Defacement attacks currently pose one of the most significant threats to web applications. Attackers often utilize this method to leave messages and signatures, which serve as a form of propaganda or a demonstration of power. However, existing detection methods mainly focus on content-based analysis, which can consume substantial computational resources, require extended processing times, and reduce accuracy. Furthermore, these methods typically overlook the attackers’ signatures, an indicator that may seem simple but is highly effective for detection. This paper proposes a defacement detection framework that integrates signature analysis with an attack detection model, combining image, text, and HTML features. This framework is capable of effectively handling both static and dynamic web pages. Experimental evaluations conducted on a dataset of 20,255 collected signatures and 96,220 web pages demonstrate that our approach achieves an accuracy rate of up to 99.23%, with a False Alarm Rate (FAR) of only 0.38%, surpassing existing detection methods.