What to do if your website or hosting has been compromised

Reviewed on October 8, 2026 5 min read hacking malware

An intrusion can affect a small website just as much as a large one. Signs include redirects to other sites, new users, phishing pages, modified files or emails being sent that you do not recognise. These signs guide the investigation; they do not by themselves show how the attacker got in.

Contain and keep evidence

Note down when the problem appeared, which URLs it affects and what legitimate changes were made recently.
Keep a copy of the current state, files, database and logs in isolated storage. Label it as compromised, not as a clean backup.
Limit access to the affected application and the compromised accounts. A maintenance page can hide the home page without stopping scripts, tasks or direct access: check how far the closure reaches.
If there is active phishing, public malware or abusive sending, contact us to coordinate containment and a review of the service.

Do not mass-delete whatever a scanner flags, or restore over the top without keeping the previous state. You may lose legitimate content and the clues needed to stop it happening again.

Investigate the whole account

Review applications and versions, plugins and themes, admin users, FTP/SSH/cPanel access, scheduled tasks, databases and settings. A stolen FTP credential is one possibility; so are a vulnerability, an abandoned dependency or insecure custom code.

Isolation between hosting accounts reduces the reach between customers. Within the same account, several websites can share permissions and credentials: check the other installations, even if they show no symptoms. The service's security measures do not replace maintaining each application.

Choose how to recover

Situation	Next step
There is a backup from before the first signs	Test restoring it, check the content and fix the way in before reopening
There is no reliable backup	Rebuild from official packages and recover only reviewed content
It happens again after cleaning	Check for persistence, other websites on the account, credentials and the devices used

A restore may lose messages, orders or content created after that date. Decide how to keep that data and do not assume the backup is clean just because it is old.

For WordPress, follow the clean-up procedure. Replace the core and components from trusted sources, review content and settings, and remove anything unnecessary. How long ago a plugin was last updated is a sign to look into its maintenance, not automatic proof of a vulnerability.

Before reopening

Close the way in, apply compatible updates, revoke exposed sessions and secrets, and test the main features. Then check whether unexpected files, users, tasks or emails reappear. A scan with no detections is only one of the checks.

If several websites have different owners or risks, separating them into different hosting accounts can limit the reach of future incidents. Moving an infected website to another account does not clean it.

Google warnings and email problems

Malicious content can trigger Safe Browsing warnings or security issues in Search Console. After fixing every case, request a review from the corresponding report and explain what you have fixed. Warnings are not removed immediately, and their removal does not by itself prove a complete clean-up.

If there was spam, check the queue and the causes before re-enabling sending. The reputation of the domain or IP may be affected; it does not recover simply by deleting the script.

If your website is with another provider

If the compromised website is hosted outside Hostsuar, we can bring it over and clean it free of charge when you order any plan. We follow this same procedure before publishing it here. What it includes and how to request it is in hacked website rescue.