This is about a (currently fictional) case where a very small group of one or more individuals is running a custom web site / web application.
The individuals working on the site are quite early in their web journey and for various reasons they do not have the manpower to go through all of the files (or the funds to hire someone to do it for them).
For example, they might:
- Be running an open-source project, or other non-profit project
- Have started recently and have not yet made much profit.
So for what-ever reason they are currently, in a sense, small-scale actors even though their site may by now be receiving a large amount of visitors.
Considering the lack of manpower and funds, and the sheer amount of files that would need to be examined to determine if their site has been compromised, it would be best to automate such checking-processes as much as possible.
Note: This question is specifically about determining whether a web site or web app has been compromised. Understandably no software may be able to determine this completely automatically. But some software may be able to for example run automated comparisons between the current files and past versions of the files.
It would be great if the software can scan the host (e.g. to determine changed configuration settings) separately from the web app.
The question I wanted to ask is whether any software (or service) exists for this purpose. It should be available either for a relatively low cost (e.g. less than 100 USD per month) or be open source.