A compromised website is a legitimate site that an unauthorized party has altered or abused. Attackers may insert malicious code, add hidden pages, or misuse the site to redirect visitors. Because the site may otherwise appear trustworthy, visitors and security tools can overlook the abuse.
In cyber attacks, compromised websites can serve as stepping stones: for example, injected server-side code may route visitors through a redirect chain to a scam or malware page. Defenders should investigate unexpected redirects and changes to site files, keep software and credentials secure, and restore clean versions of affected content. Finding and removing the injected code matters, but administrators should also check how access was gained to reduce the chance of reinfection.