If your website has been hacked or infected with malware, act quickly. An infected site can send your visitors to scam pages, get your domain blacklisted by Google and antivirus companies, and stop your email from being delivered. This guide explains how to recognise an infection and where to get it cleaned properly.
Signs your website is infected
- Google, Chrome or your antivirus shows a red "Dangerous site" or "Deceptive site ahead" warning.
- Visitors (especially on phones) are redirected to spam, casino, pharmacy or fake-prize pages.
- Strange pages, links or foreign-language text appear in Google search results for your domain.
- You find admin users, plugins or files you didn't create.
- Your hosting account suddenly hits resource limits, or your email starts bouncing as spam.
- We've contacted you because our server's malware scanner found infected files.
What to do right now
- Don't panic, and don't delete things at random. Deleting files blindly can break the site and destroy the evidence of how the attacker got in.
- Change your passwords from a computer you trust: cPanel, WordPress admin users, FTP accounts and database users (How to Change Your cPanel Password, How to Reset Your WordPress Admin Password, How to Change a MySQL Database User's Password).
- Get the site cleaned by a specialist (see below). Cleaning a hacked site is more than removing one bad file. Hidden backdoors are often left behind so the attacker can come back, and they have to be found too.
Get it cleaned: FixMyHackedWebsite.com
Malware removal and hacked-site repair are handled by our dedicated service, FixMyHackedWebsite.com. It's a separate service with its own website and ordering, but it runs under the same oversight as your hosting with us, so the people cleaning your site understand the Instant Access Internet Services servers.
FixMyHackedWebsite.com can:
- Remove malware and hidden backdoors from WordPress, WooCommerce and other platforms.
- Repair the damage and get the site working again.
- Request removal from Google and security-vendor blacklists.
- Offer ongoing maintenance so it doesn't happen again.
To get started, visit fixmyhackedwebsite.com. You can run a free check to see whether your site looks hacked, or go straight to ordering a cleanup. Current packages and prices are listed on that site.
Can I fix it myself?
Sometimes. If you know roughly when the infection started and you have a clean backup from before then, restoring that backup can work. See What to Do If Your WordPress Site Is Hacked and How to Restore Your Whole Account to an Earlier Date (JetBackup 5). Our backups only go back about two weeks, and many infections sit unnoticed for longer than that. If you're not sure, a professional cleanup is the safer choice.
Common questions
Is cleaning a hacked site part of my hosting support?
Hosting support covers your hosting account and our servers: we'll tell you what our scanner found and help with passwords, backups and account access. Cleaning and repairing the website itself is done through FixMyHackedWebsite.com.
Will my site be suspended?
If an infected site is attacking other sites or sending spam, we may need to limit it to protect other customers. Getting it cleaned quickly is the best way to avoid that.
How do I stop it happening again?
Keep WordPress, plugins and themes updated (How to Update WordPress, Plugins and Themes (and Turn On Auto-Updates)), remove plugins you don't use, use strong unique passwords with two-factor authentication (How to Set Up Two-Factor Authentication (2FA) in cPanel), and apply WP Toolkit security hardening (How to Secure WordPress with WP Toolkit Security Hardening).
Related guides
- What to Do If Your WordPress Site Is Hacked
- How to Restore Your Whole Account to an Earlier Date (JetBackup 5)
- How to Secure WordPress with WP Toolkit Security Hardening
- Who Can I Hire to Help with My Website, Design or Programming?
Still stuck? Open a support ticket and the Instant Access Internet Services team will help.
