Website Malware: Detection and Cleanup, Step by Step

The worst thing about website malware is that it doesn''t want to be noticed. Unlike a defacement attack where someone scribbles over your homepage, modern malware works quietly in the background: sending spam from your server, redirecting visitors to scams, injecting hidden links, or mining cryptocurrency. The average infection is discovered only after weeks — usually when Google flags the site or the host suspends the account for sending spam.

Signs your site is infected

• Google shows a "This site may be hacked" warning, or browsers block access with a red screen.
• Strange pages appear under your site in Google results — Japanese text, pharmaceutical products, gambling — pages you never created.
• Visitors get redirected to other sites, but only on mobile or only when coming from Google (malware often targets specific traffic to stay hidden).
• A sudden drop in search traffic; emails from your domain landing in spam.
• New admin accounts you didn''t create, files with odd names, or recent modifications you didn''t make.

Confirming the infection

Start with Google Search Console (Security Issues section) — free and the most reliable signal. Then scan the site with tools like Sucuri SiteCheck or VirusTotal (for individual URLs). On WordPress, a plugin like Wordfence can scan your files and compare them against the originals in the official repository — anything that deviates is suspect.

Cleanup, step by step

• 1. Don''t delete anything in a panic. First make a complete copy of the infected site — you''ll need it to work out how the attacker got in.
• 2. Change every password: hosting panel, FTP/SFTP, database, WordPress admin, email. An attacker who got in once probably has more than one way back.
• 3. Restore from a clean backup — the fastest and most reliable route, if you have a backup that predates the infection. This is why daily backups are worth their weight in gold: they''re included automatically in all our plans.
• 4. No clean backup? Reinstall the WordPress core and all plugins from official sources, then manually inspect wp-content/uploads (malware loves hiding there in .php files that don''t belong) and wp-config.php.
• 5. Update everything — core, themes, plugins. In 90% of cases the entry point was an outdated plugin or theme with a known vulnerability.
• 6. Request a review in Search Console so Google removes the warning — typically within 1–3 days.

Making sure it doesn''t happen again

An infection is almost always the result of one of three things: outdated software, a weak password, or a missing protective layer. The fix is routine: automatic updates for minor plugins, strong unique passwords with 2FA, and hosting with a built-in WAF that blocks known attacks before they reach your site. Our WordPress hosting includes a WAF, daily backups, and scanning — a combination that prevents most infections outright and turns the rest into a few-minute restore instead of days of cleanup.