My business website has been hacked and is spreading malware

A website compromise occurs when an attacker gains unauthorised access to your site's files or database and inserts malicious code. This can lead to visitors being redirected to phishing pages, customer credentials being stolen, or your server being used to distribute malware. Search engines and email providers often flag compromised domains, resulting in browser warnings, email blacklisting, and a loss of customer trust.

Quick Fix Steps

1. Take the website offline immediately to prevent further spread of malware.
2. Change all administrative, FTP, and database passwords.
3. Scan your local computer for malware using updated antivirus software.
4. Restore your site from a clean backup taken before the infection.
5. Update your CMS, plugins, themes, and all server-side scripts to the latest versions.
6. Request a review from Google Search Console and contact your email provider to resolve blacklisting.

Detailed Instructions

1. Take the Site Offline

If your hosting control panel provides a maintenance mode or site suspension feature, enable it immediately. This prevents visitors from accessing infected pages and stops the malware from spreading to other users.

2. Change All Passwords

Attackers often retain access through compromised credentials. Change passwords for:

• Your hosting control panel
• CMS administrator accounts (e.g., WordPress, Joomla, Drupal)
• FTP and SFTP accounts
• Database users
• Email accounts associated with the domain

Use strong, unique passwords for each account.

3. Scan Your Local Computer

Malware on your computer can capture login credentials and reinfect your website. Run a full system scan using your antivirus software and remove any threats detected before proceeding.

4. Restore from a Clean Backup

If you have a backup from before the infection, restore your website files and database from that point. Verify the backup date predates the compromise. If no clean backup exists, you will need to manually identify and remove malicious code from your files and database.

5. Update All Software

Outdated CMS versions, plugins, and themes are common entry points. Log in to your website administrator dashboard and apply all available updates. Remove any plugins or themes you no longer use.

6. Remove Malicious Code

If restoring from backup is not possible, inspect your site files for unfamiliar or recently modified scripts. Pay particular attention to:

• index.php, header.php, and footer.php files
• .htaccess files for suspicious redirects
• WordPress wp-config.php and functions.php files
• Recently uploaded files in media or upload directories

Use a reputable security scanner to identify infected files, then remove or replace them with clean versions.

7. Resolve Search Engine and Email Warnings

Once the site is clean, request a malware review through Google Search Console. If your emails are being blocked, contact your email service provider to request delisting from any blacklists. This process can take several days.

Troubleshooting

Website Remains Suspended by Host

Some hosting providers suspend accounts when malware is detected. You will need to provide evidence that the infection has been removed before they will reactivate your account. This typically involves submitting a ticket through your hosting provider's support portal.

Google Still Shows a Warning

After cleaning your site, verify ownership in Google Search Console and request a review under the Security Issues section. Google may take several days to re-scan your site and remove the warning.

Emails Are Being Rejected

If your domain is blacklisted by email security providers, your outgoing messages may be bounced. Identify which blacklist is affecting your domain and follow their delisting process. Ensure your site is fully clean before requesting removal, or you may be relisted.