Preventing and Cleaning Website Malware

How infections really happen

Outdated plugins, themes or CMS core with a public exploit — by far the most common cause.
Weak or reused passwords, especially on administrator accounts and FTP.
Malware on a developer's own computer stealing saved FTP credentials.
Nulled or pirated premium themes and plugins, which frequently ship with backdoors.
Insecure file upload handling that allows a script to be uploaded and executed.
Overly permissive file permissions letting one compromised site write into another.

Warning signs

Unexpected redirects, especially only for mobile visitors or search referrals.
Spam pages or foreign-language content appearing in search results for your domain.
A sudden CPU spike or a large jump in outbound email.
New administrator accounts, unknown cron jobs or recently modified core files.
Browser or search-engine warnings, or blocklisting of your sending IP.

Cleanup sequence

1 Put the site into maintenance mode and take a forensic copy before touching anything.
2 Rotate every credential: hosting, cPanel, FTP/SSH, database, CMS admins, and any API keys stored in the site.
3 Run a server-side malware scan and note every flagged path.
4 Replace CMS core, plugins and themes with fresh official downloads instead of editing infected files.
5 Search the database for injected scripts, spam links and rogue admin users.
6 Audit .htaccess files across every directory — redirect injections hide there.
7 Remove unknown cron jobs and scheduled tasks.
8 Rotate application session salts to log everyone out.
9 Harden: disable PHP execution in upload directories, tighten permissions, enable 2FA.
10 Request a review from search engines and blocklist providers once clean.

Staying clean

Reinfection almost always means the original entry point was never closed, or a backdoor was missed. After cleanup, keep an off-server backup taken before the incident, monitor file integrity for changes, apply updates weekly, and remove every piece of software you do not actively use.

Our team can run a scan and assist with cleanup — open a support ticket with the timeline of what you observed and any URLs showing the problem.

Frequently asked questions

Can I just restore a backup?

Only if you know the backup predates the infection and you also close the vulnerability. Restoring onto the same unpatched software reinfects within days.

Does hosting protect me automatically?

We provide server-level firewalling, ModSecurity rules, malware scanning and isolation, but application-level updates and password hygiene remain yours.