Malware Removal for Hacked Websites

How people find out

The loud signals, a browser warning, a search label or an abuse notice from the host, are covered in the website security guide. Two quieter ones usually arrive first, and each tells you something the warnings do not.

A customer says the site sent them somewhere strange, on a phone, while it looks fine on your own screen. A fault only some visitors see is a compromise until proven otherwise, and who sees it narrows down where to look.
Mail from your domain starts bouncing. A script has been sending through your domain long enough that receiving servers noticed before you did, which puts a rough date on the infection.

Before you change anything

The instinct is to delete whatever looks wrong and put the site back up. That costs money, because it destroys the record of how the attacker got in, and an entry point nobody found gets used again. So take a copy of the site exactly as it stands, infected files and all, before you touch anything.

Calm is an advantage here. A site quietly compromised for weeks is not made worse by one more hour spent doing this properly.

The first hour, in order

Copy the site as it is

Files and database both. Your hosting control panel can normally produce a full account copy. Label it clearly so nobody restores it by accident.
Take it offline only if it is doing harm

If it serves malware, hosts a fake login page or redirects people somewhere unpleasant, put a holding page up. Otherwise leave it running.
Change the passwords that matter, in this order

Hosting control panel first, then FTP, then the database user, then the CMS admin accounts, then the mailbox that resets any of them. Changing the site password while the attacker holds the hosting login achieves nothing.
Tell your host

They may already know, they can often say when the first bad file appeared, and a suspended account comes back faster when somebody is dealing with it.
Stop outbound mail if the site is sending spam

Spam is what gets an account suspended and a domain onto mail blocklists. Ask your host to hold mail from the account while the cleanup runs.
Write down what you know

The symptom, when it was first reported, the last time anyone updated anything, and who has an admin or FTP login. Five lines saves whoever cleans it a lot of guesswork.

Reading the symptoms

What a site is doing narrows down what happened to it. A starting point, not a diagnosis.

Common symptoms, what they usually indicate and where to look first
What you are seeing	What it usually is	Where to look first
Homepage replaced by a message or image	Defacement, the loudest and often the least damaging kind	Recently changed files, and the admin user list
Pages you never wrote, or hidden links inside the ones you did	Injected spam, trading on your domain's reputation, often stored in the database	New folders, the sitemap, and the page and settings tables
Search visitors or phone visitors redirected, you are not	A conditional redirect keyed to where a visitor came from, or their device	The server configuration file and the theme's function files
A login page on your domain imitating a bank or webmail	A phishing kit uploaded to a folder nobody looks in	Upload folders, and anywhere the site accepts files
Outbound spam reported, site looks normal	A mailer script, often the only thing installed	The mail queue, and files changed around that date

Secure Your Website Now Tell us what you are seeing

Malware removal for hacked websites is finding the way in, not deleting files

Removing the bad files is the easy half, and on its own close to useless. If the hole is still open, the same automated tool finds the site again, often within days. The usual routes in are listed in the website security guide. Two more turn up often enough on small sites to name here:

A form that accepts file uploads without checking what it is given.
A different, forgotten site sitting in the same hosting account.

That last one surprises people. Sites sharing one account can usually read and write each other's files, so an abandoned test site is a live way in to the one that earns money.

Working out which one it was

Three things do most of that work. Files get compared against known-good originals rather than eyeballed, because a modified core file looks perfectly normal on its own. Modification dates get read against the date of the first report, which usually produces a cluster of files touched within minutes of each other and one sitting earlier than the rest. Then the places nobody opens: the database, scheduled tasks that put the malware back, and accounts created between those two dates.

Restore from a backup, or clean in place?

Both are legitimate. It comes down to what you have and what you would lose.

Restoring usually wins when

You have a copy from before it started, and are fairly sure of that date.
Little has changed on the site since then.
The site is standard software with few custom changes.

Cleaning in place usually wins when

No copy goes back far enough, or nobody knows when it started.
Orders, enquiries or posts since the infection cannot be lost.
The copies you hold have never been restored, so nobody trusts them.

Either way you still have to close the entry point, which is the argument for getting website backups right while nothing is wrong.

When a rebuild is the cheaper answer

Some sites cost more to clean than to replace, and saying so saves people money. The test is not how alarming the infection looks, it is how long it ran. One found in its first days is a small job. One found after months of injected pages have been indexed and the domain has picked up a mail reputation problem is a large one, and most of that work is undoing consequences rather than deleting code. If a rebuild is the answer, content moves across as content and never as folders, since a copied theme can carry the problem with it.

Getting the warnings taken down

Cleaning the site does not clear the warnings. Browser and search blocklists are separate systems, and coming off them is a request and a review, not a switch.

Verify the site in the search engine's webmaster tools. That is where the flagged URLs are listed, where the review is requested, and where you find out what they think is wrong.
Browser warnings often clear with the search review, because several browsers use the same data. Some are asked separately.
Mail blocklists are their own job. If the server sent spam, delivery stays patchy for a while after the site is clean.
Ask your host to lift the suspension once the account is clean. They will want to see what was removed and what was closed.

Two things catch people out. The report normally names example URLs, and those are the fastest route to whatever you missed. And browsers hold a warning locally, so your own screen can keep showing one after the listing has cleared.

What to watch after the cleanup

The hardening that stops a repeat is in the website security guide and, for WordPress, in WordPress security. What belongs here is the window straight after, when you find out whether the way in really closed.

Scan again, more than once. The scan on the day the site goes back up proves little. Repeat scans catch something reinstalling itself.
Read the admin user list, not just its length. A new account after the cleanup means something is still creating one.
Watch outbound mail. Spam restarting is the earliest signal, and it starts before anything shows on the site.

A reinfection here means the way in was never closed, so the search moves to what nobody checked: a scheduled task, a second site in the same account, or a computer with saved logins.

If you would rather hand it over

Hacked sites are familiar work here rather than an emergency. We take the copy first, find the entry point, clean the files and the database, close the hole, request the reviews, then set up the dull parts that stop it recurring. We are an independent authorised reseller for the security products, and we will say plainly when a site is cheaper to rebuild. Ring 716-771-2536 or describe what you are seeing.

Malware removal questions

How do I tell a hacked site from a broken one?

A broken site fails the same way for everybody. A compromised one often behaves differently depending on who is looking: normal for you, redirected on a phone, different again for someone arriving from a search result. If the fault only appears for some people, treat it as a compromise.

Should I just delete the files that look wrong?

Not as your first move. Deleting is how people lose the evidence that shows where the attacker came in, and an entry point nobody found gets used again. Take a full copy of the files and the database first, then work from that.

My host has suspended the account. What now?

The suspension lifts when the account is clean, so the cleanup is the fastest route out of it. Reply to the abuse notice, say the site is being worked on, and ask what they need to see before they restore access. Hosts are usually helpful once somebody answers.

Will restoring a backup fix a hacked website?

Only if the copy predates the compromise and the way in gets closed at the same time. A restore that puts back the same out-of-date plugin invites the same attack, and a copy taken after the infection restores the infection with it.

How long do the browser and search warnings stay up?

Removal is a request and a review rather than a switch you flip. You submit the site once it is clean, a review runs, and the warning comes down if it passes. Submitting a site that is still infected starts the process again.

Related guides and services

Website Backups

What decides whether a bad day is a restore or a rebuild: where copies live, and how to prove they work.

Read the backups guide

WordPress Security

Plugins, logins and updates: the settings that close the doors most compromises come through.

Secure a WordPress site

Website Security

The overview: scanning, firewalls, backups and monitoring, and which a small site needs.

Read the security guide

See also what our support covers, or browse all guides.