Site Security
Removing Malware From a Hacked Website Step by Step
A malware cleanup that skips the entry point or leaves a backdoor behind gets reinfected within days — here's the order that actually makes it stick.
5
Core cleanup steps, done in order
Daily
Backups to restore from if a clean copy predates the hack
24/7
Human support during an active compromise
0
Backdoors left behind is the actual goal, not just visible symptoms
In short
Removing malware from a website means, in order: scanning to identify every infected or unfamiliar file rather than just the obviously broken page, removing malicious code and any backdoor scripts that let the attacker back in, patching the actual entry point (an outdated plugin, a weak password, a vulnerable script) that let the infection happen in the first place, resetting every credential tied to the site, and requesting delisting from any search engine or browser blacklist afterward.
Skipping the entry-point patch or the backdoor removal is why a surprising number of cleaned sites get reinfected within days — the visible symptom (spam content, a redirect, a defacement) is gone, but the actual hole the attacker used, and often a hidden file granting them access, is still there.
A hacked website rarely announces itself clearly — sometimes it's obvious, a defaced homepage or an outright warning page from a browser, but just as often it's subtler: unexplained new admin users, spam links injected into old blog posts, a search listing that shows pharmaceutical or gambling terms nothing on the actual site mentions, or a sudden ranking drop with no other explanation. Any of these is reason enough to treat the site as compromised and work through a full cleanup, not just fix the one visible symptom.
The order of operations matters more than any single tool used along the way. Cleaning visible malware without finding the backdoor that let it in, or fixing the symptom without patching whatever vulnerability caused it, both lead to the same outcome: the site gets reinfected, often through the exact same route, sometimes within days of being declared clean.
Step 1: Scan and Identify Every Infected File
Start with a full malware scan across every file on the hosting account, not just the pages that look broken — attackers routinely inject code into files that render normally to a visitor while quietly serving malware, spam content, or a redirect only under specific conditions, such as to search engine crawlers but not regular visitors. A scanner that checks file integrity against known-clean versions of core CMS files is far more reliable here than eyeballing file names.
Pay particular attention to files with recent modification timestamps that don't correspond to any legitimate update or edit, unfamiliar files in upload directories that shouldn't contain executable code at all, and any file with obviously obfuscated code, such as long base64-encoded strings, which is a common way malicious payloads are hidden from a casual look.
Step 2: Remove Malicious Code and Backdoors
A backdoor is a small script, often disguised with an innocuous filename or hidden inside a legitimate-looking file, that lets an attacker back into the site even after the obvious infection is cleaned — this is the single most common reason a 'cleaned' site gets hacked again shortly after. Removing only the visible spam injection or defacement while leaving a backdoor in place solves nothing long-term.
Where a clean backup genuinely predates the compromise, restoring core files from that backup and then carefully reapplying only legitimate content changes made since is often more reliable than trying to manually strip malicious code line by line from every affected file, especially on a site with a large number of infected files.
Step 3: Patch the Actual Entry Point
Cleaning the infection without identifying and closing the entry point is treating a symptom, not the cause. Common entry points include an outdated plugin or theme with a known, publicly disclosed vulnerability, a weak or reused admin password, an exposed file upload feature that accepts executable file types, or an outdated CMS core version itself.
Update every plugin, theme, and the CMS core to their current versions, remove any plugin or theme that's abandoned or unsupported entirely rather than just outdated, and review file upload functionality for whether it restricts file types appropriately. If the entry point genuinely can't be identified, treating the update and hardening steps as mandatory anyway is the safer default.
Step 4: Reset Every Credential and Recheck for Persistence
Reset every password tied to the site: CMS admin accounts, hosting/cPanel login, database credentials, and FTP or SFTP access, since a compromise can expose any of these and an attacker who kept even one working credential can undo the cleanup. Enable two-factor authentication on admin accounts at this point if it isn't already active, since it stops a leaked password alone from being enough to get back in.
After resetting credentials, re-scan once more a few days later — some backdoors are designed to lie dormant and re-establish access later, so a clean scan immediately after cleanup isn't a guarantee the site stays clean without a follow-up check.
Clean, Patched, and Off the Blacklist
A malware cleanup that stops at 'the spam is gone' instead of 'the entry point is patched and the backdoor is removed' isn't actually finished.
Hosting Cheap's 24/7 human support helps during an active compromise, and daily backups give a genuinely clean restore point to work from when one predates the infection.
- 24/7 human support during an active site compromise
- Daily backups for a clean restore point before infection
- Free managed migration if moving to a fresh, clean hosting account
- NVMe SSD + LiteSpeed keeping the cleaned site fast afterward
Why Hosting Cheap
What you get
24/7 human support
Get real people helping walk through a cleanup during an active hack, not just a ticket queue.
Daily backups
Restore from a clean copy predating the infection when manual cleanup isn't reliable enough.
Free managed migration
Move a repeatedly compromised site to a fresh hosting account with expert help during the switch.
NVMe SSD + LiteSpeed
A cleaned site stays fast on modern infrastructure once malware and bloat are removed.
Free auto-renewing SSL
Keep the site's certificate valid and current throughout a cleanup and afterward.
30-day money-back guarantee
Try hosting built with security in mind, with a refund window if it's not the right fit.
How It Works
Get set up in a few steps
Scan and identify every infected file
Run a full malware scan across the entire hosting account, not just visibly broken pages.
Remove malicious code, backdoors, and patch the entry point
Strip infected code, close any backdoor, and update or remove whatever let the attacker in.
Reset credentials and request delisting
Change every password tied to the site, enable 2FA, and submit a review request to any blacklist that flagged it.
Included
Everything you need, on every plan
- Full malware scan run across every file, not just obviously broken pages
- Recently modified files with no matching legitimate change investigated
- Backdoor scripts specifically searched for, not just visible injected content
- Clean backup used to restore core files where one predates the infection
- Every plugin, theme, and CMS core updated to its current version
- Any abandoned or unsupported plugin or theme removed entirely
- Every credential reset: admin, hosting, database, and FTP/SFTP
- Two-factor authentication enabled on admin accounts post-cleanup
FAQ
Frequently asked questions
How do I know if my website has malware?
Signs include unfamiliar admin users, spam links or content injected into existing pages, a sudden unexplained ranking or traffic drop, browser or search engine warning labels, or a redirect that sends visitors somewhere unexpected. Some infections show no visible symptom at all, which is why a full scan matters even without an obvious red flag.
Should I restore from a backup or manually remove malware?
Restoring from a backup that genuinely predates the compromise is often more reliable than manual removal, especially with a large number of infected files, since it guarantees a clean starting point. Any legitimate content changes made since that backup then need reapplying carefully afterward.
What is a backdoor and why does it matter for cleanup?
A backdoor is a hidden script that lets an attacker regain access even after visible malware is removed, which is why cleanup that skips backdoor detection frequently results in reinfection within days. Finding and removing it is as important as cleaning the visible symptom.
How do I find the entry point an attacker used?
Check for an outdated plugin, theme, or CMS core with a known vulnerability, a weak or reused password, and any file upload feature that accepts executable file types without restriction. If the specific entry point can't be confirmed, updating everything and hardening credentials regardless is still the right move.
How do I get my site removed from a search engine's malware blacklist?
After confirming the site is genuinely clean, submit a review request through the relevant search engine or browser's webmaster tools, which typically re-scans the site and lifts the warning once it verifies the infection is gone. This step only works after the actual cleanup, not before.
How do I stop my website from getting hacked again?
Keep every plugin, theme, and CMS core updated, remove anything abandoned or unsupported, use strong unique passwords with two-factor authentication enabled, and keep daily backups so a clean restore point always exists. Most reinfections trace back to the original entry point never actually being patched.
Ready to Move to Hosting Built With Security in Mind?
Get daily backups and 24/7 human support for cleanups, from $2.09/mo, backed by a 30-day guarantee.
Get Started