changedetection.io watches web pages and tells you when they change. Add a URL, choose how often to check, and it keeps a history of every version with a word-level diff, then sends a notification through Discord, Slack, Telegram, email, webhooks or any of the dozens of services the Apprise library supports. It can watch just one part of a page with CSS, XPath, JSONPath or jq filters, track PDFs and JSON APIs, and has a restock and price mode that reads product metadata and alerts on price thresholds.
It is one of the most practical self-hosted tools around: one Docker command and a browser tab, and you have back-in-stock alerts, notice of policy and government page updates, or monitoring for your own site's defacement. With a Playwright browser attached it can run JavaScript, log in, click through steps and pick elements visually. Newer versions can also send each change to an LLM of your choice, including a local Ollama model, to filter or summarise it in plain language.
The project also sells a hosted version at $8.99 a month, and the README carries an affiliate link for a proxy service. The self-hosted app is the full open-source code; the visual selector and browser steps need the optional Playwright fetcher container.
- Repository: github.com/dgtlmoon/changedetection.io
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Python. Stars: 35.3K. Forks: 2,182. Last push: Oct 26, 2026.
- Scan: safe, Oct 26, 2026, commit 16974bf
Who it is for
Bargain hunters waiting on a price drop or restock, people who need to know when a government, school or vendor page changes, and site owners watching for unexpected edits.
Getting started
1. Run it with Docker, then open http://127.0.0.1:5000
docker run -d --restart always -p "127.0.0.1:5000:5000" -v datastore-volume:/datastore --name changedetection.io dgtlmoon/changedetection.io2. Or install with pip (Python 3.11 or later)
pip3 install changedetection.io3. Then start it with a data folder
changedetection.io -d /path/to/empty/data/dir -p 5000For JavaScript-heavy sites, browser steps and the visual selector, use the docker-compose.yml in the repository and uncomment the browser service. Windows instructions are on the project wiki.
Safety scan
We cloned dgtlmoon/changedetection.io at commit 16974bf on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns and no committed binaries across 1,175 files, about 81,000 lines of them Python. The bare-IP URLs are in tests/unit/test_fetch_url_gate.py, a test that checks the app refuses to fetch private and reserved addresses.
- setup.py has a custom build step, and all it does is copy the API spec file into the package. The four shell scripts the scanner lists are test runners, with no sudo and nothing piped into a shell.
- The hosts in the code are documentation links, test fixtures such as attacker.example, and the LLM providers you can choose for AI summaries (OpenAI, Anthropic, Ollama and others). Nothing calls home by default.
- The 9 packages the scanner could check in requirements.txt have no known advisories. Six workflows, all 14 third-party actions pinned to commits, no pull_request_target. Dependabot and CodeQL are enabled; there is no security policy file.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 setup.py with custom install logic. 4 installer scripts |
| Committed binaries | None. |
| CI workflows | 6 workflows. None use pull_request_target. 0 of 14 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, changedetection.io, attacker.example, testsite.com. 6 URLs to a bare IP address, listed under the raw findings. |
| Known vulnerabilities | 0 advisories across 9 pinned packages: 0 critical, 0 high, 0 moderate, 0 low. requirements.txt: 9 packages, 0 advisories. |
| Project hygiene | Has automated dependency updates, CodeQL, licence file, contributing guide. Missing security policy. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
URLs to bare IP addresses (6)
| Where | Rule | Match |
|---|---|---|
| changedetectionio/tests/unit/test_fetch_url_gate.py:83 | ip-literal-url | for url in ('http://100.64.0.1/', # RFC 6598 CGNAT, first usable |
| changedetectionio/tests/unit/test_fetch_url_gate.py:84 | ip-literal-url | 'http://100.127.255.254/', # RFC 6598 CGNAT, last usable |
| changedetectionio/tests/unit/test_fetch_url_gate.py:85 | ip-literal-url | 'http://100.100.100.100/', # inside CGNAT (Alibaba Cloud metadata) |
| changedetectionio/tests/unit/test_fetch_url_gate.py:86 | ip-literal-url | 'http://192.88.99.1/', # RFC 7526 deprecated 6to4 relay anycast |
| changedetectionio/tests/unit/test_fetch_url_gate.py:87 | ip-literal-url | 'http://224.0.0.1/', # IPv4 multicast all-hosts |
| changedetectionio/tests/unit/test_fetch_url_gate.py:96 | ip-literal-url | self.assertAllowed('http://100.64.0.1/') |
Installer scripts (4)
- changedetectionio/run_basic_tests.sh, 119 lines; talks to really-unique-domain.io
- changedetectionio/run_custom_browser_url_tests.sh, 49 lines
- changedetectionio/run_proxy_tests.sh, 120 lines
- changedetectionio/run_socks_proxy_tests.sh, 51 lines
By the numbers
| Stars | 35.3K |
|---|---|
| Forks | 2,182 |
| Contributors | 169 |
| Commits | 2,639 |
| Open issues | 323 |
| Open pull requests | 62 |
| Releases | 225 |
| Latest release | 0.60.10 |
| Licence | Apache-2.0 |
| Main language | Python |
| Project age | 5 years |
| Last push | Oct 26, 2026 |
| Tracked files | 1,175 |
| Lines of code | 111.5K |
| Checkout size | 17 MB |
Lines by language: Python 80.9K, SCSS 8,075, HTML 8,013, JavaScript 7,716, YAML 4,280, Markdown 1,699.
Questions
Is changedetection.io free?
Yes, the self-hosted version is free and Apache-2.0-licensed. The developers also run a hosted service at $8.99 a month that includes a Chrome fetcher and proxies, for people who would rather not run it themselves.
Can it monitor pages that need JavaScript or a login?
Yes, with a Playwright or WebDriver browser attached. Browser Steps can fill in forms, click buttons and log in before each check, and the visual selector lets you click the part of the page you care about.
How do I get price drop or restock alerts?
Turn on the restock and price detection option for a single product page. It reads the product's price and stock data from the page and lets you set upper and lower price limits or a percentage change before it notifies you.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.