Website defacement monitors

What it checks

A defacement monitor loads a page in a real browser, scripts and all, then reads three parts of it: its title, the text of its body and its meta description. Each part is judged by a model trained on real defaced sites, and gets a score for how likely it is to have been defaced. The page is flagged as defaced when any one part reads like a defacement.

Because the page is loaded in a browser, content written into it by a script - a common hiding place for injected spam - is read as a visitor would see it.

Mon doesn't compare the page with an earlier copy of itself. It judges whether the page looks defaced, so publishing new content, rewriting the page or redesigning the site doesn't set it off, and there's no baseline to reset after an update.

Adding one

Under Monitors, choose Add Monitor, then Defacement, and enter the URL of the page to watch, including http:// or https://. There's nothing else to set about the page itself - the rest of the form is the interval, timeout, maintenance windows and alerts.

To add several at once, choose Add several at once and paste one URL per line. A URL in the list without http:// or https:// is taken as https://. Watch every page an attacker would want: the home page, login, checkout.

How often

Loading a whole page in a browser is heavy, so a defacement monitor is checked at most once an hour, and as rarely as once a day. Mon chooses where the check runs from. The Timeout - 10 seconds to start with - is how long the page has to finish loading; raise it for a heavy page.

What it reports

State	Meaning	Monitor
Clean	Loaded, and no part reads like a defacement	Up
Defaced	One or more parts read like a defacement	Down
Didn't load	The page couldn't be opened, or didn't finish loading within the timeout	Down

The monitor's page shows the verdict of the last check beside its status, and an Integrity score for the page: how intact it looks, from 0 to 100% - the higher, the better. Under Page analysis, the title, meta description and body each have their own integrity, so you can see which part was hit. A part the page doesn't have, such as a missing meta description, reads N/A. Every check keeps its scores, on the Checks page.

A defaced page raises a Monitor Down alert on the monitor's contacts - by default on the 1st failed check - and a Monitor Up alert when it's clean again. The down email includes the page's scores. See Alerts and contacts.

When a page is defaced

Take the page down or restore it from a known good copy, then find how the attacker got in: change passwords and keys, update the site's software and plugins, and check for anything else that was changed.

Plans

Defacement monitors come with every paid plan. On the Free plan the type is shown locked in the Add Monitor list. See Billing.

Defacement monitors and keyword monitors

A keyword monitor with Keyword must exist off can alert you when a word you name appears - a phrase an attacker has used before, say. It reads the page without running its scripts, and only knows the words you give it. A defacement monitor needs no list of words, and reads the page after its scripts have run.

A defacement monitor doesn't look at the status code: a page that loads with an error status is scored like any other. To know the page is up and answering quickly, watch it with an HTTP monitor as well.