Overview

Unauthorized modifications to website content and malicious client-side scripts can compromise the integrity of web applications, expose sensitive customer information and damage an organization's reputation.

The GAJWAF Defacement & Magecart Alerts Playbook provides a structured incident-response procedure for investigating unexpected changes to website content and third-party JavaScript resources.

GAJWAF provides website defacement monitoring and client-side script protection capabilities to help administrators identify suspicious changes, investigate their origin and apply appropriate security controls.

The guiding principle is simple: Hostile Until Proven to Be a Deploy.

Before accepting a changed website baseline or approving a new script source, administrators should verify that the change was authorized by the application or website management team.

Understanding the Two Security Alerts

1. Website Defacement Detection

Website defacement occurs when an attacker modifies a website's content without authorization.

GAJWAF's defacement monitoring compares selected website pages against an accepted content baseline to identify substantial changes.

When an unexpected modification is detected, administrators can investigate whether it resulted from a legitimate website update or unauthorized activity.

Where configured, GAJWAF can serve the last accepted version of a monitored page while the change is investigated.

2. Client-Side Script & Magecart Detection

Magecart-style attacks commonly involve malicious JavaScript introduced into websites, particularly payment and checkout pages.

Such scripts may attempt to collect sensitive customer information or transmit it to unauthorized destinations.

GAJWAF's client-side monitoring helps identify changes involving third-party scripts, newly introduced script sources and unexpected data destinations.

Administrators can review these findings and use Content Security Policy (CSP) controls to restrict unapproved script sources.

What You'll Learn

The playbook follows four investigation and response steps divided into two sections.

Part A: Website Defacement

Step 1: Investigate Unexpected Website Changes

Learn how to examine defacement alerts and compare current website content with the previously accepted baseline.

The guide explains how to:

  • Review defacement findings in GAJWAF Events.
  • Examine monitored pages through Site Insights.
  • Identify which website content has changed.
  • Coordinate with the website or content management team to verify whether the modification was authorized.

Step 2: Accept Legitimate Changes or Investigate Unauthorized Modifications

If the modification resulted from an approved website deployment, administrators can accept the new content as the monitoring baseline.

If the change cannot be explained, the playbook recommends treating it as a possible compromise and investigating the underlying website, CMS or application infrastructure.

Important: Never accept an unexplained website change as the new trusted baseline.

Part B: Client-Side Security & Magecart

Step 3: Identify Suspicious Script Changes

Learn how to investigate client-side security alerts involving new or modified JavaScript resources.

The playbook covers:

  • Reviewing client-side findings in GAJWAF Events.
  • Identifying scripts loaded by protected pages.
  • Investigating unexpected script origins and data destinations.
  • Examining Content Security Policy violation reports.
  • Verifying whether script changes were introduced through authorized deployments.

Particular attention should be given to payment pages, checkout workflows and other applications processing sensitive customer information.

Step 4: Respond to Suspicious Scripts and Strengthen CSP

When a new script is confirmed as legitimate, administrators can approve its source according to the application's requirements.

When a script is unexplained or potentially malicious, the playbook recommends investigating its origin rather than simply suppressing the alert.

The guide also explains how to strengthen Content Security Policy enforcement by restricting script execution to approved sources.

Configuration Location: Edit Configuration → Bot Check → Client-Side Script Protection

Administrators can configure script-policy enforcement and maintain an approved list of trusted script origins.

Why This Playbook Matters

Website integrity attacks can affect customer trust, application security and the confidentiality of sensitive information.

Following this playbook helps organizations:

  • Identify unauthorized modifications to website content.
  • Distinguish legitimate deployments from possible website compromises.
  • Maintain trusted content baselines for monitored pages.
  • Investigate unexpected third-party JavaScript changes.
  • Recognize suspicious activity associated with Magecart-style attacks.
  • Strengthen browser-side protection through Content Security Policy.
  • Avoid approving potentially malicious scripts or compromised website content.
  • Maintain incident records for security investigations and operational reviews.

Incident Validation and Closure

The playbook includes an incident-closure checklist to help administrators verify that:

  • Legitimate website changes have been accepted as the correct baseline.
  • Unexplained website modifications have been investigated.
  • Suspicious scripts and data destinations have been reviewed.
  • Approved script sources are appropriately restricted.
  • Identified compromises have been investigated and remediated.
  • Incident details and corrective actions have been documented.

An incident-record template is also provided for recording the affected website, alert type, detected changes, investigation findings, security actions and remediation details.

Download the Playbook

Document: GAJWAF Playbook – Defacement & Magecart Alerts
Document Version: 1.0
Document Type: Website Integrity and Client-Side Security Incident Response Playbook
Publication: October 2026
Pages: 5
Intended Audience: GAJWAF Security Analysts and Administrators

Attachment: GAJWAF_Playbook_Defacement_Magecart.pdf

Download the attached PDF for detailed website defacement investigation procedures, client-side script monitoring, Content Security Policy configuration and incident-validation checklists.

Related Documentation

For additional guidance, refer to:

Technical Support

For assistance with GAJWAF website integrity monitoring, client-side security or incident response, contact GajShield Technical Support or your authorized GajShield partner.

Website: https://www.gajshield.com

GAJWAF: Different Applications. Different Protection. Shared Risk Intelligence.