Defending websites has become more difficult as advance tools have proliferated in the underground markets. Organizations that are too small to afford IT staff, let alone security staff, are outgunned and have little chance at keeping attackers out. This talk describes a new strategy in web defense that focuses on cheap and fast recovery of web site attacks. We will discuss automated backup and detection strategies that assume the attacker can and will compromise an account that allows them to write files to the web