Websites, Domains & Internet Infrastructure · WDH-044

Can a website be compromised without the owner’s knowledge?¶

Yes. A website can be altered or misused through stolen credentials, vulnerable software, insecure plugins, malicious insiders or compromised hosting accounts.

An attacker may upload files, create hidden pages, redirect visitors, alter payment details or use the server for another purpose while the visible site appears normal.

Test compromise as an alternative explanation¶

Look for:

• unexpected administrator logins;
• new user accounts;
• file or configuration changes;
• password resets;
• security alerts;
• malware findings;
• support tickets;
• traffic anomalies; and
• communications showing when the owner became aware.

Establish when the compromise occurred, when the material appeared and when the owner learned of it.

Do not accept or reject a compromise claim merely on assertion. A suspect may falsely blame an attacker, while a genuine owner may have been unaware.