Cache integrity monitoring (4 encodings, SHA-256)

Cache integrity monitoring is an ongoing (monthly) service: we set up a regular automatic check that your site serves identical content across all compression variants. For an agreed set of important URLs we request the resource in four encodings — identity (uncompressed), Brotli (br), gzip (gz), zstd (zst) — decode each and compare the SHA-256 of the decoded content: normally all four hashes must match. A mismatch means that somewhere along the path (CDN, caching proxy, compression layer) the variants have desynced — both a delivery bug and a potential sign of cache poisoning, where some visitors get the wrong content (to be honest: this is an indirect signal, not full attack detection — the cause of a mismatch is not necessarily an attack). On a mismatch you get an alert with details (which URL, which encodings diverged). Honestly about the essence of the service: this is detection and alerting, NOT fixing — we do not configure your CDN and compression layer for you and do not "fix the cache"; remediating the cause is separate work (your team or us separately). And it is not a guarantee that the cache will never break or that the site is secure: monitoring only lets you know sooner and about a specific class of problem, it does not insure against it. Coverage is only what is configured: we watch an agreed list of URLs and encodings; pages and endpoints outside the list are not checked. As the site grows, new and changed addresses do not appear in the check automatically — the list needs to be expanded and kept current together with you. False positives are possible on legitimate dynamics (personalized or frequently changing content, correct Vary) — we configure and tune the thresholds and the URL list, perfect accuracy does not exist. Access to the site and agreement on the URL list are needed; someone must react to an alert, otherwise the value is lost. This is a narrow but rare check — most monitoring systems do not do it. An important boundary: this is ongoing cache integrity monitoring, not a one-time performance or security audit and not CDN setup/maintenance. If the site is small, static and served in a single encoding without a CDN or caching layers, there is almost nothing to compare and you most likely do not need this service. Picture this: instead of "some users complain about a broken page while it opens fine for us" you immediately see an alert that the gzip variant of one page has diverged from the rest — and you know where to look for the cause. The base price starts from 12,000 ₽ per month; it depends on the number of URLs and the check frequency.

• Some visitors see a broken or wrong page while for you "everything works".
• You use a CDN and compression but are not sure all variants serve the same content.
• You fear cache poisoning but have no way to catch it.
• You learn about content-delivery problems only from customer complaints.

• Setup of the check over an agreed list of important URLs
• Requests in 4 encodings: identity, Brotli, gzip, zstd
• SHA-256 comparison of the decoded content (normal — all match)
• Alerts on a mismatch: which URL and which encodings diverged
• Signs of cache poisoning and variant desync
• Configuring and tuning thresholds and the URL list (fewer false positives)
• Monthly continuous operation of the check
• An alert channel of your choice (email, messenger, webhook)

• You learn about encoding desync quickly, not from complaints
• You see which URL and which encoding serve the wrong content
• You notice potential cache poisoning earlier
• You know where to look to remediate the cause (separately)

• We agree on the list of important URLs, encodings and alert channel; collect access
• We set up the regular SHA-256 check across 4 encodings and the thresholds
• We launch the continuous check and tune it against false positives

• Will you fix the cache and CDN if you find a problem?

  No. This is monitoring: it detects the mismatch and sends an alert. Configuring the CDN, the compression layer and remediating the cause is done by your team or by us separately — it is not part of the monitoring service itself.

• Is this a one-time check or a subscription?

  It is an ongoing service with monthly billing: we set up the check once, then it runs continuously and sends alerts. A one-time integrity check is a different format (it can be done within an audit).

• Will there be false positives on dynamic content?

  There can be: personalized or frequently changing pages and a correct Vary produce legitimate differences. That is why we agree on a list of suitable URLs and tune the thresholds; false positives cannot be fully eliminated but can be minimized.