Guide

Your site has been defaced. Here's the calm, correct order of operations.

by Ken Armitt, Founder · updated 31 July 2026

A defacement means an attacker gained write access and replaced a page to prove it. Don't just restore a backup — that puts the same vulnerable site back online with the entry point still open. Preserve the evidence, switch to a holding page, find and close the way in, then restore hardened. Assume they could also read your files and database until you've proven otherwise.

What a defacement actually tells you

Someone had enough access to write to your site. That is the important fact — not the message they left. The same access that let them replace your homepage usually let them plant backdoors, read your database, and add themselves as users. Treating it as "just the homepage" is the mistake that turns one incident into three.

The order of operations

1. Preserve evidence first. Screenshot the defaced page, save the URL and timestamp, and keep server logs. If you may need to report a breach later, this is the record.
2. Contain, don't scrub. Put up a holding page or maintenance mode rather than frantically deleting files — a forensic copy first means you can still find how they got in.
3. Find the entry point. Outdated plugin, stolen credential, a writable upload directory. Named and closed, or it happens again.
4. Clean and harden, then restore. Remove every injected file and backdoor, rotate all credentials, and bring the site back harder than it was.

Why "restore the backup" isn't the fix

A backup restores the files — including, often, the vulnerability that was exploited, and sometimes the backdoor itself if the backup was taken after compromise. Restore is part of recovery, never the whole of it. The question that decides whether you're safe is "how did they get in?", and a backup doesn't answer it.