The 82,300-line service turns page changes into alerts
changedetection.io stores a list of URLs, fetches them on a schedule, compares the useful content, keeps history, and sends a notification when its rules match. Our checkout contained 1,134 files and about 82,300 source lines. The dashboard can watch ordinary HTML, JavaScript pages, PDFs, product prices, stock metadata, and JSON APIs.
Filtering is the main reason to choose it over a tiny polling script. Watches can select content with CSS, XPath 1 or 2, JSONPath, jq, and regular expressions. Conditional actions can require a keyword or numeric threshold. Browser Steps can fill fields, click controls, accept cookies, and prepare a page before extraction. Notifications use Apprise URLs for email, chat services, webhooks, and syslog.
JavaScript monitoring adds a second browser service
The basic fetcher is enough for server-rendered pages and APIs. JavaScript rendering, Browser Steps, screenshots, and the Visual Selector need Chrome through the Playwright path. The supplied compose file exposes changedetection.io on 127.0.0.1:5000, persists data in /datastore, and shows a separate sockpuppetbrowser service reached at port 3000. Those lines are commented until the operator enables them and sets PLAYWRIGHT_DRIVER_URL.
A real browser changes the deployment from one container to a small service pair. Preserve and back up the datastore volume. Notification URLs and proxy configuration may contain credentials, so keep them secret and do not expose the dashboard on an unauthenticated public port.
What happened when we ran it
Our sandbox installed changedetection.io in 70 seconds, adding 197 Python packages and occupying 479 MB. The build completed successfully in 4 seconds. The checkout was 16.4 MB before dependencies, with 1,134 files and roughly 82,300 source lines. It included 6 CI workflow files, a Dockerfile, and a compose file, which matches the project's container-first setup.
The lab did not run a test suite because it found no tests script or target; the measured result says skipped, not passed. Our scan also found no top-level tests directory. That does not claim the project has no tests elsewhere or no upstream CI. It means this checkout did not offer the lab a recognized command, so this review has no fresh passing test count to use as assurance.
Pip-audit reported 9 known vulnerabilities in the installed environment. The supplied measurement does not list affected packages, advisory IDs, or severities, so we cannot say which features are exposed or whether an upgrade resolves them. Nine findings are enough to block a blind public deployment. Resolve each advisory against the image you plan to run, then repeat the audit before release.
Bot protection can defeat every available fetcher
Open issue 4343 reports a target returning HTTP 403 under changedetection.io 0.55.8 with the plain fetcher, Playwright, a residential proxy, a datacenter VPN, and curl with browser headers. The report attributes the refusal to the site's Cloudflare Bot Management rules and asks for a clearer error. Changing fetchers or paying for a proxy cannot guarantee that a site permits automated access.
The README places legal responsibility on the user for website terms, robots rules, access policies, and applicable law. Browser Steps can enter credentials and navigate an account, but permission to monitor and store that content is separate. A reliable deployment needs modest request intervals, ownership of each watch, and a plan for repeated 403 or 429 responses.
LLM rules can miss changes or send extra alerts
Optional LLM features can summarize a diff or judge a plain-language rule such as whether a price crossed a threshold. The README supports hosted providers and OpenAI-compatible local endpoints. It also says external providers receive page diffs and extracted text, placing API cost, privacy, and output validation on the operator.
Issue 4383 reports that transient HTTP 503 and 429 provider errors were not retried and could fall back to a raw diff notification. Issue 4385 describes malformed model JSON taking inconsistent paths: some responses suppress a change, while another parsing failure passes it through. Both were open when fetched. These failure modes make LLM intent unsuitable as the only control for compliance, safety, or financially significant alerts.
Release 0.60.4 is active, with 384 open items
Version 0.60.4 was released on September 10, 2026, the same day as the repository's latest push. GitHub showed 33,791 stars, 316 open issues, and 68 open pull requests. The release included an API method for deleting watch history, UI changes, translation work, an Apprise update, and a path-traversal test fix. Same-day code and issue activity show active maintenance, while 384 combined open items indicate a large support and review queue.
The Apache 2.0 license file sits beside COMMERCIAL_LICENCE.md, which says commercial activity involving hosting must execute a separate agreement. Organizations planning a paid hosted service should obtain written terms and legal advice rather than guess how those documents interact. External AI users must also decide which monitored content may leave the server.
urlwatch is smaller; Huginn is broader
Use changedetection.io when several capabilities belong together: a shared dashboard, visual filters, browser actions, stored diffs, price detection, schedules, and many notification channels. urlwatch suits a few text-based checks run from cron. Huginn fits a wider automation chain. Uptime Kuma is cleaner when response status and availability matter more than textual differences.
Our 479 MB install, 9 audit findings, and absent lab test target change the default recommendation. Trial the project behind local access with persistent storage and one notification route. Add Playwright only for sites that need it, then review bot blocks and LLM behavior before expanding the watch list.