2026-09-13

WordPress Tamper Detection: Monitor title, h1, and noindex

Written by AI · Supervised by Taiki Kanai Creator of Miterl / FUNBREW Inc.

WordPress tamper detection agencies uptime monitoring maintenance contracts

A Tampered WordPress Site Does Not Go Down

The reason WordPress tampering is hard to detect is simple: the site stays up. Attackers have no interest in taking a site offline. The pages keep answering HTTP 200 while the <title> is rewritten into pharmacy spam, an external script is injected into <head>, or a <meta name="robots" content="noindex"> tag quietly removes the site from search results.

Uptime monitoring answers the question "is the site responding?", so this class of tampering is invisible to it by design. The typical way an agency finds out is a client email: "Why does Google show a weird title for our site?"

Detecting tampering requires a monitor that checks whether the content of the page still looks the way it should, not whether the page responds. This guide shows how to combine Miterl's DOM integrity monitor and keyword monitor to watch every WordPress site an agency manages, from one place.

Seven Things the DOM Integrity Monitor Checks

The DOM integrity monitor (type: dom_integrity) fetches the page, parses the HTML, and verifies the items below. If any enabled check fails, the monitor goes Down and alerts flow through the same channels as a regular outage.

Check	Setting	Goes Down when
title present	`dom_check_title`	`<title>` is missing or empty
h1 present	`dom_check_h1`	no `<h1>` element on the page
noindex injected	`dom_check_noindex`	`<meta name="robots">` contains `noindex`
canonical present	`dom_check_canonical`	`<link rel="canonical">` is missing or has an empty href
og:image present	`dom_check_og_image`	the `og:image` meta tag is missing or empty
og:title present	`dom_check_og_title`	the `og:title` meta tag is missing or empty
required title text	`dom_title_must_contain`	`<title>` does not contain the given string

For tamper detection specifically, the two checks that matter most are dom_title_must_contain and dom_check_noindex.

Put the company or product name into dom_title_must_contain and the monitor goes Down the moment the title is replaced. SEO-spam defacements almost always rewrite the title
dom_check_noindex catches injected tags, but it also catches a mistake agencies make on their own: shipping a staging site's noindex tag to production

Note that the DOM integrity monitor is not a whole-page hash comparison. It does not chase every changed character in the body; it focuses on the structural elements that drive SEO and rendering. To watch body-level wording, pair it with the keyword monitor described next.

Why the scope is deliberately narrow

Whole-page hashing sounds thorough, but on a WordPress site full of dynamic elements (latest-post widgets, dates, nonce-bearing script tags) it fires on every update. In practice the team learns to ignore the alerts, and the monitor becomes noise. Effective tamper detection concentrates on the places an attacker must touch and the places where damage is greatest.

Keyword Monitoring for Text That Must Not Disappear

The keyword monitor (type: keyword) checks whether a specific string is present or absent in the page body.

keyword_exists: true -- Up while the string is present. Use it for text that must never vanish: the company name in the footer, legal notices, a trust badge
keyword_exists: false -- Up while the string is absent. Use it to catch PHP error output such as Warning: or Fatal error, or phrases typically injected by defacements

Where the DOM integrity monitor watches structure, the keyword monitor watches wording. One of each per site covers both the SEO-spam and the error-page scenarios.

Registering Monitors in Bulk via the API

When an agency manages dozens of sites, creating monitors through the API is more reliable than clicking through the dashboard. The DOM integrity monitor is available on the Pro plan; keyword monitoring is available on Standard and above.

Create a DOM integrity monitor

# DOM integrity (type: dom_integrity) -- check title / h1 / noindex / required text every 5 minutes
curl -X POST https://miterl.com/api/v1/monitors \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "client-a.example.com DOM",
    "type": "dom_integrity",
    "url": "https://client-a.example.com/",
    "interval_seconds": 300,
    "dom_check_title": true,
    "dom_check_h1": true,
    "dom_check_noindex": true,
    "dom_check_canonical": true,
    "dom_title_must_contain": "Client A Inc."
  }'

Create a keyword monitor

# Keyword (type: keyword) -- go Down if a PHP fatal error is rendered on the page
curl -X POST https://miterl.com/api/v1/monitors \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "client-a.example.com fatal error",
    "type": "keyword",
    "url": "https://client-a.example.com/",
    "interval_seconds": 300,
    "keyword": "Fatal error",
    "keyword_exists": false
  }'

To roll the same configuration out to many sites, keep a CSV of sites and loop over it.

# sites.csv: name,url,must_contain
while IFS=, read -r name url must; do
  curl -s -X POST https://miterl.com/api/v1/monitors \
    -H "Authorization: Bearer $MITERL_API_KEY" \
    -H "Content-Type: application/json" \
    -d "{\"name\":\"$name DOM\",\"type\":\"dom_integrity\",\"url\":\"$url\",\"interval_seconds\":300,\"dom_check_title\":true,\"dom_check_noindex\":true,\"dom_title_must_contain\":\"$must\"}"
done < sites.csv

Avoiding False Alarms During Theme Updates and Redesigns

Tamper detection alerts on "different from expected", which means it also reacts to intentional changes. A theme update that restructures the h1, or a redesign that changes the title format, will trigger it unless you tell the monitor about the work.

Schedule a maintenance window for the work. If your deploy script calls the webhook (POST /api/v1/webhooks/maintenance/{token}/start and /end), the window opens and closes automatically with the deployment
When a redesign changes the title, update dom_title_must_contain at launch time (PUT /api/v1/monitors/{id})
If short transient errors (for example, waiting for a build to propagate) keep getting picked up, raise failure_threshold or use alert suppression rules to silence just the notification

See "Reducing False Positive Alerts" for a deeper look, including a real deployment-time case.

What to Do After a Detection

When tampering is detected, the agency's response should already be written down in the maintenance runbook so that anyone on the team reacts the same way.

Share status on the public status page -- DOM integrity violations can be displayed on the status page, which is faster than a first call or email to the client
Preserve the evidence -- curl -s https://client-a.example.com/ > evidence.html captures the tampered HTML for analysis
Verify core, theme, and plugin files -- wp core verify-checksums and wp plugin verify-checksums --all show which files were modified
Restore from backup and close the entry point -- replacing modified files alone leads to reinfection; fix the vulnerable plugin or weak credentials before restoring

Our "Incident Report Template" covers how to write it up. Tampering incidents are notoriously vague about "when it started", so anchor the timeline to the monitor's detection time.

Combine With Pre-Launch Checks

Set up tamper detection before a site goes live, and the same monitor also catches launch-day accidents such as leftover noindex tags or a missing canonical. The "Pre-Launch Monitoring Checklist" lists what to verify before launch, and "Adding Uptime Monitoring to a WordPress Maintenance Service" shows how to fold it into a maintenance contract. An expired SSL certificate is the same kind of "not down but broken" failure, so "Managing SSL Certificate Expiry for WordPress Agencies" is worth reading alongside this guide.

Summary

WordPress tampering happens behind an HTTP 200, so uptime monitoring alone cannot see it
The DOM integrity monitor checks seven items (title, h1, noindex, canonical, OGP tags, required title text), focusing on the places attackers must touch
Add a keyword monitor to cover both "text that must not disappear" and "errors that must not appear"
Announce theme updates and redesigns through the maintenance-window webhook to prevent false alarms
Put the post-detection steps (status page, evidence, checksums, restore) into the maintenance runbook

Monitor type specifications are in the documentation, and plan availability is on the pricing section. Keyword monitoring is included in the 14-day Standard trial. Sign up and start with a single "text that must not disappear" monitor on one managed site.