What to Do If Your Website Is Hacked or Flagged for Malware Print

Act quickly and in this order. The goal is to stop the damage, clean the site, and close the hole that let the attacker in.

1. Contain it

• Change your cPanel, FTP, database and CMS admin passwords immediately
• Delete any FTP or admin accounts you do not recognise
• If the site is sending spam or attacking others, take it offline temporarily — open a ticket and we can help

2. Assess the damage

• Check the site root for unfamiliar PHP files, especially in wp-content/uploads
• Look for recently modified files in File Manager, sorted by date
• Review the access logs in cPanel for suspicious POST requests
• In WordPress, check for unknown administrator accounts

3. Clean it

The most reliable route is a restore from a backup taken before the compromise, followed by immediate updates. Otherwise:

1. Replace WordPress core files with a fresh copy from wordpress.org
2. Reinstall every plugin and theme from a clean source — delete rather than overwrite
3. Inspect wp-config.php and .htaccess for injected code
4. Scan with a reputable security plugin and remove anything it flags

4. Close the hole

Update everything, remove nulled or abandoned plugins, enforce strong passwords, and enable two-factor authentication. If you do not fix the entry point, the site will be reinfected within days.

5. Clear the warning

If Google flags the site, request a review in Google Search Console under Security Issues once the site is clean. Removal usually takes a day or two.

We can help

Open a ticket. We can review server-side logs, identify the entry point and restore from backups. Deep malware cleanup on a heavily infected site may be quoted as a paid service.