This article investigates the distributed secure state estimation problem for cyber-physical systems under replay attacks. The main purpose is to design the distributed observers such that the estimation error system is stable. First, a detection algorithm is proposed to not only expose the behavior of the attacker but also identify which sensor is tampered. Then, the distributed observers are designed and the adverse effects are eliminated. Moreover, in view of the linear matrix inequality technique, a sufficient condition is presented, which ensures that the estimation error system is stable and achieves an $H_{\infty }$ property. Finally, a practical inverted pendulum example is employed to elaborate the effectiveness and superiority of the presented design and detection method.