Attacks on websites have become noticeably more frequent over the past few months. Anyone who runs websites ends up tilting at windmills: we update, change passwords, configure firewalls, vet plugins – and there is always a new method, a new gap, a new trick. With AI now widely available, attackers also work faster, cheaper and at a larger scale than ever.
Defence is not something you can stop doing, but there is another weapon worth just as much: catching problems fast. That is what this post is about – and what we have done about it.
Where does the trouble come from?
Infections that keep coming back
Some infections “heal” themselves. You clean the site, everything looks fine, and a few days later the same thing is back in the same place. Somewhere a hidden piece of code, an unknown admin account or an entry written into the database is left behind, rebuilding the malware again and again. Removing the symptom is not enough with these; you have to find the source as well.
The neighbour’s infection
Shared hosting is like an apartment block. A single server often runs dozens of independent websites. If the hosting is not configured properly, malware from another, infected site can barge its way into the sites we look after too – however up to date and clean we keep our own. In that case the site gets infected through no fault of its own, and the key to the fix is not entirely in our hands either.
What are the attackers after?
The most common type of infection is defacement, meaning the site’s content is tampered with. The goal is usually one of two things:
- Hijacking traffic: visitors are redirected to a site that cannot advertise on the ad platforms – online casinos, crypto “investments”, pharmacy shops and the like. Your traffic becomes their free advertising.
- SEO link building: hidden links and text are planted on your site so that Google passes your site’s credibility on to theirs.
Visible and invisible infections
When you can see it
An infection either has visible elements or it does not. If it does, it is typically something odd on the page – a link that does not belong, a block of text in a foreign language – pointing to an external site, or the site simply redirects visitors straight to the target.
When you cannot
The worse case is when visitors see nothing at all. The malware only shows something different to Google’s crawler, with one message: “what matters is not here, it is over there”. We recently dealt with exactly that: the site worked flawlessly for visitors, while Google’s crawler was served gambling spam instead for more than two weeks. The trick is called cloaking, and it is dangerous precisely because the owners never run into it themselves – until strange text appears under the site’s name in the search results, or traffic drops off a cliff.
Why does nobody notice right away?
Because neither the developer nor the owner is the webshop’s most frequent visitor. Owners mostly work in the admin area: handling orders, uploading products. Developers live in the code and the staging environment. The homepage, the categories and the product pages are viewed mostly by customers – and they do not tell you, they just leave. So an infection can go unnoticed for days, even weeks.
From now on, we check every hour
For our clients, that is now over. I have built a monitoring system that checks the state of the sites we look after every hour. It fetches every monitored address in three ways: as an ordinary browser, as Google’s crawler, and as a visitor arriving from Google’s search results – since the craftier infections show something different to exactly those visitors.
Each time, it checks the following:
- Is the site up? Does it respond at all, and with a proper page rather than an error?
- How long does it take to load? If it takes more than 5 seconds on two consecutive checks, that is suspicious: it can point to a load attack, endless bot requests or a runaway process. (We covered the other reasons for a slow site in an earlier post.)
- Does it redirect elsewhere? If the site sends visitors to a foreign domain, or they do not end up where they normally do, that is an immediate alert.
- Has the page title changed? Tampering with the title shown on the browser tab and in search results is one of the most telling signs of defacement.
- Has the page size changed significantly? If the homepage suddenly shrinks to a fraction of its size or swells to several times it, something has replaced or stuffed its content.
- Have suspicious words appeared? Casino, gambling, pharmacy ads, “hacked by” and the other typical spam phrases – only those that were not on the page before count.
- Have strange characters appeared? Blocks of Japanese or Chinese text, even encoded into links: one of the most characteristic patterns of SEO spam.
- Does everyone see the same thing? If Google’s crawler or a visitor coming from Google gets a different title, different content or a different redirect than an ordinary visitor, that is cloaking – exactly the invisible infection described above.
All of this is measured against a clean starting point. On the first error-free check, the system records what the site’s “normal” state looks like and compares every later check to it. When a site changes on purpose – a redesign, a new title – we accept the new state with a single click.
When something is wrong, it tells us immediately
Whenever it finds a deviation, it emails us straight away with which site changed and how – for redirects, including the full path. While the problem lasts it sends a reminder every six hours, and a separate email when the site is back to normal. After the alert, we take over: we investigate, track down the source and clean up the site.
What this means for you as our client
An infection caught in time can often be handled without any fuss, before it does any damage: before Google flags the site, before casino ads show up under its name in search results, and before a single customer of yours ends up on a suspicious page. The later it comes to light, the more expensive it gets: on top of the cleanup, lost search rankings and customer trust have to be rebuilt as well.
The service is live as of today and completely free for our clients. You do not need to install anything, and it does not slow your site down: the system looks at it from the outside, through a visitor’s eyes. It does not replace prevention, of course – an up-to-date system, well-chosen security plugins and regular backups are still the foundation. The monitor is there so that if something does go wrong, we know about it within hours, not weeks.
Want to know whether your site is among the ones we monitor – or are we not working together yet, but you would like an extra pair of eyes on your site? Drop us a line and we will take a look!