Web server compromise is the unauthorized control of a web server by an attacker. Once inside, the attacker can change page content, inject scripts, alter redirects, add hidden forms, or modify server behavior to support fraud, phishing, malware delivery, or data theft. A compromise may come from stolen credentials, vulnerable software, misconfiguration, exposed admin panels, or a web application flaw.
It matters because users and security tools often trust a legitimate domain more than a suspicious one. If an attacker controls a real server, they can abuse that trust to make malicious traffic look normal, hide payloads behind ordinary pages, or redirect visitors through a chain of sites. Defenders look for unexpected file changes, new accounts, unusual outbound connections, altered DNS or redirect rules, and logs that show admin actions outside normal patterns. Fast isolation and credential resets are critical when compromise is suspected.