My OPD website was defaced or injected with online gambling content

Your OPD website's appearance has been replaced by someone else (defacement), or Google search results show online gambling titles and descriptions for your site. Both mean an outside party can change the website's files or database, and they usually leave a webshell behind to get back in.

Signs

• The home page or certain pages show images, text, or music placed by someone else.
• A Google search for site:namadomain.kutaitimurkab.go.id slot shows pages containing gambling content.
• Visitors on phones are redirected to gambling sites, even though the site looks normal on a computer.
• Google Search Console sends an email about a new owner or user you do not recognize.
• New URLs or pages appear that the administrators never created.

Online gambling content is often shown only to Googlebot. A website that looks normal in your browser is not necessarily clean.

Do this now

1. Keep evidence: screenshots of the altered pages and the Google search results, with the date and time.
2. Report it to KUTIM-CSIRT through /lapor (see the Report section).
3. Ask the developer or server administrator to copy the logs and all website files before anything is deleted or restored.
4. Ask for the website to be put into maintenance mode or taken offline temporarily.
5. Change the passwords for the CMS admin panel, hosting or cPanel, database, FTP/SSH, and the administrators' email from a clean device.
6. Open Google Search Console, go to Settings > Users and permissions, then note down and remove any owners or users you do not recognize. A verified unknown owner is only truly removed once its verification file or tag is also deleted from the website.
7. Forward the technical guide to handling defacement and online gambling injections to your developer or server administrator.

Don't

• Do not immediately overwrite the website with a backup. As long as the entry point has not been closed, the site will be broken into again.
• Do not delete unfamiliar files before copying them as evidence.
• Do not leave the website online with gambling content while waiting for repairs.
• Do not reuse old passwords, including for other administrator accounts.

Report

At /lapor, choose the category Penyisipan Konten Judi/SEO (Judol) (gambling/SEO content injection) for gambling injections, or Perusakan Situs (Defacement) if the site's appearance has been replaced. Choose the severity Tinggi (High), or Kritis (Critical) if the site provides public services or holds residents' personal data, or if there are signs the database was also accessed. Include the website address, screenshots, any emails from Google Search Console, and the contact details of the developer or hosting provider. Under our service standards, the initial response for High is within 4 working hours and for Critical within 1 hour.

Once the website has recovered, the OPD can request a VA/pentest through a service request.

To prevent a recurrence

• Update the CMS, plugins, and themes regularly, and remove unused plugins.
• Make sure all admin pages, including file upload features, can only be opened after logging in.
• Block PHP execution in upload folders.
• Keep scheduled backups outside the website's server.
• Enable 2FA on the CMS admin account and on the Google account that manages Search Console.
• Check your website with a Google site: search at least once a month.