Over the past decade, web defacement and related forms of web-based attacks have emerged as significant security threats to enterprise and organizational systems. A single defacement incident can result in severe consequences for the affected party, including immediate disruption of website functionality, reputational damage, and substantial financial losses. To mitigate these risks, various monitoring and detection mechanisms have been developed. However, many of the existing approaches are constrained in scope: some are restricted to static web content, while others can process dynamic content but at the cost of substantial computational overhead. Furthermore, current solutions often suffer from limited detection accuracy and elevated false positive rates, largely due to the inadequate handling of key webpage elements such as plain text content. To address these limitations, this study introduces a novel web defacement detection model leveraging BERT and BiLSTM architectures, with a focus on features extracted from webpage plain text. Extensive experiments conducted on a dataset comprising nearly 70,000 webpages demonstrate that the proposed model achieves superior performance compared to prior approaches, attaining an overall accuracy of 98.61% and an F1-score of 98.70%.