Script integrity & skimming protection — web-skimming watch
Monitors the SHA-256 hash of every external third-party script and alerts on unnoticed changes — a typical web-skimming signal. Also watched: new external form targets on checkout paths.
Embedded third-party scripts are a popular entry point for web skimming: attackers tamper with a seemingly harmless script that loads on many pages and siphon off payment or form data directly in the browser. Such manipulations often go unnoticed for weeks. XICTRAQ learns the hash of every external script as a baseline during the scan and checks it continuously. If a script changes unnoticed -- or a new external form target appears on a checkout path -- you receive an alert and can review, confirm or end the monitoring.
Script integrity & skimming protection — web-skimming watch features
Hash baseline per script
During the scan the SHA-256 hash of every external third-party script is learned and stored with host, size in bytes and context. This baseline is the reference for all subsequent checks.
Continuous integrity check
A cron re-fetches the monitored scripts regularly and compares their hash against the baseline. This surfaces even silent changes that would otherwise go unnoticed in day-to-day operations.
Skimming signal as alert
An unnoticed hash change is a typical web-skimming pattern. XICTRAQ then creates a drift entry and alerts via your channels — exactly once per drift, until you acknowledge it.
Checkout & form integrity
External form targets are captured as well. If a new, foreign form target appears on a checkout path, this is an indication of a possible payment-data leak.
Acknowledge & dismiss workflow
Legitimate changes are confirmed via Acknowledge — the current hash becomes the new baseline. With Dismiss you end monitoring of an entry entirely.
Overview of open drifts
A clear status per website shows how many scripts are monitored and how many drifts are open. Each entry names host, shortened hash, context and timestamps.
How it works
Run a scan on your website
During the on-demand scan, XICTRAQ inventories all external third-party scripts and external form targets and learns the SHA-256 hash as a baseline for each monitored script.
Let it check continuously
A cron re-fetches the monitored scripts regularly and compares the hashes. When needed, you can trigger an immediate re-check at any time via “rescan”.
React to drift
On an unnoticed change you receive an alert. Confirm a legitimate change via Acknowledge as the new baseline, or end monitoring of the entry via Dismiss.
From learned hash to drift alert
The SHA-256 hash of every external third-party script is learned as a baseline and checked continuously. An unnoticed change is treated as a possible web-skimming signal — and is alerted exactly once.
Learn the baseline
During the scan the SHA-256 hash of every external third-party script is captured and stored as a baseline — together with host, size and context (script or form target).
Check hashes continuously
A cron re-fetches the monitored scripts and compares their hash against the baseline. As long as everything stays equal, nothing happens.
Alert on drift
If a script changes unnoticed, this is treated as a possible web-skimming signal: you receive exactly one alert per drift — no repeated noise.
Acknowledge or end
With Acknowledge you confirm a legitimate change as the new baseline. With Dismiss you end monitoring of an entry entirely.
Drift detection is based on hash comparisons of embedded third-party scripts and external form targets — an indication, not a conclusive security proof. Available from the Business plan.