Hacked Website? Malware Cleanup Steps That Actually Work

To clean up a hacked website, work in this order: contain the damage (maintenance mode or restricted access), take a forensic backup of the infected site, change every related password, identify how the attacker got in, remove malicious files and database injections or restore from a known-clean backup, update and harden everything, then request reviews from Google and any blocklists. Skipping the step of finding the entry point is the most common reason sites get reinfected within days.

Signs your website has been compromised

• Visitors are redirected to spam, pharmacy, or gambling sites, sometimes only on mobile or only from search results
• Google Search Console reports security issues, or browsers show a "deceptive site" warning
• Unknown administrator users appear in WordPress or your CMS
• Your hosting provider suspends the account for sending spam or hosting malware
• Unfamiliar PHP files appear in upload folders, or core files change without an update
• Search results show your pages with spam titles in other languages

Step 1: Contain

Put the site into maintenance mode or restrict access by IP while you work. If the server is sending spam, stop outgoing mail for that account. Containment limits harm to visitors and to your domain's reputation, which matters for your business email as well.

Step 2: Take a forensic backup

Before deleting anything, make a full copy of the site files, database, and relevant logs. This preserves evidence, lets you compare files later, and protects you if a cleanup step removes something important.

Step 3: Change credentials

Assume every credential tied to the site may be known to the attacker:

• Hosting control panel (cPanel, Plesk, CWP)
• FTP and SFTP accounts
• Database user passwords, updated in the site configuration
• CMS administrator accounts
• Email accounts on the same domain
• API keys and secrets stored in configuration files

Change them from a computer you trust, and enable MFA wherever possible.

Step 4: Find the entry point

Common causes include:

Entry point	What to check
Outdated plugin, theme, or CMS core	Version history and known vulnerabilities
Stolen or weak password	Login logs, new admin users
Nulled or pirated plugins	Any premium plugin not from the official vendor
Another site on the same account	Old or forgotten installs in subfolders
Insecure file permissions	World-writable files and folders

Review web server access logs around the time the problems started. Look for POST requests to unusual files, uploads, and logins from unfamiliar locations.

Step 5: Clean or restore

You generally have two options:

• Restore from a clean backup taken before the compromise, then apply updates before the site goes live again. This is often the fastest path if you know when the infection started.
• Clean in place by replacing CMS core files with fresh copies from the official source, reinstalling plugins and themes from their vendors, removing unknown files, and searching the database for injected scripts, spam links, and rogue admin accounts.

Server-side scanners help considerably. On cPanel servers, Imunify360 can detect and clean many known malware families automatically, and other tools can scan for suspicious code patterns. Automated tools catch a lot, but a manual review of recently modified files, upload directories, and scheduled tasks (cron jobs) is still important, because attackers often leave a hidden backdoor to regain access.

Step 6: Harden

• Update the CMS, plugins, and themes, and remove anything unused.
• Set correct file permissions and disable PHP execution in upload folders.
• Add a web application firewall, such as Cloudflare WAF or server-level protection.
• Enable MFA for CMS administrators and limit login attempts.
• Schedule automatic offsite backups with enough retention to go back several weeks.

Step 7: Request reviews and monitor

Once the site is clean, request a review in Google Search Console and check whether your domain or IP appears on email or malware blocklists. Request delisting where needed. Then monitor closely for a few weeks: file integrity changes, new admin users, and outgoing mail volume are good early indicators of reinfection.

Our web hosting management service covers cleanup and ongoing protection for cPanel, Plesk, and CWP servers, and our cybersecurity services handle hardening and monitoring.

FAQ

Can I just delete the infected files I can see?

Usually not. Visible symptoms are often the result of a hidden backdoor elsewhere in the files or database. Without finding the entry point and backdoors, reinfection is likely.

Will a hacked website affect our email?

It can. If the server sent spam or your domain was used in phishing, your email may land in spam folders or be rejected. Reviewing SPF, DKIM, and DMARC and checking blocklists should be part of the recovery.

Do we need to tell our customers?

If customer data may have been accessed, consult legal counsel and review applicable regulations to determine your notification obligations.

Next step

Max, our founder, is a certified cPanel & WHM System Administrator and Imunify360 professional with more than 20 years in IT. If your site is showing warning signs, or you want a review before a problem appears, request a free IT assessment.