Defacement is an unauthorized change to the visible content or appearance of a website.
Definition source: MITRE ATT&CK: External Defacement. Read on 24 October 2026. The practical questions on this page help you define the issue with your administrator.
What does defacement mean for your website?
You might see a message or image that your team did not publish. MITRE describes external defacement as changing publicly visible systems to deliver messages or mislead people. This term concerns the visible change.
It does not establish how someone obtained the access needed to make it.
SEO spamSEO spam on a hacked website is unwanted content added to redirect search traffic toward other purposes. has a different emphasis: using unwanted content for search traffic. Both may occur on a website, but not every unfamiliar page should immediately be called defacement. Start with what you can establish: what changed, where it is visible and who could have published that change.
How do you recognise an unauthorized change?
Which PHP version does your site report?
We read only what your site already sends in public: the headers and the top of the homepage. No scan, no login.
First check that the change belongs to your own domainA domain name is the address people type to reach your website, such as yourcompany.com. It points visitors to wherever your site is hosted. and was not planned by your team. A forgotten campaign, accidentally published test page or styling error may also look unexpected. An unexplained change is an indicator of compromiseAn indicator of compromise is a technical observation that may point to an attack or unauthorized access to a system. that needs assessment rather than an immediate attribution to an attacker.
Record the page, time and visible change. Preserve a screenshot without personal information for the authorized administrator. Do not follow links in the unfamiliar message.
Ask whether other parts of the site or other sites under the same account need examination; do not infer their condition from the homepage alone.
What should happen before restoring the old page?
Have the administrator record the affected state and decide how visitors should be protected. Then discuss restoring the intended content. A backupA backup is a separate copy of your website's files and database, so you can bring the site back after a mistake, a hack or a failed update. may help, but should be assessed first.
Its date does not automatically establish that it contains no unwanted changes or that it fits the current business information.
Alongside visible recovery, request investigation of the access that allowed the change. Removing only the message leaves that question unanswered. Agree who checks accounts, publishing permissions and relevant changes.
Record the actions and findings so it is clear which step was actually completed and which still needs work.
When should you ask for help?
Get help if the change returns, you cannot access administration or its scope is unknown. Explain which functions visitors need and which content is wrong. The administrator can then consider a temporary measure without unnecessarily interrupting other parts of the business.
A message left on a page does not prove who was responsible or which information was accessed. Do not repeat its claims as facts. Ask the investigator separately about confirmed access, visible changes and any evidence that information was affected.
A normal homepage after recovery does not answer that final question.
Prepare your request for help
Write a short note for your administrator naming the page, the time of the observation and what your team changed beforehand. Include the original warning if one is available. Keep facts separate from suspicions.
Describing what you saw on a particular page is more useful than stating a conclusion that has not been investigated.
For routine maintenance of a PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. site, review the existing PHP services. First discuss which question fits the service. This glossary page explains a term; it does not examine your installation or promise recovery.
For a possible incident, establish the expertise needed and which components someone can actually assess before agreeing the work.
Agree who receives the findings and who follows up an open question. Request a report identifying the areas checked, the date and the limitations. That helps you decide on a next step without treating general reassurance as evidence.
Your own first step is to record the observation and pass it to the administrator responsible for the site.
Frequently asked questions
Is my site recovered once the unwanted message is gone?
The visible content may have been restored. Also ask which access was examined and whether the cause was established. Those are separate conclusions that belong in the report.
What should I tell my administrator?
Provide the page, time and original warning. Describe what you observed and what remains a suspicion. Do not submit passwords, keys or customer personal information through an ordinary contact form.
Can the PHP Exposure Check establish this?
No. It reports public information such as the PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. exposed by your server. It does not investigate malware, access permissions or interception of form input.
Have your specific warning assessed separately.