Call Us! 1-800-383-5193
Call Us! 1-800-383-5193
Call Us! 1-800-383-5193

Need Help?

Emergency Response Time custom

Our experts have had an average response time of 11.06 minutes in March 2021 to fix urgent issues.

We will keep your servers stable, secure and fast at all times for one fixed price.

Monitor Website Defacement With Nagios XI

by | May 19, 2021

Wondering how to monitor Website Defacement With Nagios XI? We can help you.

Website defacement is an attack on a website that changes the visual appearance of the site or a webpage.

As part of our Server Management Services, we assist our customers with several Nagios queries.

Today, let us see how our Support Techs monitor Website Defacement.


Monitor Website Defacement With Nagios XI


First and foremost, the Website Defacement Wizard provides an automated method for monitoring our website for defacement and notify us when our website contains undesirable content.

Today, let us see how our Support Techs use the Website Defacement Wizard to monitor our websites for defacement, modification and malicious insertions with Nagios XI.

Consider the following points when monitoring a website for defacement:
  •  The Website Defacement wizard uses a regular expression check to search for a specific string or multiple strings.
  •  Strings do not have to be case sensitive and each one should be separated by a new line.
  • There are a few pre-defined lists of words we may want to search for, sorted into categories.
  •  We can also load a custom wordlist file into the wizard for each site we want to monitor.
  • There is also a regular expression match check to verify that the website we are monitoring is up and running. But this is strictly optional and may be redundant if we are already monitoring this website with Nagios XI.


The Website Defacement Wizard


Basically, Website Defacement wizard uses the regular expression check to find a specific string that we do not want to appear on our website.

To begin using the Website Defacement wizard, navigate via the top menu bar to Configure > Run a configuration wizard and select the Website Defacement wizard.

Step 1:

Enter the URL of the website we want to monitor into the URL to Monitor field. This can be the main page of the website or any specific sub-page we want to monitor.

Then, click next.

Step 2:

Here is where the majority of the configuration takes place and is broken up into multiple sections.

URL Details specifies the following:

  •  Host Name is the standard Nagios host name.
  •  Service Name Prefix is a string that will be added to the beginning of any services created by the wizard for easier identification.
  •  IP Address allows us to specify a different IP from the one that was auto-detected for the URL.

URL Options specifies the following:

  •  Use SSL and Port can be configured in case HTTP/S are running on alternative ports.
  • On Redirect allows us to define how to handle redirected pages.
  • Credentials allow us to specify a username and password for use in basic HTTP authentication.

Defacement Monitoring Services allows us to select which defacement methods we would like to use to monitor our website.

Website Defacement service will be created once we check the box next to Defacement Content Locator.

The Defacement Content Locator allows us to enter a list of words which should be considered “bad” if they appear on the page.

  • Enter each line enter in a list of words manually.
  • Also, upload a custom text file of words.
  • We can choose from the pre-defined lists of default words from different categories.

Web Page Regular Expression Match allows us to check that the content of the webpage includes specific words or expressions.

Web page Regex Match service will create, If we check the box next to Web Page Regular Expression Match.

Then, we will enter a string we wish to search for on the website.

If the entered string does not appear on our website, we will receive an alert.

We can also choose to invert the search by checking the Invert Regex Search check box.

Step 3:

Once we have finish making our selections, click Next and then complete the wizard by choosing the required options.

Step 4:

To finish up, click on Finish in the final step of the wizard, this will create the new hosts and services and begin monitoring.

Click the View status details for our web server link to see the new host and services that were create, after wizard applies the configuration.


“301 Moved Permanently – pattern not found” while we Monitor Website Defacement With Nagios XI


Let us see how our Support Techs fix the above error while monitoring.

The error “301 Moved Permanently – pattern not found” implies that Web Page Regex Service is in a critical state, whereas the Website Defacement Service is in an OK state.

However, we need to correct the error “301 Moved Permanently – pattern not found” for the service to function properly.

Some sites will issue a HTTP 301 code which is just a simple redirect and can cause some issues with the check_http plugin.

We have to adjust the “-f xxxx” switch on the services to use the follow argument.

Locate the services by navigating to Configure > Core Config Manager > Monitoring > Services.

Click the services in the Service Name column to begin editing it.

If $ARG3$ has the value “-f ok”, change “ok” to “follow”.

Now $ARG3$ has the value:

-f follow

Click Save to save the changes.

Repeat this for any other services that need updating and then click Apply Configuration to make the changes go into production.

Once the configuration has applied, view the services. After they have performed a check with the new setting, they should be working correctly.


[Need help with the procedures with Nagios? We are here for you]



In short, Nagios XI can monitor for potential Website defacement using the Website Defacement monitoring wizard. Today, we saw steps followed by our Support Techs in the process.


Never again lose customers to poor server speed! Let us help you.

Our server experts will monitor & maintain your server 24/7 so that it remains lightning fast and secure.


var google_conversion_label = "owonCMyG5nEQ0aD71QM";


Submit a Comment

Your email address will not be published. Required fields are marked *

Privacy Preference Center


Necessary cookies help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies.

PHPSESSID - Preserves user session state across page requests.

gdpr[consent_types] - Used to store user consents.

gdpr[allowed_cookies] - Used to store user allowed cookies.

PHPSESSID, gdpr[consent_types], gdpr[allowed_cookies]


Statistic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.

_ga - Preserves user session state across page requests.

_gat - Used by Google Analytics to throttle request rate

_gid - Registers a unique ID that is used to generate statistical data on how you use the website.

smartlookCookie - Used to collect user device and location information of the site visitors to improve the websites User Experience.

_ga, _gat, _gid
_ga, _gat, _gid


Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers.

IDE - Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.

test_cookie - Used to check if the user's browser supports cookies.

1P_JAR - Google cookie. These cookies are used to collect website statistics and track conversion rates.

NID - Registers a unique ID that identifies a returning user's device. The ID is used for serving ads that are most relevant to the user.

DV - Google ad personalisation

IDE, test_cookie, 1P_JAR, NID, DV, NID
IDE, test_cookie


These are essential site cookies, used by the google reCAPTCHA. These cookies use an unique identifier to verify if a visitor is human or a bot.