Question 1

What problem does the Domain Exploits Detector actually solve?

Accepted Answer

Most malware on legitimate websites is delivered through embedded third-party JavaScript — a compromised tag manager, a hijacked CDN script, an outdated plugin, a backdoored npm dependency loaded over the wire. Traditional WAFs only see traffic hitting your origin server, so they are blind to anything injected client-side. We render your site as a real visitor every five minutes and watch what it actually loads.

Question 2

How is this different from Sucuri, SiteLock, or a website malware scanner?

Accepted Answer

Classic scanners check your server files and known signature databases at long intervals (often once a day). They miss client-side injections delivered via third-party scripts, time-bombed payloads, and geo-targeted malware. We focus exclusively on the in-browser execution surface and the third-party domains it reaches, with a 5-minute cadence.

Question 3

What sources go into the 500+ malicious domain blocklists?

Accepted Answer

We combine commercial threat intelligence (Spamhaus DBL, Spamhaus DROP, SURBL), open community feeds (URLhaus, OpenPhish, PhishTank, abuse.ch, MalwareBazaar, Feodo Tracker, ThreatFox), DNS-layer reputation (Quad9, OpenDNS public lists), and general detection lists (Maltrail, StevenBlack, hpHosts mirrors). Lists are normalized, deduplicated and refreshed hourly. The exact feed catalog is available on request.

Question 4

Will the 5-minute crawler hurt my site performance or skew analytics?

Accepted Answer

Each scan is one page request from one browser. The bandwidth and CPU impact is equivalent to a single human visitor. We send a stable, identifiable User-Agent string (configurable) so you can filter our traffic out of your analytics in one rule. We do not perform load testing, brute-forcing, or rapid concurrent fetching.

Question 5

Does it work with sites behind Cloudflare, Akamai, or a WAF?

Accepted Answer

Yes. Because the crawler behaves as a real visitor, ordinary WAF rules treat it as one. For aggressive bot-management products we provide a stable IP allow-list and an optional shared-secret header so our probes are admitted without challenge pages.

Question 6

What exactly is in a malware alert email?

Accepted Answer

A summary line, the malicious third-party domain detected, the blocklist source(s) that flagged it, the initiator script with file path and line number, the parent page URL where it occurred, the full HTTP request and response headers, a PNG screenshot of the rendered page, the complete HAR archive, the console log, and a unique replay URL that re-runs the exact scan in a sandbox.

Question 7

How long until I'm protected after signing up?

Accepted Answer

Under sixty seconds. You add a domain, confirm ownership via a DNS TXT record or a meta tag, and the first scan runs immediately. The recurring 5-minute schedule begins right after.

Question 8

Do you store our visitors' personal data?

Accepted Answer

No. We crawl as a synthetic visitor with no real user identity. We capture our own scan's network traffic only — never your real users' sessions. All data is encrypted at rest, isolated per tenant, and retained for 90 days by default (configurable down to 7).

Question 9

Can I monitor multiple URLs per domain?

Accepted Answer

Yes. Each domain supports multiple URL templates — homepage, checkout, login, blog, admin login. We recommend covering at least your top revenue-impacting paths. Risk is rarely uniform across a site.

Question 10

What happens during a false positive?

Accepted Answer

Each alert exposes a one-click 'Mark as expected' action that adds the third-party domain to your per-tenant allow-list. You can also pre-allow vendors during onboarding (Stripe, Google Tag Manager, Hotjar, etc.) so legitimate partners never page you.

Question 11

Do you offer SOC, MSP, or agency plans?

Accepted Answer

Yes. The Enterprise tier includes white-label dashboards, multi-tenant isolation, role-based access, and a REST/Webhook API for ingesting our findings into your own SIEM, ticketing, or client reporting tooling.

Question 12

What about HIPAA, PCI-DSS, and GDPR compliance?

Accepted Answer

We help you maintain compliance by detecting unauthorized data exfiltration paths (e.g. tracking pixels accidentally loaded on a checkout or PHI page). The platform itself is SOC 2 Type II audited, ISO 27001 aligned, GDPR-ready, and supports EU-only data residency on request.

Question 13

How do I check a website for malware?

Accepted Answer

The most reliable way is to render the site in a real browser and watch what it actually loads and connects to, rather than only scanning server files. ExploitShield re-renders your pages every five minutes, captures every executed script, and checks each outbound domain against 500+ blocklists — catching client-side malware that file scanners and WAFs miss.

Question 14

How do I detect a JavaScript skimmer?

Accepted Answer

Skimmers run in the browser and often hide in service workers, WASM blobs or lazy-loaded chunks, activating only for real sessions. Detection requires real-browser execution that records each JavaScript body and watches every form submission's destination — which is exactly how ExploitShield surfaces a skimmer the moment it fires.

Question 15

Can a website have malware without being hacked?

Accepted Answer

Yes. Most client-side attacks never touch your server — they arrive through a compromised third-party dependency (a script, CDN, or npm package) that runs in the visitor's browser. Your origin can be perfectly clean while a hijacked tag still exfiltrates card data.