How can I monitor a website for malicious changes to the files

Question

I had an occasion recently where our website was compromised - a link farm was added to a couple of the pages on one occasion, and on another occasion, a large and nasty aspx file was put on the server. I won't mention the host's name (Hostway), but I was pretty annoyed that someone was able to do this. No, it wasn't a leaky password - around 10 sites hosted by HW with consecutive IP addresses got trashed.

Anyway. What I need is a utility or service (preferably free) that takes a snapshot of my websites contents, and then regularly monitors the files (size and datestamp) for unauthorized changes or additions, and alerts me. I've used web services that monitor one file for changes, but I'm looking for something a bit more aggressive.

Answer 1

Two tools that run on windows might work for you md5deep and AFICK - another file integrity checker. The allow the auditing and also become aware of new files.

AFAICK there is now web interface for them but you might want to send you the report via E-Mail right from the moment the tools flag a warning anyway.

Answer 2

We've been using this, Monitor Hacked Files, which is a PHP script that you install on the server. It notifies you if there are any changes to your site -- sending an email with a list of changed files. This at least tells you where to look. Definitely better than Google or clients finding out before you do!

Answer 3

You could set up a Google Alert to search your site for probable junk. For example, you might have the alert search for "viagra site:example.com". Google alerts will email you if it ever finds the target of your search.