Malware
Defacement
Defacement is an attacker replacing the public face of a site with their own page or message. It is the loud kind of hack, done for protest, bragging, or to show off access.
How it is measured
You see it directly: the homepage shows a different page, a banner, or a skull and a handle. Uptime monitors with a content check catch it by looking for expected text, and a hash of the homepage HTML changing without a deploy is another signal.
Check file modification times on `index.php`, `index.html`, and theme templates, then read the access log for the request that wrote them. The defaced page is the visible symptom, not the root cause.
Worked example
A hobby chess club's site loads a black page reading "Owned by r00t_kid" on a Saturday morning. A check shows `index.php` was edited at 03:48, and the access log has a POST to an old file-manager plugin at 03:47 from a Romanian address.
The restore from the previous night's backup brings the homepage back in ten minutes. The plugin is removed. An uptime check for the string "Chess Club" is added so the next change would page the owner.
How it differs
Defacement is visible and wants to be seen. SEO spam is quiet and wants to stay hidden, stuffing pages with pharma or casino links that only search engines see. A webshell is usually how the attacker made the change. A defacement tells you someone had write access; the file they left behind tells you how to stop them returning.
Common errors
Restoring the page and not closing the hole. Restoring a backup that already held the backdoor. Not preserving logs first. Assuming a joke page means nothing else was touched. Checking only the homepage while subpages carry spam. Rushing to a restore before taking a copy of the evidence.
In practice
Add a content check to your uptime monitor on the homepage and a second page. When defacement happens, snapshot the files and logs, find the entry point, and then restore. Rotate every credential the server held.