A hijacked or defaced site can keep answering every request with HTTP 200 and a fast response. A monitor that only checks the status code and response time will report that page as “Up” while it serves something an attacker put there.
Keyword monitoring closes that gap by checking what the page says, not only whether it answers. On every check it looks in the response for text you specify: a keyword, a phrase or a regular expression. The check fails, and alerts you, when the result does not match what you expect.
Hijacking and defacement mean that an attacker, or a compromised plugin or script, changes what your pages serve: replacing content, injecting spam links or scripts, or redirecting visitors elsewhere. The server is healthy, so a plain uptime check sees nothing wrong. If you know text that should appear on a page, or text that should never appear, a keyword check can tell you when that stops being true.
A keyword rule only detects what you thought to look for, so pick text that is stable and meaningful, such as a footer line, a legal notice or a script you expect to load. It complements your security tooling and does not replace it.
Keyword Monitoring Options
Site Qwality's keyword monitoring offers these options on every HTTP monitor:
Presence and Absence Checks
A presence rule (must contain) fails when expected text goes missing, such as a copyright notice, a legal disclaimer, a trust badge or your brand name. That is useful for compliance, and for noticing when a bad deploy or a CMS change removes required text without any server error. An absence rule (must not contain) fails when text that should never be there shows up, such as spam keywords, a known malicious script or a defacement message. A monitor holds one keyword and one mode, so use two monitors to watch a URL for both.
Case-Sensitive Matching
Case-sensitive matching is optional per monitor. Turn it on to tell “Apple” from “apple”, or to notice “YourBrand” turning into “yourbrand”. With a regular expression, case-sensitive mode simply removes the case-insensitive flag, so the pattern behaves exactly as you wrote it.
Regular Expression (Regex) Pattern Matching
Regex mode uses Rust regex syntax (close to RE2, with no lookahead, lookbehind or backreferences), so one pattern can cover a whole category of content instead of a fixed string: email addresses, credit-card-like number patterns, script-injection signatures or version numbers. Matching happens within a single line of the response.
Cost and Alerting
Keyword rules, including regex and absence rules, come with every HTTP uptime monitor at no extra cost, and because pricing is per product with a free tier for each, you can try them on the free plan first (see pricing). How quickly you find out depends on the check interval: every 5 minutes on the free tier and as often as every 30 seconds on paid uptime plans, with alerts by email, SMS, Slack, Microsoft Teams or webhook.
For a closer look at defacement itself, see our guide to website defacement detection with keyword monitoring.