Perimattic Managed changedetection.io - Website Change Monitor

This AMI runs changedetection.io, an open-source service that watches web pages for changes, shows you what changed and sends a notification, on Ubuntu 24.04 LTS. Release 0.60.10 is pinned and baked into the AMI, so first start does not depend on a registry. Watches and history are kept in a data folder on the instance.

What Perimattic adds

Protected from the first request: out of the box changedetection.io has no password at all, so anyone who finds the address can read your watches and add their own. On this AMI, first-login setup generates a random 24-character password on your server and stores it only as a salted PBKDF2 hash in the application's own deployment setting, before the application starts. The web interface, the REST API and the RSS feeds then all refuse anonymous visitors: the API needs the per-instance API key and the RSS feeds need the per-instance token that the application generates for your installation. Setup checks that the password works, that a wrong one does not and that anonymous requests are refused, before the site is published. There is no user name (the application asks for the password only); you can change the password at any time with a helper script. A fresh install adds two sample watches that fetch third-party sites; they are removed before the first start, and the application's version check is switched off.

Safe by design against server-side request forgery: a service that fetches whatever address you give it can be pointed at your own network. The application refuses to fetch private, loopback, link-local and cloud-metadata addresses and file:// URLs, including names that resolve to them; the tests prove it for the EC2 metadata address, loopback, private ranges and a name that resolves to loopback. As a second layer the instance bars its containers from the EC2 metadata service with a firewall rule that survives reboots; we measured that without this rule a container does reach the metadata service. The consequence is that you cannot monitor pages on private addresses with this setup.

HTTPS: Apache is configured as a reverse proxy and a free Let's Encrypt certificate is requested for your domain with certbot. The application runs as an unprivileged user and listens only on the loopback interface.

Patched base: Ubuntu 24.04 LTS built through an automated EC2 Image Builder pipeline, with security updates applied at build time.

What you should know

No browser is installed, so JavaScript-rendered pages cannot be watched (plain HTML pages, JSON and text can). No mail server is configured: notifications go to the services you set up in the application, and email needs your own SMTP server in the notification address. Memory use was about 95 to 120 MB for the application and about 600 MB for the whole host, so a t3.small (2 GB) is the recommended starting size.

Licence and attribution

Built on the open-source changedetection.io (Apache-2.0). The image is unmodified; its libraries carry their own open-source licences. Not affiliated with, endorsed by, or sponsored by the authors of changedetection.io or its hosted service.

Getting Started Launch the AMI and open ports 22, 80 and 443 in the security group SSH in and answer the setup prompts (domain and admin email) Open https://your-domain/  and sign in with the password printed at the end of setup Add the address of a page to watch, choose how often to check and set up a notification

A domain name with an A record pointing at the instance is required, because the site is served over HTTPS.

This AMI is built and supported by Perimattic.

Book a free setup consultation at https://cal.com/gaurav-pareek-perimattic/marketplace-setup-consultations  or email us at aws-support@perimattic.com .

Support Managed and supported by Perimattic, a cloud infrastructure company with 13+ years of experience serving global clients. We offer free setup assistance, custom integrations, infrastructure consulting, and 24/7 support.