How are Websites Defaced

The most common methods of website defacements are:

Via SQL injections - Attackers exploit a vulnerability to insert malicious SQL statements in a website.

Via compromised content management systems - In 2013, attackers compromised numerous websites hosted on publicly available content management systems such as WordPress. The attackers compromised these sites by brute-force attack.

By gaining access to web servers - Attackers who obtain credentials to gain access to web servers can manipulate sites/pages hosted on these web servers.