Website defacement is an attack in which intruders change the visible content of a website, typically replacing its pages with their own messages, images or propaganda.
How website defacement works
To deface a site, attackers need write access to its content or files. Typical paths:
- exploiting vulnerabilities in content management systems and their plugins, such as outdated WordPress, Joomla or Drupal installations;
- injection flaws such as SQL injection or code injection, followed by uploading a web shell;
- stolen or weak passwords for CMS admin panels, FTP or hosting control panels;
- compromising a shared hosting server or a DNS record and redirecting the domain to another page.
MITRE ATT&CK describes the technique as External Defacement (T1491.002). Defacers often leave a signature and register their “trophies” in public archives such as Zone-H.
Why website defacement matters
Defacement is a visible, symbolic attack favoured by hacktivists during political conflicts. In January 2022, dozens of Ukrainian government websites were defaced with threatening messages shortly before destructive wiper attacks were discovered. Even when no data is stolen, defacement damages reputation and trust, may lead to search engine and browser warnings, and shows that the attacker had control of the server – which they could also use to plant malware, phishing pages or SEO spam.
How to prevent website defacement
- Keep the CMS, themes and plugins updated and remove unused components.
- Protect admin accounts with strong passwords and multi-factor authentication.
- Use a web application firewall and file integrity monitoring to detect changes.
- Keep offline backups so that the site can be restored quickly, then investigate how the attackers got in.
