Module · XICTRAQ

Visual diff & defacement protection — screenshot diff

Pixel-perfect comparison of all screenshots: detects broken deployments, hacked content and unintended CMS updates on desktop and mobile — automatically in one timeline.

from Starter plan

Start 14-day free trial Live demo

No credit card Servers in Germany 3 EU probe nodes 14-day pro trial GDPR compliant

Live status

Visual diff & defacement protection — screenshot diff

ACTIVE

Responsive Preview across 50+ devices

iPhone 17/16 series, Galaxy S25, Pixel 10/9, OnePlus 13, Xiaomi 15, foldables (Z Fold 6, Pixel 9 Pro Fold), iPad Pro M4, Galaxy Tab S10 Ultra, MacBook Pro, 4K/5K, ultrawide 21:9/32:9 — including landscape variants and custom pixel sizes up to 4000 × 4000 px. Smart picker with search + tags (New 2025/26, foldables, landscape).

Pixel-Diff Overlay

Visual highlighting of all changed pixels as an overlay. Changed pixels are highlighted as a colored overlay.

Multi-layer defacement detection

Three signal layers -- pixel diff, normalized HTML hash and a DOM element fingerprint with external script/iframe hosts -- correlated into one score (0-100). Opt-in per website, with a learning phase. Details below.

Full-Page Capture

Not just the visible area -- XICTRAQ scrolls the entire page and captures complete content including footer and lazy-loaded elements.

Last check just now

What it does

Unnoticed changes to your website can cost trust -- whether from failed deployments, hacked content or unwanted CMS updates. XICTRAQ regularly captures screenshots of your pages, compares them pixel-by-pixel and shows you the differences in a clear timeline. This gives you full control over your website's appearance.

Responsive Preview across 50+ devices

01 / 06

Pixel-Diff Overlay

Visual highlighting of all changed pixels as an overlay. Changed pixels are highlighted as a colored overlay.

02 / 06

Multi-layer defacement detection

03 / 06

Full-Page Capture

Not just the visible area -- XICTRAQ scrolls the entire page and captures complete content including footer and lazy-loaded elements.

04 / 06

Stability re-scan

If a capture deviates by more than 3.5%, XICTRAQ usually captures the page a second time after 15 seconds. If flicker between the two captures largely explains the deviation, for example from sliders, banners or lazy-loaded images, it does not enter the changelog.

05 / 06

Change Timeline

Chronological overview of all captured changes with before/after view. Filter by time period, severity, change type or website, and search the entries.

06 / 06

Process

How it works

Add pages for monitoring

Choose the URLs to monitor. The number of subpages depends on your plan.

Configure screenshot interval and devices

Depending on your plan, screenshots are taken automatically every 24h (free) or every 12h (paid) for desktop, tablet and mobile.

Detect changes automatically

XICTRAQ compares each new screenshot with the previous one. For large deviations (above 20%), you receive an immediate notification.

Defacement protection

Multi-layer defacement detection

Three independent signal layers are correlated into a score from 0 to 100. The score only rises when several layers fire together — this reduces false alarms compared to a pure pixel comparison.

Layer 1

Pixel diff (visual)

Compares the current screenshot pixel-by-pixel against the learned baseline and measures the share of changed pixels.

Layer 2

Normalized HTML hash

Hashes the cleaned-up HTML (without volatile values). If the hash deviates, the delivered markup core has changed.

Layer 3

DOM element fingerprint

Captures the DOM structure and checks for newly added external script and iframe hosts — a typical takeover pattern.

Opt-in per website

You enable defacement detection selectively per website via the watch toggle. It is off by default.

Learning phase without false alarms

The first three screenshot runs build the baseline and deliberately raise no alert.

One score, a clear threshold

From a correlated score of 60, XICTRAQ creates an event and alerts via your channels.

Auto-resolve on recovery

If the score drops below 30 on the next run, the event closes automatically. The baseline only changes via “relearn baseline”.

The layer signals are indications based on image, markup and DOM changes — not a conclusive security proof. Available from the Starter plan.

FAQ

Frequently Asked Questions

How accurate is the pixel-diff comparison?

XICTRAQ compares every single pixel and calculates the percentage of change. A visual change is logged from 3.5% changed pixels; for large changes above 20%, XICTRAQ automatically raises an alert (possible defacement). Minimal rendering differences are filtered out by Y-shift alignment and a stability re-scan.

How does multi-layer defacement detection work?

It evaluates three signal layers and correlates them into a score from 0 to 100: the pixel diff (visual comparison to the baseline), a normalized HTML hash and a DOM element fingerprint that captures newly added external script and iframe hosts. Only when several layers fire together does the score rise. From a score of 60, XICTRAQ creates an event and alerts. Detection is opt-in per website via the watch toggle and adds content signals on top of the classic visual diff.

What is the learning phase and how is the baseline built?

The first three screenshot runs of a monitored website establish the baseline -- during this learning phase no alerts are raised on purpose, so the system can settle on the normal state. After that, each run is checked against the learned baseline. The baseline only changes when you deliberately trigger “relearn baseline” -- for example after a planned relaunch.

Are dynamic contents also captured?

Yes. XICTRAQ waits until the page is fully loaded, including JavaScript-rendered content and lazy-loaded elements. Flicker from dynamic content is filtered out automatically via Y-shift alignment and a stability re-scan.

How long are screenshots stored?

The before/after image and diff of a detected change stay in the changelog for 30 days (Starter), 90 days (Business) or 180 days (Agency) depending on the plan, or 24 months with extended data retention. The most recent change per website is kept as the comparison basis; the latest screenshot per device is continuously updated.

What notifications do I receive when changes are detected?

For a large change above 20% you receive an alert via your configured channels (email, Slack, Teams, Discord, Telegram, webhook) with the percentage of change; the before/after image and diff overlay are shown in the changelog. For defacement detection the event additionally contains the score and the triggered layers. If the page recovers and the score drops below 30 on the next run, the event is closed automatically.