Docs menu

Anomaly Radar

CookieHug Anomaly Radar: cloaking, 5xx/404 errors, unknown scripts, new cookies and a missing snippet — e-mail alerts based on your site's history.

What Anomaly Radar is

Anomaly Radar is monitoring that checks not just whether your site responds, but whether it responds with what it should. The same nightly scans that refresh cookie data compare your website's state against previous days — and when something stands out, you get an e-mail alert.

Radar will not protect you from a break-in (that is what backups and updates are for) — it shortens the time it takes you to find out about one.

What it detects

  • Cloaking — the website shows Googlebot different content than it shows users; a classic sign of a compromise and a fast path to removal from search results.
  • Server errors on subpages — an address that returned 200 yesterday returns 500 or 404 today.
  • Unknown third-party scripts — a domain appears in the code that was not there before (e.g. an injected script).
  • New cookies and trackers — something started setting cookies before consent.
  • Missing CookieHug snippet — the banner stopped being served (e.g. after a theme change or plugin update).
  • Downtime and slowdowns — the availability monitor catches series of 5xx errors.
  • Dangerous robots.txt changes — the file suddenly blocks the whole site for search engines or points to a sitemap on a foreign host (see below).

robots.txt changes: what is an alert and what is not

robots.txt changes more often than you would think: a WooCommerce update adds its own blocks, Yoast appends the sitemap address, and Cloudflare may add or remove its comment block about AI bot signals. Radar therefore does not compare raw text but directives — comments, order and whitespace do not matter. Every change is classified into three levels:

  • Critical (e-mail alert) — a new “Disallow: /” appears for all robots or for Google/Bing (the site will disappear from search results), a new sitemap points to a foreign host (this is how SEO spam URLs get injected), or /robots.txt serves HTML instead of the file.
  • Warning (panel only) — blocks for search engines were removed (more URLs may enter the index) or a new sitemap address appeared on your own host.
  • Routine (timeline only) — new path blocks, rules for AI bots, comment changes. No notifications.

What the details show

The signal details and the e-mail show the list of added and removed directives, so you know right away whether the change was intentional. The first night after adding a domain builds the baseline — comparison starts with the second scan.

How alerts work

Anomalies have three severity levels (critical / warning / info). Alerts arrive by e-mail to the account address, and details are available in the domain panel. Radar compares the current state against your website's own history, so the first days after adding a domain are spent building the baseline.

Which platforms

Radar works regardless of technology — WordPress, WooCommerce, PrestaShop, Shopify, Joomla, Drupal, Webflow or a custom CMS. It is especially useful with WordPress, where outdated plugins and themes are the most common attack vector; the core and plugin version audit is described in the WordPress integration docs.