or a removed HSTS header
- a new or changed script could not be read in full
- a script the owner rejected is still being served
- the page loads insecure HTTP content, or its TLS certificate is about to expire
During the first week we are still learning what is normal for the site, so only critical findings send an email. Payment and checkout pages have an extra rule that applies from the first day: a script that was never on the page before always waits for a person's approval.
What happens to the rest
Changes that don't trigger an email are still recorded and shown in the dashboard, and automatic decisions are logged with their reason. The weekly report says how many changes we reviewed and closed that week, how many emails that saved, and whether anything is waiting for a decision.
We also report the cases where we couldn't check. A script we couldn't read in full and a page address that has never responded both reach the site owner. When a Scan Can't See the Page, It Should Say So covers them.
Questions we get
Why not send an alert for every script change?
Because almost every scan finds one. On the shops we monitor, 96% of successful scans in the 30 days to September 10, 2026 found a changed script, and none of the new code was flagged as malicious. Alerts for all of it would hide the change that matters.
If I don't get an email, is the change ignored?
No. Every change is recorded and shown in the dashboard, new script versions are read in full, and the weekly report says how many changes were reviewed and closed and whether anything needs a decision.
Does a well-known vendor name make a script safe?
No. Attackers disguise skimmers as familiar scripts. Microsoft Threat Intelligence described skimmers posing as Google Analytics and Meta Pixel code in 2022. Trust has to come from evidence about the script, such as who actually serves it and what its code contains.
Try ScriptPatrol on your site
The open beta is free, needs no credit card and requires nothing to be installed on your site.