Why has my website been suspended for malware or phishing?

Summary

This guide helps you troubleshoot and resolve: Why has my website been suspended for malware or phishing?. Follow the steps below to fix the issue.

Common Causes

If your website has been taken offline with a malware or phishing warning, it usually means your hosting provider detected suspicious activity on your account and suspended it to protect their infrastructure, other customers, and your visitors. Suspensions are not permanent penalties; they are security measures designed to stop malicious code from spreading and to prevent your domain from being blacklisted by search engines and email providers.

Remember — If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Why websites get suspended

Hosting providers monitor accounts for signs of compromise. When they find evidence that a site is being used to attack visitors or harvest credentials, they suspend the account immediately. Common triggers include:

• Malicious scripts uploaded through compromised FTP or control panel credentials
• Outdated content management systems, plugins, or themes with known vulnerabilities
• Phishing pages designed to mimic banks, government services, or popular online stores
• Unauthorised changes to account settings, email forwarders, or DNS records
• Automated attacks using your server to send spam or host malware for other sites

Even if you did not intentionally install anything harmful, an attacker may have gained access through a weak password, an unpatched plugin, or a compromised local computer. Your hosting provider acts quickly because a single infected site can damage the reputation of the entire server and cause email delivery problems for every customer sharing that IP address.

Identify the cause of the suspension

1. Open the suspension email from your hosting provider and look for the specific reason, such as malware detected, phishing page, or spam relay.
2. Note any file paths mentioned, for example /public_html/wp-content/uploads/suspicious-file.php.
3. Check whether your domain appears on Google Safe Browsing or other blocklists by entering your URL into a public security scanner.
4. Review your hosting control panel's error logs and access logs for unusual IP addresses or requests made at odd hours.

Remove malicious code

1. Connect to your hosting account using FTP or your control panel's file manager.
2. Compare your website files against a clean backup from before the compromise. Look for newly created or recently modified files.
3. Delete any unfamiliar scripts, especially in upload directories, temporary folders, or theme files.
4. Remove any unauthorised administrator users from your content management system.
5. Check for hidden email forwarders or auto-responders that may have been set up to steal incoming mail.
6. Reinstall core files for your content management system if you are unsure which files have been altered.

Secure your account

1. Log into your hosting control panel and navigate to the password or security settings.
2. Create a strong, unique password using a mix of uppercase, lowercase, numbers, and symbols.
3. Enable two-factor authentication if your provider offers it.
4. Update the database password in your website configuration file, such as wp-config.php, to match the new database credentials.
5. Scan the computer you use to manage your website with updated antivirus software.

Request reinstatement

Contact your hosting provider's support team to request that your account be reactivated once the malicious code has been removed and the account has been secured.

Website remains suspended after cleanup

Hosting providers often require manual verification before reactivating an account. If your site is still offline:

• Ensure you have actually removed all flagged files, not just disabled them.
• Check that no backdoors remain in theme files, plugins, or the database.
• Reply to your original suspension ticket rather than opening a new one, so the support team has the full history.

Visitors still see security warnings

Even after your site is restored, browsers and search engines may continue showing warnings until their caches update.

• Request a review through Google Search Console if your domain was flagged by Safe Browsing.
• Check whether your domain is listed on email blocklists if your messages are being rejected.
• Allow 24 to 48 hours for warnings to clear after reinstatement.

Remember — If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Still Having Issues?