No it's a bit more primitive than that. :) For basic IDS, it's a Python program I wrote a few years ago which does a recursive wget over my entire website, the

No it's a bit more primitive than that. :) For basic IDS, it's a Python program I wrote a few years ago which does a recursive wget over my entire website, then generates SHA256 hashes of each page. Then it compares the hashes against the previous scan, and emails me if there are any changes. For very dynamic websites this doesn't work very well - luckily my site is almost 100% static so I can just whitelist the few allowed changes to prevent false-positive alerts. I also monitor my DNS and WHOIS for changes, so that if my domain or DNS is hijacked, then I hopefully will know about it more quickly.