Web compromise is the unauthorized alteration or control of a website or web server. It can mean an attacker changes page content, steals administrative access, installs a web shell, redirects visitors, or uses the server to host malicious files or phishing pages. Even limited access can let an intruder manipulate trust signals, collect credentials, or pivot deeper into the network.
This matters because public websites are often the first visible sign of intrusion and a common target for extortion, fraud, and malware delivery. In real attacks, web compromise may follow stolen passwords, vulnerable CMS plugins, weak server hardening, or unpatched software. Defenders look for unexpected file changes, new admin accounts, strange outbound connections, defacement, and abnormal server logs. Quick validation, patching, credential resets, and restoring clean backups are standard containment steps.