How to tell whether a site is compromised

A site that has been taken is usually not defaced. Defacement is rare because it ends the access; what is common is spam pages, redirects that only fire for visitors arriving from a search engine, and mail sent from your server. To you, logged in and typing the address directly, everything looks fine.

The signals

• Search results for your domain that you did not write.
• Mail from your server bouncing in volumes you cannot explain.
• A jump in CPU or outbound traffic with no jump in visitors.
• A visitor reporting a redirect you cannot reproduce.
• Your host or a browser warning about the site.

Four commands

# 1. files changed in the last week, ignoring the ones that should change\nfind /var/www/site -type f -mtime -7 -not -path '*/storage/*' -not -path '*/cache/*' | head -50\n\n# 2. PHP where PHP has no business being\nfind /var/www/site/uploads /var/www/site/public/img -name '*.php*' 2>/dev/null\n\n# 3. the shapes an injected shell takes\ngrep -rEl 'eval\(|base64_decode\(|gzinflate\(|assert\(\$' /var/www/site --include='*.php' | head\n\n# 4. logins that succeeded\nsudo grep "Accepted" /var/log/auth.log | tail -20

Compare against something trustworthy

If the code is in git, the fastest answer in the world is git status on the server: anything modified or untracked that you did not put there is your answer in one line. For a CMS, re-download the same version and diff the core files against it.

The database counts too

Injected content often lives in the database rather than in files, which is why a clean file scan proves less than people think - see malware in the database, not the files.