Website Defacement: What to Do When Your Homepage Has Been Replaced

What defacement actually is

Website defacement is exactly what it sounds like: an attacker gains access to your site and replaces some or all of your visible content — usually the homepage — with their own message, image, or claim of responsibility. Unlike most of the hack types covered elsewhere on this site, defacement isn't trying to hide. It's the opposite: it's built to be seen.

Research into these attacks (based on datasets of millions of recorded incidents on public defacement archives like Zone-H) shows a consistent pattern in what gets left behind: a "hacked by" signature, an ideological or political message, or an explanation of the attacker's motive. This isn't vandalism without a purpose — it's usually one of three things: making a socio-political statement, building reputation within attacker communities by publicly claiming credit for a successful breach, or demonstrating that access was achieved at all, sometimes as a precursor to a more serious follow-up action.

The one silver lining: you know immediately

Compare this to the pharma hack covered elsewhere on this site, where cloaked spam content is deliberately hidden from you and shown only to search engine crawlers — you can browse your own homepage fifty times and see nothing wrong while Google's index quietly fills with spam. Defacement is the mirror image of that. There's no cloaking, no conditional logic checking who's asking. The compromised page is compromised for everyone, all the time, starting the moment it happens.

That visibility is precisely why attackers who want to stay embedded for financial gain — the ones running spam injection or planting a webshell for long-term access — almost never deface a site. Defacement burns the access. It's a statement, not a strategy for staying hidden. If your goal as an attacker is ongoing exploitation, the last thing you want is the owner logging in within minutes because a customer called to ask why the homepage looks wrong.

First steps: contain it before you fix it

The visible damage is not the actual problem — it's a symptom of the actual problem, which is that someone got in. Acting on the visible damage first, without addressing the access, is how a defaced site becomes a defaced-again site a week later.

• Take the site offline or into maintenance mode immediately. Every minute the defaced page stays live is a minute of public exposure and reputational damage compounding. A short, controlled "we're performing maintenance" message is better than an extended window of a stranger's message sitting on your homepage.
• Do not simply restore the old homepage and call it fixed. This is the same mistake covered in restoring from a backup after a hack: putting the original content back changes what visitors see, but it does nothing about how the attacker got in. If that path is still open, they can deface it again just as easily — sometimes within hours of the "fix."
• Preserve evidence before you clean anything up. If you can, take a screenshot or save a copy of the defaced page and check your server's access logs around the time it happened. This can help identify the entry point and is useful if you later need to explain the incident to customers, a host, or an insurer.

How defacement actually happens technically

Defacement isn't a distinct vulnerability class of its own — it's what an attacker does after gaining access through one of the same access vectors covered elsewhere on this site: a vulnerable, unpatched plugin or theme, stolen or guessed administrator credentials, or a webshell that was planted during an earlier, unnoticed compromise and is only being used now to make a visible change. In other words, defacement is frequently the loud, final step of an intrusion that started quietly — which is exactly why the fix has to go back to that original entry point, not just the page that got changed.

Full recovery, not just a cosmetic one

1. Treat it as a complete compromise. Work through the full malware removal process: check for unfamiliar admin users, scan for injected code across files and the database, replace WordPress core files wholesale, and audit every active plugin and theme.
2. Check specifically for a webshell. If the defacement was the visible half of a longer intrusion, there may be a persistence mechanism you haven't found yet — see what a webshell is and how to find one.
3. Close the actual entry point and rotate every credential. Update every plugin and theme, remove anything abandoned, and change every password and API key connected to the site. If you don't know exactly how they got in, assume the same door is still unlocked.
4. Address the reputational side honestly. If the defaced page was live for any meaningful length of time, some visitors and customers saw it. A short, direct note — what happened, that it's resolved, and what you did about it — does more for trust than pretending it never occurred.