So Outside Technology Security CMS
AnQiCMS
Online Demonstration

The statistics that 13,000 websites are hacked every day are saying who, and which layer the attack has entered.

📅 October 26, 2026 👁️ 0

About 13,000 sites are hacked every day, who does this statistic refer to? It refers to the fact that in the public site ecosystem with a huge number of installations, being scanned and hit in bulk is the norm rather than an occasional accident, the number is cumulative by day, and the denominator is the entire ecosystem. What is even more worth reading is which layer the attack has reached: malicious code no longer comes only from unfamiliar entry points, but is injected into the core, plugins, and theme files that should exist, with normal paths and owners. Checking for 'whether there are any extra files' will miss a batch. Therefore, the defense line needs to be shifted to change verification, credential management, and the ability to practice recovery.

The applicable scope of the statistical criteria

“Every day, about 13,000 sites are hacked” such numbers come from the overall estimation of the ecosystem, the denominator is the number of publicly available sites of an extremely large magnitude, and the numerator is the cumulative number of hacked events accumulated daily.It describes not the luck of a single site but when the installation volume of a technology stack is sufficiently large, automated scanning will consider it a normal target: the scanning script does not need to target you, just cover you.In the same batch of data, there is another more interesting perspective - the median time for large-scale use is only a few hours, which means that sites that have not been processed after the repair announcement is publicly released will be queued for attempts.These two numbers are enough to judge the priority of risks: don't expect that 'no one will pay attention to my little station', and don't treat it as a certainty that you will have an accident.

What does it mean to inject a legitimate file

The change in the level of risk is here. The traditional intrusion imagination is external requests hitting the login port or upload vulnerabilities, resulting in a file that clearly does not belong to the site; while the common practice now is to write malicious fragments into the core, plugins, or theme files that should exist naturally. Such file paths are normal, the owners are normal, and the timestamps may have been processed together, so checking according to

The defense line should be moved to which layer

The first layer is visible for changes. It can baseline compare content files with templates, so that changes have a chance to be discovered; the document status on the backend distinguishes between formal documents, drafts, pending publication, and recycling bin, with the status and modification records providing clues when the main text is rewritten, and deleted formal documents go to the recycling bin instead of disappearing directly, and also retain the comparison basis.The second layer is about credentials and entry convergence. Login and session are the real targets of the attacker, AnQiCMS fixed the issue of login credentials being forgeable in the v3.6.6 version, the official upgrade suggestion includes rotating the full-site signature key and changing the administrator password: The fix and credential rotation must be done together, otherwise, the path obtained after gaining control remains valid.The third layer is the permission and operation side, actions such as backup and upgrade should be closed by default, and explicitly opened by domain. The fourth layer is the input side, the built-in JWT authentication and content sensitive word filtering handle the submission and verification stages, anti-capture interference code handling content being taken away in bulk, they do not bear the responsibility of backdoor detection.

The order of handling after the event

Follow in order, do not skip steps. First isolate: Limit the entry points that can be triggered externally, to prevent malicious code from being called during the cleaning process. Then collect evidence: Retain Web access logs, file change records, and abnormal request samples to determine the entry point and scope of impact.Then full-scale verification: It is usually not enough to only clean up 'the one found', as the same batch of legitimate files may have been altered in multiple places. It is more effective to check against the list. Subsequently, rotate credentials: The passwords of administrators, interfaces, and site signature-related credentials all need to be updated. Only changing the content and not the credentials will lead to a second entry.Finally, it is time to recover and review: confirm that the site functions and are indexed normally, and supplement this discovery method into the daily inspection.

How to prepare the recovery capability

The cost of backing up decisions for event handling. Only backing up the database will result in missing images and attachments, and the page will be more easily reused after being partially destroyed; data backup should cover static files as well, and a real rehearsal for recovery should be performed. Leave a version that can be rolled back before changing the template, and back up first before upgrading. There is also an often overlooked expense: After the event, you need to check if the collection has been contaminated, attackers may rewrite the text or insert promotional content, which will be read together by search engines, and after the content is restored, it still needs to be reviewed according to the page list, and if necessary, the address that has been changed back needs to be pushed again.

Common questions

Question: Is it necessary for small sites to prepare according to this process?Reorder by cost: backups can be fully restored, credentials can be cleaned up in one go, and file modifications can be seen, and these three things are affordable for sites of any scale.

Question: Why is it not enough to only check for new files?Because malicious segments can be written in legitimate files. It is necessary to compare the content differences of known versions, rather than just looking at whether there are unfamiliar files.

Question: Can changing the password confirm that the cleaning is done?No. Credential rotation prevents re-entry, and the injected code needs to be removed by itself or restored from a clean backup.

Question: Will the hacked page affect search inclusion?Will. The modified main text and promotional content may have been captured, and after restoring the content, you still need to check the index status and resubmit the key address.

Question: Is the file upload function the most dangerous link?It is one of the common entry points, but the risk depends on the permission and validation design: who can upload, where the upload lands after, and whether it can be executed, these three items are more decisive than whether there is an upload function, in terms of the size of the problem.

Related articles

The report shows that 90% of vulnerabilities come from plugins, which part of the site should be strengthened first.

The annual security report shows that 90% of the newly discovered vulnerabilities come from plugins and themes. This proportion points to the attack surface location, not the core quality. The sequence of site reinforcement should be based on the exposed surface rather than the number of components: first, converge the entry points and high-risk operations that can be triggered externally, then count the list of extensions, and finally prepare credentials and backups as recovery capabilities. Installing fewer plugins reduces follow-up costs, but does not equal security.

2026-10-26

Website evaluation lists SEO and page speed as two indicators, which one should webmasters pay attention to?

The third-party website building tool evaluates the SEO capability and page speed by scoring them as two separate items. The reading method is not to copy the high-score items, but to determine the weight according to the scenario first. Page speed determines the effect of all optimization, and SEO capability determines whether it can be understood and indexed. When looking at the list, you need to distinguish between qualitative evaluation and reproducible indicators. For self-hosted sites, you also need to ask: Are these two items decided by the system or operations?

2026-10-26

llms.txt is called the site map of the AI era, and what does it manage compared to sitemap?

Two files do not solve the same thing: the site map is for address list, aimed at crawling discovery, emphasizing comprehensive coverage; llms.txt is for content description, aimed at understanding and reference, emphasizing selected entries and one-sentence explanations of responsibilities. Using llms.txt as a crawling switch or as a full link list will make it ineffective. The former is responsible for being discovered, and the latter is responsible for being understood. The configuration order is to have readable text first, followed by the description file.

2026-10-26

Statistics says that search references are looking at paragraphs, not the whole page, and the organization of content needs to be changed in which three places?

The object quoted is usually a text that can stand independently, rather than a whole page. According to this criterion, there are three changes to be made: the subtitle should be written as a question that the user would ask, the paragraph should be self-contained and not dependent on the previous text, and the conclusion should be brought forward to the first paragraph within one hundred and twenty words. This judgment comes from the summary of a third-party practice guide, not the official statistics of the search engine, and it is appropriate to organize content with it, but it is out of bounds to predict rankings.

2026-10-26

AI crawler cannot catch the answer in the main text, how can the script rendered page let it read?

Most AI scraping sides receive the response HTML without executing the script, the main content of the page injected by the front-end script, and what they see in the extraction layer is just an empty shell. The core is to let the model read the answer by making the main content appear in the initial response: server-side rendering, static output during construction, or directly writing the key question and answer paragraphs into the page. The site description file solves the problem of content navigation, but cannot replace the rendering problem.

2026-10-26

Robots only wrote禁止抓取, why can't they stop the content from being taken away

The robots.txt file is a request, not a gate: it only takes effect for those who voluntarily comply with the rules, and the scraping script can be ignored directly. The content is taken in bulk, and what is missing is never this line Disallow, but the three layers of access control, protection of the value of the text, and verification of the source. It is only by treating the restriction of crawling and the protection of content as two separate things that we know where to strengthen at each level.

2026-10-26

The same article posted on a station group is identified as duplicate content, how should the standard writing method be established?

An article posted on multiple sites is deemed duplicate, the problem usually does not lie in the writing style but in the lack of a main version: who holds the original address, how to point back to the other copies, and how to handle the old address during the revision period. If any of these three things are missed, they will compete for weight. The standard writing style should be determined before publication, not after the problem is found, and the logic of the list page and parameter page within the site is also the same.

2026-10-26

How much does it cost to self-host a Go language system for five years, and where do the bills differ from PHP stacks?

The main difference in the five-year self-hosting gap is not in the software license, but in the host slot usage decided at runtime, and who bears the maintenance hours. Third-party accounting provides a set of references: under the same VPS slot, the hardware bill for five years is about several hundred dollars, while the complete five-year accounting for maintenance sites can reach $2,000 to $4,000. The memory and concurrency surplus affects the lowest running slot, which is where the stacks truly differ.

2026-10-26