Website Malware:Signs of Infection and What to Do

The most common signs of website malware are unexpected redirects (often only for some visitors), spam pages or links you did not create, browser or search-engine warnings, unknown administrator accounts or files, a sudden drop in performance, and warnings from your hosting provider. If you see any of them, act quickly: take a backup of the current state, change passwords, and investigate or get help before the problem spreads or your site is blocked.

This guide applies to any kind of website. For WordPress-specific cleanup steps, see how to clean a hacked WordPress site.

Warning signs

What visitors and search engines see

• Visitors are redirected to gambling, pharmacy, adult or fake-prize sites. Often this happens only on mobile, only for visitors from search results, or only once per visitor, so you may not see it yourself.
• Search results for your site show strange titles or pages in other languages (a "pharma" or "Japanese keyword" hack).
• Browsers show a "Deceptive site ahead" or "This site may harm your computer" warning.
• Antivirus software on visitors' computers blocks your site.

What you might see behind the scenes

• Admin users you did not create.
• New or modified files you did not change, such as PHP files in upload folders.
• Injected code at the top or bottom of files, often obfuscated.
• Outgoing spam from your server, reported by your host or seen in mail logs.
• High resource use or slow pages without a traffic increase.
• Suspicious scheduled tasks (cron jobs).

What others tell you

• Your hosting provider suspends the account or reports malware or spam.
• Google Search Console reports a security issue.
• Customers report strange behaviour or emails.

How to confirm

• Check the site from a private browser window on a mobile connection, and from a search results page.
• Run an online scan from a reputable security service (these only see what the public sees).
• Ask your host for a server-side malware scan and recent access logs.
• Check Search Console's Security issues report.
• Compare files with a clean copy or your version control.

First steps: contain the damage

1. Back up the current, infected state (files and database). It helps the investigation and protects you if cleanup goes wrong.
2. Change passwords for the website admin, hosting/control panel, FTP/SFTP, database and email, from a clean computer.
3. Put the site in maintenance mode if it is harming visitors.
4. Tell your host, who may have logs and can check other accounts.
5. Do not just delete obviously bad files and move on: backdoors are often hidden in several places.

Example: the hidden mobile redirect

A shop owner hears from a customer that "your website sends me to a casino". On the owner's laptop, the site looks normal. The investigation:

1. Testing in a private window on a phone using mobile data, after clicking the site from a Google search result, reproduces the redirect.
2. The host's scan finds obfuscated JavaScript injected into the theme's footer file and a malicious PHP file in the uploads folder.
3. The script only redirects visitors who arrive from search engines on mobile devices, and sets a cookie so each visitor is redirected once, which is why the owner never saw it.
4. The entry point turns out to be an outdated form plugin with a known vulnerability.

Cleaning the files without updating the plugin would have led to reinfection; updating it, removing the malicious files, rotating passwords and adding a firewall closed the incident.

Gathering useful information for your host or a specialist

• When the problem was first noticed, and by whom.
• Exact URLs and devices where it appears.
• Recent changes: updates, new plugins, new users, password changes.
• Any warnings from Google, the host or antivirus software.
• Access to logs and a backup of the current state.

This information shortens the investigation considerably.

Cleaning up

The general approach:

1. Identify how the attacker got in (outdated software, stolen password, vulnerable plugin, infected neighbouring site in the same account).
2. Replace application code with clean copies from official sources.
3. Remove malicious files, scheduled tasks and database content.
4. Rotate all credentials and secret keys.
5. Fix the entry point: update everything, remove vulnerable components.
6. Request reviews from Google and remove blacklisting once clean.

If you are not confident doing this, professional cleanup is worth the cost, especially for stores and sites holding personal data.

Restoring from backup

A clean backup from before the infection can be faster than cleaning, but you must know when the infection began and still fix the entry point, or reinfection follows. See backup security.

Prevention

• Keep software updated and remove unused components.
• Use strong passwords and 2FA.
• Use a web application firewall and malware scanning.
• Keep separate sites in separate hosting accounts.
• Monitor file changes and Search Console.

See website security basics.

Frequently Asked Questions

Why can't I see the redirect myself?

Malware often hides from logged-in administrators and repeat visitors, and targets only mobile users or visitors arriving from search engines.

Will my host fix it for me?

Policies vary. Many hosts scan and report, and some clean for a fee. Ask what is included in your plan.

Do I need to inform anyone?

If personal data may have been accessed, you may have legal obligations depending on your jurisdiction. Get advice.

Related reading

For WordPress, see how to clean a hacked WordPress site. If you suspect malware on your ServerNeed account, contact support for logs and help.

Sources

• Google Search Central: Security issues and hacked sites
• Google Search Console: Security issues report