Anti-WebMiner: Protect Your Site from Malicious CryptominingCryptojacking—the unauthorized use of a visitor’s browser or a site’s resources to mine cryptocurrency—has evolved into a persistent cybersecurity threat. Malicious scripts known as web miners can be injected into websites via compromised plugins, third-party scripts, or direct code modifications. These miners silently consume CPU, drain battery life on mobile devices, degrade user experience, and increase hosting costs. This article explains how Anti-WebMiner solutions work, how to detect and respond to cryptomining on your site, and best practices to prevent reinfection.
What is Web Mining / Cryptojacking?
Web mining (or cryptojacking) refers to scripts that run in a visitor’s browser to solve cryptographic puzzles that secure blockchain transactions and earn cryptocurrency rewards. Unlike legitimate browser-based miners used consensually, malicious web miners run without explicit user consent and are typically hidden from users and site owners.
Key impacts:
- Increased CPU and memory usage for visitors and servers.
- Poor user experience — slower pages, high device temperatures, rapid battery drain.
- Higher hosting and infrastructure costs due to increased resource consumption.
- Reputational damage when users discover a site is abusing their devices.
How Malicious Web Miners Get on Sites
Common infection vectors include:
- Compromised CMS plugins or themes (WordPress, Joomla, etc.).
- Third-party scripts and widgets (analytics, ads, chat widgets).
- Supply-chain attacks where a trusted vendor’s script is altered.
- Cross-site scripting (XSS) or insecure file upload points.
- Compromised developer accounts or source repositories.
Signs Your Site Might Be Infected
- Unexplained spikes in CPU usage or server load.
- Reports from users of slow loading pages or overheating devices.
- Traffic patterns where many short-lived sessions consume high CPU.
- Presence of unfamiliar JavaScript files or inline scripts in page source.
- Blocklists or browser warnings flagging your domain.
Detection Techniques
- Log and metric monitoring
- Monitor server CPU, memory, and outbound traffic.
- Track page response times and error rates.
- File integrity and code scanning
- Use checksums, Git diffs, or file-integrity monitoring to detect modified files.
- Scan codebase for suspicious obfuscated scripts or eval()/Function() usage.
- Static and dynamic analysis
- Analyze served JavaScript for WebAssembly, cryptographic loops, or long-running intervals.
- Use browser devtools and network panels to inspect loaded scripts and long-polling workers.
- Third-party scanning tools
- Use malware scanners and specialized cryptojacking detectors to flag known signatures.
- Browser-based detection
- Inject test pages to identify heavy CPU usage in client-side profiling.
Immediate Response Steps if You Find a Miner
- Take the affected pages or site offline if the infection is widespread and causing serious harm.
- Isolate compromised accounts and rotate credentials (CMS admin, FTP, SSH, API keys).
- Restore from a clean backup taken before the compromise, if available.
- Replace infected files with clean versions and remove malicious scripts.
- Audit third-party integrations; temporarily disable nonessential external scripts.
- Re-scan to ensure no persistence mechanisms remain (cron jobs, scheduled tasks).
- Notify users if necessary and provide transparency on actions taken.
Anti-WebMiner Strategies and Tools
Prevention requires layered defenses—technical controls, processes, and user education.
Technical controls:
- Content Security Policy (CSP)
- Implement a strict CSP to restrict sources of scripts, workers, and WebAssembly. Disallow inline scripts and only allow trusted domains.
- Subresource Integrity (SRI)
- Use SRI for external scripts to ensure files haven’t been tampered with.
- HTTP security headers
- Use X-Content-Type-Options, X-Frame-Options, and Referrer-Policy to harden delivery.
- CSP-based worker restrictions
- Disallow or tightly control creation of Web Workers and Service Workers which miners often use.
- Regular dependency and plugin scanning
- Keep plugins, libraries, and CMS components up to date; use vulnerability scanners.
- File integrity monitoring
- Watch for unexpected file changes on the server.
- Runtime application self-protection (RASP)
- Some solutions detect and block malicious script execution at runtime.
- Network-level protections
- Use WAFs (Web Application Firewalls) to block known malicious payloads and anomalous requests.
- Rate-limiting and resource quotas
- Limit CPU/IO per user session where possible; use serverless or containerized environments with resource constraints.
- Browser-based defensive scripting
- Deploy heuristics to detect suspicious CPU usage patterns from loaded scripts and block or throttle them.
Tools and services:
- Malware scanners for websites and CMS-specific security plugins.
- Browser extensions and enterprise endpoint protection that block known miners.
- WAFs and CDN providers offering bot management and script sanitization.
- Monitoring platforms (APM, RUM) to spot anomalous client-side performance degradation.
Configuration Examples (High-Level)
- CSP example: allow scripts only from your domain and your chosen CDN, block inline scripts, and block WebAssembly unless explicitly needed.
- SRI: add integrity attributes to all third-party