Deployment guide

changedetection

Overview

changedetection.io is the open source, self-hosted website change monitor. Point it at any web page, such as a price, a stock level, a set of terms and conditions, a competitor page, a job board or a government notice. It tells you the moment the content changes and shows you exactly what was added or removed. It can also alert you through email, Slack, Discord, Telegram, webhooks and 80+ other channels.

The SecureAnyCloud image installs Docker CE from the official Docker repository. It runs changedetection.io 0.55.7 as a container (managed by Docker with a restart policy), bound to the loopback connector 127.0.0.1:5000 behind an nginx reverse proxy on port 80. nginx is configured with the WebSocket upgrade that changedetection uses for its live watch list.

The data lives on a dedicated Azure data disk, and a unique login password is generated on the first boot of every VM. The image is backed by 24/7 SecureAnyCloud support.

What you get:

changedetection.io 0.55.7 running as a container managed by Docker
Docker CE preinstalled from the official Docker apt repository
The changedetection web UI on :80, fronted by nginx with the WebSocket upgrade proxied
A unique login password generated on first boot and recorded in a root-only file
A dedicated Azure data disk at /var/lib/changedetection holding the watch list, change history and settings
docker.service and nginx.service as systemd units, enabled and active
An unauthenticated /healthz endpoint for Azure Load Balancer health probes
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a reasonable starting size. Size up for hundreds of watches or more frequent checks.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp. changedetection serves plain HTTP on port 80. For production, terminate TLS in front of it with your own domain (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure portal, choose Create a resource, search the Marketplace for changedetection.io by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab. Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, then create the VM and open port 80:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:changedetection-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name changedetection \
  --image sac1647283583153:changedetection-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name changedetection --port 80 --priority 1010

Step 3 - Connect to your VM

Connect over SSH as azureuser:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that both services are active:

systemctl is-active docker.service nginx.service

Both report active. Docker manages the changedetection.io container (bound to the loopback connector 127.0.0.1:5000). nginx fronts it on port 80 with the WebSocket upgrade that the live watch list requires.

The watch list, change history and settings live on the dedicated Azure data disk mounted at /var/lib/changedetection.

Step 5 - Retrieve your login password

changedetection.io uses a single shared login password (there is no username). It is generated uniquely on the first boot of your VM and written to a root-only file. Read the file:

sudo cat /root/changedetection-credentials.txt

This file contains CHANGEDETECTION_PASSWORD and the URL to open. Store the password somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes. Query it:

curl -s http://localhost/healthz

It returns ok. This endpoint never requires authentication, so it is safe for an Azure Load Balancer health probe.

Step 7 - Confirm the login password is enforced

Because a password is set on first boot, an unauthenticated request to the app is redirected to the login page (HTTP 302). Nobody reaches your watches without the password. Verify the redirect:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/

It prints 302. A wrong password is rejected, and only the per-VM password from Step 5 establishes a session. You can confirm this in the browser in the next step.

Step 8 - Sign in to the console

Browse to http://<vm-public-ip>/. changedetection shows a sign-in page. Enter the password from Step 5.

After you sign in, the watch list is your home page. It shows every page you are monitoring, when each was last checked and when it last changed. It also offers quick actions to recheck, edit, preview or view the history.

Step 9 - Add a watch

Paste a URL into Add a new web page change detection watch and click Watch.

To configure a watch in detail, open Edit on it. There you can set the check frequency, a CSS/xPath filter to narrow the page to just the part you care about, trigger and ignore rules, and per-watch notifications.

Step 10 - View a diff

When a page changes, open its History to see a diff of exactly what changed. Removed text is shown in red and added text in green. Controls let you compare any two snapshots by words or lines.

Step 11 - Confirm data lives on the dedicated disk

The watch list, change history, snapshots and settings are stored under /var/lib/changedetection on the dedicated Azure data disk (bind-mounted into the container as /datastore). They survive OS changes and can be resized independently. Confirm the mount:

findmnt /var/lib/changedetection

The mount is backed by a separate Azure data disk captured into the image and re-provisioned on every VM.

Maintenance

Password. The login password is set on first boot. To change or remove it, sign in and use Settings > General in the console.
Notifications. Configure Apprise notification URLs under Settings > Notifications (or per watch) to get alerts by email, Slack, Discord, Telegram, webhooks and more.
JavaScript-rendered pages. The base image fetches pages with plain HTTP requests. To watch pages that build their content with JavaScript, run a browser fetcher sidecar (browserless/sockpuppetbrowser) and set the watch's fetch method to the Chrome/WebDriver fetcher.
Upgrades. changedetection runs as the changedetection container from the pinned ghcr.io/dgtlmoon/changedetection.io:0.55.7 image. To upgrade, pull a newer tag, remove the container and re-run it with the same -v /var/lib/changedetection:/datastore mount, so your data is preserved.
Storage. All changedetection state lives under /var/lib/changedetection on the data disk. Back up that volume to protect your watches and history.
TLS. changedetection serves plain HTTP on port 80. Front it with TLS (for example, certbot with your own domain) before running it in production.
Security patches. unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch changedetection.io on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

changedetection.io is a self-hosted service that monitors web pages for changes. It notifies you when something you care about is added, removed or updated. Point it at any URL, optionally narrow it to a CSS or xpath region, and it re-fetches the page on a schedule, stores a snapshot, and shows you a clear visual diff of exactly what changed.

What you get:

changedetection.io running as a container bound to 127.0.0.1:5000 on the loopback interface, fronted by nginx as a reverse proxy on port 80 (and 443 once you add TLS), with the WebSocket upgrade its live-updating watch list needs already configured
A dedicated EBS data volume mounted at /var/lib/changedetection, holding all settings, page-content history snapshots and diffs. It is independently resizable and separate from the operating system disk.
A per-instance access password. On the first boot of every deployed instance, a one-shot service generates the password and applies it to changedetection.io using the application's own salted hash. It then verifies the sign-in round trip and records the password in /root/changedetection-credentials.txt with mode 0600.
No shared or default credentials in the image. You can change or remove the password later from the settings screen.

Prerequisites

Before you deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and inbound ports 80 and 443 from the networks your operators will reach changedetection.io on
The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for changedetection.io. Select the SecureAnyCloud listing and choose Select, then Continue on the subscription summary.

Pick an instance type of t3.small or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet. Then create or select a security group that allows inbound port 22 from your management network and inbound ports 80 and 443 from the networks your users use. Leave the root volume at the default size or larger. The image adds a separate data volume for the watch database automatically.

Select Launch instance. First boot initialization takes under a minute after the instance state becomes Running and the status checks pass.

Launch the Instance from the AWS CLI

The following command launches an instance from the SecureAnyCloud changedetection.io Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22, 80 and 443 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.small \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=changedetection-01}]'

The command prints a JSON document on success. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect and Retrieve the Access Password

Connect over SSH with the key pair you selected and the public IP address from Step 2. The SSH login user depends on the operating system of the AMI variant that you launched:

AMI variant SSH login user

changedetection.io 0.55 on Ubuntu 24.04 ubuntu

The first boot service runs before the SSH daemon becomes ready, so the credentials file is always in place when you log in for the first time.

ssh <login-user>@<public-ip>
sudo cat /root/changedetection-credentials.txt

The file is plain text. It contains the changedetection.io URL and the per-instance access password (there is no username).

From the same SSH session, confirm that the deployment is healthy. The health endpoint is open and served by nginx:

curl -fsS http://127.0.0.1/healthz

ok

An ok response confirms that nginx is fronting the application. Then confirm that the services that make up the stack are running and that the changedetection.io container is up:

systemctl is-active docker nginx changedetection-firstboot
sudo docker ps --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'

active active active NAMES IMAGE STATUS changedetection ghcr.io/dgtlmoon/changedetection.io:0.55.7 Up 3 minutes

First Sign-in

Open a web browser and go to http://<public-ip>/. changedetection.io presents its sign-in page and prompts for the access password.

Enter the password from /root/changedetection-credentials.txt and select Login. changedetection.io opens on the watch list. The list shows the pages it is monitoring, when each was last checked, and whether a change has been detected. Two sample watches are seeded so that you have a populated list to explore.

Each row has recheck, edit and preview controls.

Add a Watch

To monitor a new page, paste its URL into the Add a new web page change detection watch box at the top of the watch list. Optionally add a Group tag to organize related watches. Choose whether to track general text and HTML changes or restock and price changes, and select Watch.

Use Edit > Watch instead if you want to set the check interval, restrict monitoring to a page region, or configure notifications before the first check.

changedetection.io fetches the page immediately, stores the first snapshot, and then re-checks it on the schedule you set. To narrow a watch to just the part of a page you care about, open the watch's Edit screen and use the Visual Selector. Alternatively, enter a CSS selector or xpath under Filters & Triggers, so that navigation menus and ads do not create noise.

Read a Change Diff

When changedetection.io detects a change, the watch is highlighted on the list and its Last Changed time updates. Select the watch, or its Diff control, to open the difference view.

Pick any two stored versions with the From and To selectors. The view highlights exactly what changed: removed text in red and added text in green. You can switch between word-level and line-level comparison and toggle which change types are shown.

Configure Notifications

changedetection.io can notify you the moment a change is detected, through dozens of channels. Open Settings > Notifications to set a default notification for every watch. To set one per watch, open an individual watch's Edit > Notifications tab.

Notification targets use the Apprise URL format, so you can send to email, a webhook, Slack, Discord, Telegram and many more. A typical email target looks like mailto://user:pass@smtp.example.com, and a webhook target looks like json://your-endpoint.example.com/hook.

The notification body is templated from the change, so you can include the watch URL, the diff and the current snapshot. Use Send test notification to confirm the channel before relying on it.

Enable HTTPS with Let's Encrypt

For any production deployment, serve changedetection.io over HTTPS so that your session and the WebSocket used by the live watch list cannot be intercepted. The image ships with nginx, which certbot can configure automatically.

The following steps assume that you have a DNS record pointing your fully qualified domain name at the instance's public IP address.

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d changedetection.your-domain.example \
  --non-interactive --agree-tos -m you@your-domain.example \
  --redirect

certbot obtains a certificate and rewrites the nginx server block to serve HTTPS and redirect HTTP. The WebSocket upgrade headers already in the site are preserved. The certbot systemd timer renews the certificate automatically.

After enabling TLS, set the base URL used in notification links to your HTTPS address by adding -e BASE_URL=https://changedetection.your-domain.example/ when the container is recreated, or set it under the application settings.

Backups and Maintenance

changedetection.io keeps its settings, watch configuration and page-content history under /var/lib/changedetection on the dedicated data volume. Confirm that it is on its own disk:

df -h /var/lib/changedetection | tail -1

/dev/nvme1n1 20G 252K 19G 1% /var/lib/changedetection

Because that is a separate EBS volume you can take a coordinated EBS snapshot of it for point-in-time backups, or archive the tree to object storage:

sudo docker stop changedetection
sudo tar czf <backup-dir>/changedetection-$(date +%F).tgz -C /var/lib changedetection
sudo docker start changedetection

Ship the archive to an Amazon S3 bucket or another object store.

To change or remove the access password, sign in and use Settings > General > Password.

The reverse proxy and engine run under systemd, and the changedetection.io container runs with a restart policy of always. Check their state at any time:

systemctl is-active docker nginx
sudo docker ps --filter name=changedetection

Scaling and Operations

Increase the check frequency and the number of watches to suit your workload. changedetection.io processes checks in the background, so the UI stays responsive.
Add optional JS rendering for pages that need JavaScript, by running a browser sidecar (for example a Playwright or sockpuppetbrowser container) and pointing watches at it.
Put the web tier behind an Application Load Balancer and terminate TLS there. Forward the WebSocket upgrade so that the live watch list connects.
Grow the data volume by extending the EBS data volume and running sudo resize2fs on /var/lib/changedetection.
Use Group tags and per-tag notification settings to organize large numbers of watches by team or purpose.
Pin the changedetection.io version for a fleet by controlling which AMI version you launch.

The official changedetection.io documentation is available at https://changedetection.io/docs.

Support

SecureAnyCloud provides 24/7/365 expert technical support for this image. Guaranteed response within 24 hours, one hour average for critical issues. Contact sales@secureanycloud.com.

For general changedetection.io questions, consult the documentation at https://changedetection.io/docs. changedetection.io is a trademark of its respective owner; use here is nominative and does not imply affiliation or endorsement.

Deploy on AWS

Launch changedetection.io on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS