Host Suspended Your Site for Malware? Do This

If your host suspended your site for malware, the fastest way back online is: get the exact scan report from your host, remove the malicious files (not just disable the infected plugin), rotate every password and secret key, update everything, run a clean third-party scan, and send your host proof of all of it before you ask for reinstatement. Skipping the "proof" step is the single biggest reason sites get re-suspended within days.

This is for site owners staring at a "suspended due to malicious content" email from GoDaddy, Bluehost, SiteGround, Hostinger, WP Engine, or a similar host, with no idea what to do next. By the end you'll have a step-by-step process to identify the infection, clean it properly, and get your host to turn the site back on — plus what to do so it doesn't happen again.

What "suspended for malware" actually means

Hosts don't suspend sites to be difficult. Malware on your site can spam other customers' shared servers, get the host's whole IP range blocked by email providers, or trigger Google Safe Browsing warnings that make the host's network look untrustworthy. Suspension is the host protecting its own infrastructure — your reinstatement path exists, but you have to do the cleanup, and you usually have to prove it.

Common triggers: a hidden backdoor script uploaded through an outdated plugin, injected spam links or redirects, a cryptomining script, or your site being used to host a phishing page. All of these get caught the same way — by a scanner (the host's own, or Google's) flagging known malicious patterns.

Step 1: Get the exact reason from your host

Don't start deleting files yet. Open a support ticket and ask specifically for:

• The scan report or list of flagged files and paths
• The date/time the infection was detected
• Whether they've already quarantined or restored anything
• Their exact reinstatement requirements (some hosts want a signed statement, some want a specific scanner's clean report, some will rescan themselves)

Many hosts (GoDaddy, Bluehost/EIG-family brands, SiteGround) run automated malware scanners on shared hosting and will hand you a file list on request — this saves you hours of guessing.

Step 2: Check how bad it looks from the outside

Before touching code, check what the internet already knows:

1. Search site:yourdomain.com in Google — spammy titles or foreign-language pages you didn't write are a strong signal of injected content.
2. Check your domain's status at Google's Safe Browsing site status tool.
3. Log into Google Search Console and check the Security Issues report if the site is verified — it often names the exact malware type (e.g., "injected content," "harmful downloads").

If you're not sure whether the site is actually compromised or just misflagged, our free website security check can give you a quick read before you spend hours digging.

Step 3: Find and remove the malicious code

This is the part people rush and get wrong. Disabling the plugin the malware came in through does not remove a backdoor the attacker already planted elsewhere.

If you have a clean backup from before the infection date, restoring it is usually faster and safer than manual cleanup — as long as you also patch the entry point (Step 5) before putting it back online.

If you don't have a clean backup, look for:

• Obfuscated PHP: eval(base64_decode(...)), gzinflate(...), str_rot13(...) inside theme or plugin files that shouldn't contain them
• Files with recent modified dates you don't recognize, especially in /wp-content/uploads/ (uploads folders shouldn't contain .php files at all)
• Extra admin accounts you didn't create (check Users in your CMS admin, or the database wp_users table directly)
• Unfamiliar entries in .htaccess, especially RewriteCond/RewriteRule blocks that redirect mobile visitors or search-engine bots to a different site
• Scheduled tasks (cron jobs) you didn't set up, in your hosting control panel or via a plugin like WP Crontrol

Compare core CMS files against a fresh download of the same version — any core file that differs from the official release is suspect. Google's own "Clean up your hacked site" guide walks through this file-by-file comparison process in more detail.

Step 4: Lock the doors — rotate every credential

Attackers who got in once often leave themselves a way back in. Before you reopen the site:

• Change your hosting/cPanel password, database password, FTP/SFTP password, and every admin account password
• Regenerate WordPress secret keys via api.wordpress.org/secret-key/1.1/salt/ and paste them into wp-config.php
• Delete any admin user you don't recognize
• Revoke and reissue API keys for any connected services (payment processors, email senders, CDNs)

Step 5: Update everything before you reopen

Outdated, unpatched software is how most of these infections start — it's consistently one of the top causes tracked in the OWASP Top 10 under vulnerable and outdated components. Update your CMS core, every theme, and every plugin to their latest versions, and remove anything inactive you're not using — an unused plugin can still be exploited even if it's switched off.

Step 6: Get a clean scan your host will accept

Most hosts won't take your word for it. Run one (ideally two) of these before you file for reinstatement:

Keep a screenshot or exported report of the clean result — you'll attach it to your reinstatement request.

Step 7: Ask for reinstatement — and prove it's clean

Reply to your original support ticket with:

1. What the infection was and where it was (referencing their scan report)
2. What you removed and what you patched (be specific: "deleted wp-content/uploads/2024/xx.php, updated Plugin X from 4.1 to 4.9")
3. Your clean scan report or screenshot
4. Confirmation that passwords and keys were rotated

After reinstatement, if Search Console showed a Security Issues warning, submit a review request there too — that's a separate step from your host unsuspending you, and it's what actually clears the browser warning for visitors.

DIY cleanup vs. professional help

If you cleaned it yourself and just want a second set of eyes to confirm nothing was missed before you tell your host it's fixed, that's exactly the kind of check a manual audit is good for — it's not a substitute for the cleanup itself, but it catches what automated scanners and a rushed manual pass often miss. Compare that to a full penetration test cost if you're weighing options, and see how manual review differs from automated scanning if you're deciding which route fits.

How to stop this from happening again

• Turn on automatic updates for your CMS core and plugins where your host supports it
• Set up basic security headers — they won't stop every attack, but they close off easy wins like clickjacking and some injection vectors
• Keep offsite backups on a schedule your host doesn't control, so a future infection doesn't wipe your only clean copy
• Run a free security check periodically, and read how to tell if your site is hackable before the next scare

For background on the general categories of attacks hosts are scanning for, CISA's malware, phishing, and ransomware overview is a solid plain-English primer if you want to understand the bigger picture beyond your own incident.

Key takeaways

• Get the host's exact scan report first — don't guess at what's infected
• A clean backup restore plus patching the entry point beats manual file-by-file removal when you have one
• Rotate every password and secret key, not just the CMS admin password
• Run a clean third-party scan and attach the report to your reinstatement request — hosts rarely reinstate on your word alone
• Fix the update/backup habits that let it happen, or expect a repeat

If you'd rather have a person confirm the infection is fully gone (and check for anything else an attacker could come back through) before you go back to your host, a Circuit audit is a $49 manual review with a written report — a second, human set of eyes on exactly this kind of situation.