Based on what little I've seen of compromised websites being used to attack visitors, Javascript has been involved in every single case. It might not necessaril

Based on what little I've seen of compromised websites being used to attack visitors, Javascript has been involved in every single case. It might not necessarily be a JS-based exploit, but JS is used to load the actual exploit into the page. But, I'm really not a domain expert on this. I follow things like Sucuri's blog and get maybe a few calls a year from someone with a compromised website, so it's possible that there's a more common attack method that I don't know about. Yeah, I'd love to love and recommend NoScript, but I just can't. JS is becoming too integral to too many websites these days, for everything from navigation to contact forms, and it looks like that's going to be the trend forever at this point. FWIW, I don't think a single one of our clients uses NoScript, so good browser + AB+ + good antivirus software seems to be doing the trick so far.