A method of data security, comprising: accessing, by a first set of servers, website content file attribute data for website files used by one of a second set of servers to host website content; determining a status of change of the website files by comparing a file change date attribute value to a most recently analyzed attribute value for the website files that is accessible in a non-transient computer accessible memory by at least one of the first set of servers; based on the determining, downloading website files from at least one of the second set of servers to the non-transient memory that have not been analyzed since being changed; analyzing the downloaded website files for a security risk by performing file integrity techniques on the downloaded website files to identify suspicious or known signatures contained in the downloaded website files; based on the analyzing, decoding, with a server of the first set of servers, scripting code that is detected within the downloaded website files by: parsing the scripting code to separate the scripting code into a plurality of components to determine a function the scripting code is intended to perform by examining variables and commands of the scripting code; analyzing each component of the plurality of components to determine if the component presents a security risk; and flagging a subset of components of the plurality of components that present the security risk; executing portions of the scripting code corresponding to the subset of components that were flagged using one of the first set of servers that is configured to isolate and monitor execution of the portions of the scripting code; determining security breach content in the downloaded website files based on a monitoring of the execution of the portions of the scripting code; and performing an in-line code repair of the website files by replacing at least one portion of the scripting code corresponding to the security breach content with known proper code. accessing, by a first set of servers, website content file attribute data for website files used by one of a second set of servers to host website content; determining a status of change of the website files by comparing a file change date attribute value to a most recently analyzed attribute value for the website files that is accessible in a non-transient computer accessible memory by at least one of the first set of servers; based on the determining, downloading website files from at least one of the second set of servers to the non-transient memory that have not been analyzed since being changed; analyzing the downloaded website files for a security risk by performing file integrity techniques on the downloaded website files to identify suspicious or known signatures contained in the downloaded website files; based on the analyzing, decoding, with a server of the first set of servers, scripting code that is detected within the downloaded website files by: parsing the scripting code to separate the scripting code into a plurality of components to determine a function the scripting code is intended to perform by examining variables and commands of the scripting code; analyzing each component of the plurality of components to determine if the component presents a security risk; and flagging a subset of components of the plurality of components that present the security risk; parsing the scripting code to separate the scripting code into a plurality of components to determine a function the scripting code is intended to perform by examining variables and commands of the scripting code; analyzing each component of the plurality of components to determine if the component presents a security risk; and flagging a subset of components of the plurality of components that present the security risk; executing portions of the scripting code corresponding to the subset of components that were flagged using one of the first set of servers that is configured to isolate and monitor execution of the portions of the scripting code; determining security breach content in the downloaded website files based on a monitoring of the execution of the portions of the scripting code; and performing an in-line code repair of the website files by replacing at least one portion of the scripting code corresponding to the security breach content with known proper code.