I assume even if it isn't, attacker could deface the website so heavily everyone would know they win.