Server-side compromise means an attacker has gained control over a web server or the path the server uses to process requests. That control may come from stolen credentials, a vulnerable service, a malicious module, or tampered configuration. Unlike a client-side attack, the abuse happens on the host that delivers the website, so the visible page can still look normal while the server quietly changes what visitors receive.
This matters because a compromised server sits at a trusted point in the network. Attackers can use it to redirect traffic, inject content, steal data, or create persistence that survives simple cleanup. In real incidents, malicious code may be loaded by the server itself, letting the attacker alter responses without changing the site’s front end. Defenders look for unexpected modules, configuration drift, unusual redirects, file integrity changes, and access anomalies. Rebuilding or validating the server is often safer than only removing the obvious malicious file.