Clean malware from your website
Remove an infection and close the hole it came through, in the order that stops it returning within days.
Recover a compromised website. Applies to shared, reseller and Premium hosting.
Removing the malicious files is not the job. They got in through something ā an outdated plugin, a stolen password, a vulnerable theme. Clean the files without closing that hole and the site is reinfected within days, often within hours. Work through all of the steps below, in order.
1. Take a backup of the current state
Even infected. You may need to compare against it, and restoring the wrong backup is worse than having both ā see Take a snapshot backup.
2. Find out what is infected
Scan the account: Scan your site for malware. The results list each affected file.
3. Replace, do not repair
Delete infected files. For anything the site needs, replace it with a fresh copy rather than trying to strip the malicious code out:
- WordPress core ā reinstall from Dashboard ā Updates ā Reinstall.
- Plugins and themes ā delete each one entirely and install a fresh copy. Updating over an infected plugin frequently leaves the injected code behind.
- Your own files ā restore from a backup predating the infection.
Anything you no longer use, delete rather than reinstall. Abandoned plugins and old theme copies are a common entry point precisely because nobody updates them.
4. Change every password
All of them, because you do not know which was taken:
- cPanel
- The site's admin accounts
- Database users ā remember to update
wp-config.phpto match - FTP and SSH accounts
- Email accounts on the domain
5. Look for what the attacker left behind
Cleaning files misses persistence mechanisms:
- Unknown admin users in WordPress. Delete any you do not recognise.
- Scheduled tasks ā check cPanel ā Cron Jobs for entries you did not create.
- Mail forwarders and filters ā check cPanel ā Forwarders and Email Filters.
.htaccessfiles with unexpected redirects, including in subdirectories.
6. Update everything
Run the newest PHP version your site supports ā Change your PHP version ā and update the CMS, themes and plugins. Old PHP versions stop receiving security fixes.
7. Clear the Google warning
If visitors see "Deceptive site ahead", the site stays flagged until Google re-checks ā see Request a Google review.
If it comes back
The entry point is still open. At that stage it is worth paying a specialist ā repeated reinfection usually means either a backdoor that was missed, or a compromised machine re-uploading through legitimate credentials.
Related
Unblock an IP address from the firewall
Check whether your IP is firewall-blocked and remove the block yourself from the client area, without opening a ticket.
Why AutoSSL skips some service subdomains
mail.example.com and cpanel.example.com get certificates on your main domain but not on alias domains. Why, and what to use instead.