# Clean malware from your website
Source: https://docs.webgee.com/en/security-ssl/steps-to-cleaning-malware-from-your-website



Recover a compromised website. Applies to shared, reseller and Premium hosting.

<Callout type="warn">
  **Removing the malicious files is not the job.** They got in through something
  — an outdated plugin, a stolen password, a vulnerable theme. Clean the files
  without closing that hole and the site is reinfected within days, often within
  hours. Work through all of the steps below, in order.
</Callout>

## 1. Take a backup of the current state [#1-take-a-backup-of-the-current-state]

Even infected. You may need to compare against it, and restoring the wrong
backup is worse than having both — see
[Take a snapshot backup](/en/backups/jetbackup-snapshot-backups).

## 2. Find out what is infected [#2-find-out-what-is-infected]

Scan the account:
[Scan your site for malware](/en/security-ssl/malware-scanner-how-to-scan-your-sites-for-malware).
The results list each affected file.

## 3. Replace, do not repair [#3-replace-do-not-repair]

Delete infected files. For anything the site needs, **replace it with a fresh
copy** rather than trying to strip the malicious code out:

* **WordPress core** — reinstall from **Dashboard → Updates → Reinstall**.
* **Plugins and themes** — delete each one entirely and install a fresh copy.
  Updating over an infected plugin frequently leaves the injected code behind.
* **Your own files** — restore from a backup predating the infection.

<Callout type="info">
  Anything you no longer use, delete rather than reinstall. Abandoned plugins and
  old theme copies are a common entry point precisely because nobody updates
  them.
</Callout>

## 4. Change every password [#4-change-every-password]

All of them, because you do not know which was taken:

* cPanel
* The site's admin accounts
* Database users — remember to update `wp-config.php` to match
* FTP and SSH accounts
* Email accounts on the domain

## 5. Look for what the attacker left behind [#5-look-for-what-the-attacker-left-behind]

Cleaning files misses persistence mechanisms:

* **Unknown admin users** in WordPress. Delete any you do not recognise.
* **Scheduled tasks** — check **cPanel → Cron Jobs** for entries you did not
  create.
* **Mail forwarders and filters** — check **cPanel → Forwarders** and **Email
  Filters**.
* **`.htaccess` files** with unexpected redirects, including in subdirectories.

## 6. Update everything [#6-update-everything]

Run the newest PHP version your site supports —
[Change your PHP version](/en/development/change-php-version) — and update the
CMS, themes and plugins. Old PHP versions stop receiving security fixes.

## 7. Clear the Google warning [#7-clear-the-google-warning]

If visitors see "Deceptive site ahead", the site stays flagged until Google
re-checks — see
[Request a Google review](/en/security-ssl/deceptive-site-ahead-how-to-request-google-to-review-a-compromised-site).

## If it comes back [#if-it-comes-back]

The entry point is still open. At that stage it is worth paying a specialist —
repeated reinfection usually means either a backdoor that was missed, or a
compromised machine re-uploading through legitimate credentials.

## Related [#related]

* [Scan your site for malware](/en/security-ssl/malware-scanner-how-to-scan-your-sites-for-malware)
* [Request a Google review of a compromised site](/en/security-ssl/deceptive-site-ahead-how-to-request-google-to-review-a-compromised-site)
* [Restore from a backup](/en/backups/jetbackup-how-to-restore-your-account-files-or-databases)