The main goal of this final paper was to identify changes to web pages using HTML structure. As part of the main goal, the detection of malicious code by filtering HTML tags and their associated attributes was also researched. The method of detecting changes on a web page and the way in which newly inserted HTML structures are removed from the structure are described. The method was implemented using existing software support for parsing HTML documents. The found inserted structure is tested by an algorithm for finding a malicious structure. With the malware detection algorithm, testing is performed in such a way that the found HTML tags return the attributes and look at the values of these attributes. Checking attribute values looks for CSS combinations that can be used to hide structures from the screen. Combinations are added to the security index parameter, which tells us how much the condition for maliciousness has been met. The algorithm has two versions, and in one version the latest version of the equipped HTML document is submitted, and the entire document is checked. In the second version, two HTML documents are submitted, the latest and the second latest version of the website, and the result of the algorithm is an assessment of maliciousness and a part of the HTML structure in which the algorithm finds dangerous CSS combinations. The method and algorithms used proved to be successful because several malicious pages were detected for which they were manually confirmed as malicious. A way to improve the algorithm is proposed, which includes setting the security index and further researching the CSS combinations used to hide inserted HTML structures