Sign up ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I had an occasion recently where our website was compromised - a link farm was added to a couple of the pages on one occasion, and on another occasion, a large and nasty aspx file was put on the server. I won't mention the host's name (Hostway), but I was pretty annoyed that someone was able to do this. No, it wasn't a leaky password - around 10 sites hosted by HW with consecutive IP addresses got trashed.

Anyway. What I need is a utility or service (preferably free) that takes a snapshot of my websites contents, and then regularly monitors the files (size and datestamp) for unauthorized changes or additions, and alerts me. I've used web services that monitor one file for changes, but I'm looking for something a bit more aggressive.

share|improve this question

migrated from Feb 22 '11 at 21:05

This question came from our site for computer enthusiasts and power users.

interesting question - do you have any clue HOW your server was compromised?? –  Digital Lightcraft Sep 25 '12 at 11:06
Same thing happened to me on GoDaddy several times. I don't use hosting services anymore. Too many clients on one machine means there's many users who are already through the first level of security (ie. logged in to your server). All strangers and you don't know who they share passwords with. –  Octopus Sep 24 '13 at 5:23

4 Answers 4

One of our sites was recently hacked and we didn't notice for a while, because nothing was broken, until we became aware of our site appearing with spammy words in Google searches. Since our site was using git, I came up with a quick and dirty solution for monitoring the site for unauthorised file changes using the git diff command.

It is a bash script (but is simple enough to be modified into a batch script for Windows environments) that runs periodically via something like cron.


# change the following two params,
# set up a cron job and there you go!
site="your site"

cd "$(dirname "$0")"

if [ ! -f snitch.log ]; then
    touch snitch.log

# if git diff finds a difference between
# HEAD and what we have now, snitch!
if [[ -n $(git diff --name-only HEAD) ]]; then
    git diff --name-only HEAD > snitchtemp.log
    if [[ -n $(diff snitch.log snitchtemp.log) ]]; then
        git diff --name-only HEAD > snitch.log
        cat snitch.log | mail -s "snitch@$site" "$email"
    echo "OK"

What it does is very simple. On every invocation it uses git diff to see if any files have been modified since the last commit, and if so sends an email with the list of files that have been tampered. To avoid sending the same email over and over again until you pay attention, it saves the list of files that were tampered with the last time it ran and checks against that to see if the list of files have changed, in which case it can send another email.

Note that git diff will only list modified files that git is tracking, so if the intruder creates brand new files, they won't be caught. However since they would need to tamper with at least one existing file to create the brand new file in the first place, this script should be fine.

share|improve this answer

Two tools that run on windows might work for you md5deep and AFICK - another file integrity checker. The allow the auditing and also become aware of new files.

AFAICK there is now web interface for them but you might want to send you the report via E-Mail right from the moment the tools flag a warning anyway.

share|improve this answer

We've been using this, Monitor Hacked Files, which is a PHP script that you install on the server. It notifies you if there are any changes to your site -- sending an email with a list of changed files. This at least tells you where to look. Definitely better than Google or clients finding out before you do!

share|improve this answer
It would do the trick...but. I'm hosted on a Windows server, not Unix. I guess one could write something in ASP though. –  rossmcm Feb 23 '11 at 9:35

You could set up a Google Alert to search your site for probable junk. For example, you might have the alert search for "viagra". Google alerts will email you if it ever finds the target of your search.

share|improve this answer
Thanks, I had already done this when we were link-farmed, but it didn't pick up the occasion when we got infected with the aspx. –  rossmcm Feb 23 '11 at 9:29

protected by Stephen Ostermiller May 5 at 9:45

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.