An indicator of compromise is a technical observation that may point to an attack or unauthorized access to a system.
Definition source: NIST: Indicator of Compromise. Read on 24 October 2026. The practical questions on this page help you define the issue with your administrator.
What does an indicator establish?
NIST describes technical observations that may suggest an imminent, ongoing or previous attack. An indicator is therefore a starting point for investigation. Examples include an unexpected file or a connection mentioned in a report.
Its meaning depends on the source and the setting in which the observation occurs.
A confirmed web shellA web shell is a script on a web server that lets an attacker keep remote access to that server. is a different finding from a match against a filename alone. Always ask what was actually compared. A line containing the word suspicious is not enough to decide that your site was hacked or that a warning can safely be ignored.
How do you record a useful observation?
Which PHP version does your site report?
We read only what your site already sends in public: the headers and the top of the homepage. No scan, no login.
Keep the original notice with its time, affected site and the source of the check. If the observation appears in an error logAn error log is a file where your website's software writes down what went wrong, with the time and place. It is the first thing to check when a site breaks., have the administrator preserve relevant context. A single line can omit events needed to understand it.
Do not share a complete log containing personal information in a public forum.
Ask whether the observation belongs to the current installation. An old notice about a removed test environment may mean something different from the same finding on your live checkout. The period covered by the source also matters.
Keep that information together when passing the warning to someone else.
How should you use a published indicator?
A developer may publish indicators for a specific incident in a security advisoryA security advisory is an official notice from a software maker about a security weakness: what it is, which versions are affected and how to fix it.. Have an administrator assess whether that advice applies to your software and environment. Do not copy a list of blocks from a message without understanding its scope.
Incorrect use can interfere with legitimate traffic or administration.
Finding no match means only that the particular check found no match within its scope. It does not rule out every possible attack. Ask which sources were used, what was examined and which areas remained outside view.
This makes a negative result useful without overstating what it establishes.
When should you ask for help?
Get help with a specific warning you cannot interpret, several unexplained changes or uncertainty about the sender’s authenticity. Ask the investigator to distinguish confirmed observations from explanations that still need testing. Request the evidence supporting each conclusion rather than only a coloured status label.
Avoid definitive language in your own record when only a suspicion has been established. Record which warning arrived, when it arrived and who is investigating it. That gives the next administrator a verifiable starting point without spreading an unsupported conclusion about your website or a supplier.
Prepare your request for help
Write a short note for your administrator naming the page, the time of the observation and what your team changed beforehand. Include the original warning if one is available. Keep facts separate from suspicions.
Describing what you saw on a particular page is more useful than stating a conclusion that has not been investigated.
For routine maintenance of a PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. site, review the existing PHP services. First discuss which question fits the service. This glossary page explains a term; it does not examine your installation or promise recovery.
For a possible incident, establish the expertise needed and which components someone can actually assess before agreeing the work.
Agree who receives the findings and who follows up an open question. Request a report identifying the areas checked, the date and the limitations. That helps you decide on a next step without treating general reassurance as evidence.
Your own first step is to record the observation and pass it to the administrator responsible for the site.
Frequently asked questions
Does finding no IoC mean my site is safe?
No. That result applies to the indicators and information examined. Ask about the scope and limitations of the check before using its result to make a decision.
What should I tell my administrator?
Provide the page, time and original warning. Describe what you observed and what remains a suspicion. Do not submit passwords, keys or customer personal information through an ordinary contact form.
Can the PHP Exposure Check establish this?
No. It reports public information such as the PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. exposed by your server. It does not investigate malware, access permissions or interception of form input.
Have your specific warning assessed separately.