Fortinet 498 FortiWeb 5.0 Patch 6 Administration Guide
Anti-defacement
The anti-defacement features monitors your web sites for defacement attacks. If it detects a
change, it can automatically reverse the damage.
This feature can be especially useful if you are a hosting provider with many customers, such as
favorite local restaurants or community associations, who have basic web pages that should
not be changed, but it is impractical to manually monitor them on a continuous basis.
The anti-defacement feature examines a web site’s files for changes at specified time intervals.
If it detects a change that could indicate a defacement attack, the FortiWeb appliance can notify
you and quickly react by automatically restoring the web site contents to the previous backup.
Anti-defacement backs up web pages only, not databases.
Content that will not be backed up includes all database-driven content that is inserted into
web pages using AJAX, PHP, JSP, ASP, or ColdFusion, such as bulletin boards, forums, blogs,
and shopping carts: page content does not reside within the page markup itself, but instead
resides in a back-end database that is queried and whose results are dynamically inserted into
page content at runtime when the client requests a page. Separately from configuring
anti-defacement, you should regularly back up MySQL, Oracle, PostgreSQL, and other
databases and defend them with controls such as FortiDB.
Before updating a web site where you are using web site anti-defacement, disable both the
Enable Monitor and Restore Changed Files Automatically options. Otherwise, the FortiWeb
appliance will perceive your changes as a defacement attempt and undo them.