Website malware removal, how to clean an infected site step by step
In short: website malware removal is not just deleting one suspicious file. You have to find and remove all the malicious code, close the hole the attacker used, and make sure no hidden back doors are left. Otherwise the infection comes back within days.
A hacked site rarely looks dramatic. Most often it shows up quietly: spam appears in Google results, visitors get redirected to other sites, antivirus warns on entry, and the browser shows a red „dangerous site" screen. Below we explain how to clean an infected site and, most importantly, how to make sure the infection does not return.
How to tell a site is infected
Typical signs are redirects to other domains, unknown pages about pills or gambling in search results, a Google „this site may harm" warning, traffic spikes from odd countries, new admin accounts and a slower site. If you see even one of these, treat the site as infected. We cover more symptoms in how to tell your site has a virus and ads and redirects as a sign of infection.
Website malware removal, step by step
1. Stop the damage and preserve evidence
First, limit the blast radius. Enable maintenance mode or temporarily take the site out of traffic so it stops infecting visitors and hurting your Google reputation. Before you delete anything, take a full snapshot of the current state (files plus database). It is both evidence and a safety net. If you are not sure where to start in the first minutes, see what to do in the first hour after a hack.
2. Find the malicious code in files
Look for files changed on the infection date, suspicious PHP scripts in the uploads folder (no executable code should live there), obfuscated code (eval, base64_decode, long strings) and so-called webshells, small files that give the attacker remote control. Comparing files against a clean backup or a fresh original version of the system (WordPress, Joomla, plugins) makes finding changes much faster.
3. Clean the database
Infections often sit in the database too: scripts injected into post content, swapped URLs, hidden admins, malicious option entries. This part has to be reviewed separately, because cleaning files alone will not touch it. The post cleaning the WordPress database helps.
4. Close the hole the attacker used
This is the most important step, and the one most often skipped. If you do not close the entry point, the infection returns. Update the core, plugins and themes, remove pirated („nulled") code, change all passwords (panel, database, FTP, hosting) and turn on strong passwords and 2FA. Also check whether the problem is on the server side, as with the critical PHP vulnerability.
5. Remove back doors and cron jobs
Attackers almost always leave themselves hidden entries that bring the infection back. Review cron jobs, unknown accounts, added keys and redirect rules. Only removing every back door finishes the cleanup.
6. Restore the site and request a Google review
Once the site is clean and the hole is closed, restore normal traffic. If the site was flagged as dangerous, request a review, which we cover in Google flagged your site as dangerous. After the warning is cleared, rankings usually come back.
What NOT to do
Do not delete individual files in a panic without a backup, you can break the site and lose evidence. Do not count on „one plugin scan" to fix it. Do not restore an old backup without closing the hole, it will get reinfected. And do not leave the job half done: an incompletely cleaned site returns to its infected state, and the next cleanup is harder.
How to avoid getting reinfected
Cleanup is a cost you can usually avoid. The basics are: regular updates without breaking the site, backups in the 3-2-1 model, strong passwords with 2FA, and monitoring that catches an infection before it grows into a big problem. That is exactly what ongoing website care is made of.
Do not want to do this yourself?
Malware removal is tedious and easy to get wrong, and a single uncleaned back door brings the whole problem back. If your site is infected or Google flagged it, get in touch. We will clean it, close the entry point and secure it for the future. See also what our website care covers.