On this page
Definition
A website malware infection happens when malicious code, files, scripts or redirects are added to a website without authorisation. It may be used to steal data, send spam, redirect visitors, create hidden pages, damage search visibility or gain control of the hosting environment.
If your website is infected, the first priority is containment. Do not keep making random changes, do not ignore browser warnings, and do not restore an old backup until the cause of the infection is understood.
Quick Answer
- If your website is infected with malware, restrict access, take a safe backup, contact your hosting or website support provider, then scan and clean the site before putting it fully back online.
- Malware can affect customer trust, website forms, payment flows, search visibility, browser warnings and email reputation, so it should be treated as a business continuity issue.
- Cleaning files is only part of recovery. You also need to fix the vulnerability, review users and passwords, check DNS and hosting, submit review requests where needed, and improve ongoing monitoring.
First response
What To Do Immediately If Your Website Has Malware
Recovery process
A Safe Website Malware Recovery Process
The exact recovery process depends on the platform, hosting environment and type of infection. These steps outline the general order a business should follow when a website is compromised.
-
Contain the infection
Restrict public access if the site is harming visitors, redirecting traffic or distributing suspicious files. Notify the right internal people, pause risky changes, and avoid installing extra plugins or tools without a clear plan.
-
Diagnose and clean the website
Scan the files, database, users, forms, uploads, templates and configuration. Remove malicious code, unwanted users, spam pages, hidden redirects and backdoors. Restore from backup only if the backup is known to be clean and the original weakness has been fixed.
-
Harden, test and request reviews
Patch software, rotate passwords, review access permissions, check hosting logs, test forms and payment paths, then request a review from Google Search Console or security warning providers if the website was flagged.
Do Not Restore a Backup Blindly
Common Signs Your Website May Be Infected
Malware does not always announce itself clearly. Some infections are obvious, while others run quietly in the background for weeks.
Visitors are redirected to another website
Likely cause
A malicious script, altered template file, compromised plugin or database injection may be forcing visitors to a spam, phishing or adult website.
Solution
Restrict access if visitors are at risk, scan files and database content, review recent changes, remove the redirect source and check for backdoors that could recreate it.
Google or browsers show a security warning
Likely cause
The website may have been flagged by Google Safe Browsing, antivirus systems or browser security checks because malware, phishing content or suspicious downloads were detected.
Solution
Clean the infection, fix the underlying issue, verify the site in Google Search Console where applicable, then request a review once the site is safe.
Unknown pages appear in search results
Likely cause
Attackers may have created spam pages, hidden doorway pages or injected links to manipulate search engines or promote unrelated products.
Solution
Remove the spam pages, check the sitemap and internal links, return proper 404 or 410 responses where needed, and monitor indexing until search results refresh.
Business impact
How Malware Can Affect Your Website, SEO and Customers
Website Malware Recovery Checklist
Use this checklist to understand what needs to be reviewed during a malware recovery. The exact steps may vary by platform and hosting setup.
-
Review access and credentials
Change administrator passwords, hosting passwords, FTP or SFTP credentials, database passwords and any shared agency or developer accounts. Remove unknown users and reduce permissions where access is too broad.
-
Check files, database and uploads
Malware can sit inside theme files, CMS files, uploaded media folders, database content, configuration files and scheduled jobs. A clean-up should check more than the homepage.
-
Confirm the site is safe before requesting review
If the website was flagged by Google or a browser, request a review only after the infection and underlying weakness are fixed. Repeated failed reviews can delay recovery.
Mistakes To Avoid During Malware Clean-Up
A rushed clean-up can leave the site vulnerable or make the problem harder to diagnose. These are common mistakes we see businesses make when they are under pressure.
Only removing the visible symptom
Do this instead
Look for the cause, not just the obvious injected text, redirect or spam page. If a backdoor, weak password or vulnerable component remains, the website may be reinfected.
Ignoring connected systems
Do this instead
Review hosting, DNS, email forms, analytics, payment gateways, third-party scripts and administrator accounts. Malware can affect more than the website files.
Putting the site live before testing
Do this instead
After cleaning, test key pages, forms, checkout flows, SSL, redirects, mobile display, indexing signals and server responses. A site can be malware-free but still broken.
Can You Remove Website Malware Yourself?
When an internal fix may be reasonable
- The issue is limited to a low-risk test site with no customer data, payment flow or important search visibility.
- You have reliable backups, clear access to hosting, and someone internally who understands the website platform and server environment.
- You are performing simple first-response tasks, such as changing passwords, pausing new changes and collecting evidence for your support provider.
When professional support is safer
- The website handles enquiries, bookings, payments, customer records or other business-critical functions.
- The infection keeps coming back, the site has been blacklisted, or you do not know when the malware first appeared.
- Hosting, DNS, email, CMS access and third-party providers are spread across different accounts and no one has a clear picture of the setup.
Malware Clean-Up vs Ongoing Website Maintenance
Emergency clean-up and preventative maintenance solve different problems. Most businesses need both at different times.
| Area | Emergency Malware Clean-Up | Ongoing Website Maintenance |
|---|---|---|
| Main purpose | Contain, diagnose and remove an active infection. | Reduce the chance of issues through monitoring, updates, backups and technical care. |
| Timing | Reactive, usually after warnings, redirects, spam pages or suspicious behaviour appear. | Proactive, carried out before issues become visible or disruptive. |
| Business value | Helps restore a compromised website and reduce immediate harm. | Supports long-term reliability, security, performance and business continuity. |
Our approach
How We Approach Website Malware and Security Issues
Website Malware FAQs
These answers cover common questions businesses ask when they discover a website infection.
Should I take my website offline if it has malware?
Will malware permanently damage my SEO?
Can malware come back after it is removed?
Need Help With an Infected Website?
If your website is showing malware warnings, strange redirects, spam pages or suspicious behaviour, we can review the issue and explain the safest next step. For urgent website, hosting, domain or email issues, contact us so we can assess the severity and support options.