Security finding
Something was added to the pages since the last crawl that looks like tampering
Security Warning Severity: High
Part of the audit Unexpected changes. Finding id: security.defacementSigns.
What it costs you
If you did not make this change, someone else can edit your site. Added scripts read what visitors type, hidden links lend your reputation to other sites, and a redirect sends your visitors away.
What to do
Ask whoever deploys the site and whoever manages tags whether they made the change. If nobody did, act as described below.
What it checks
- New script from another site
- New hidden links or text
- New embedded frame
- New redirect added
- Page content replaced
- Spam words added to pages
How to fix it
Confirm the change, or treat it as a break-in
- Compare with the deploy history and the tag manager's version history for the days since the last crawl.
- If the change is yours: dismiss the finding.
- If it is not: keep a copy of the changed files and the server logs, then restore the site from a clean backup or the repository.
- Change the passwords and keys of the CMS, hosting, FTP or SSH and database, and remove accounts you do not recognise.
- Update the CMS and its plugins before going live again; an old plugin is the usual way in.
How to check: Recrawl: the added element is gone and no new one appears.
A real case
Google tracked 760,935 incidents of hijacked websites between July 2014 and June 2015; over 12% of the sites were attacked again within 30 days of cleaning up.
Thresholds
| Name | Default | Meaning |
|---|---|---|
replaced_title_similarity | 0.2 | A page counts as replaced when its new title shares less than this share of words with the old one (0 to 1). Adjustable default; not taken from a standard. |