A hacked website is not just an embarrassment - it can put your visitors at risk, get your domain blacklisted by Google, and tank months of SEO progress overnight. The troubling part is that most infected sites look completely normal to the owner while quietly redirecting visitors, serving spam, or stealing data.
Here is how to detect a malware infection, remove it, and make sure it does not come back.
Signs Your Site May Be Infected
Malware is often designed to hide from site owners while targeting visitors. Watch for these warning signs:
- Google Search Console alerts - Google actively scans for malware and will email you if it detects a problem
- Visitors are redirected to unrelated or suspicious websites
- Your browser flags the site with a "Deceptive site ahead" warning
- Unexpected content appears - pharmaceutical spam, foreign-language pages, or hidden links in your footer
- Your hosting account is suspended due to malicious script activity
- Server resources spike for no clear reason
- Your site appears in spam emails you did not send
If you notice any of these, act immediately. Every hour counts.
Tools to Scan Your Website
You do not need to dig through code manually. These free tools can detect most common infections:
Sucuri SiteCheck (sitecheck.sucuri.net) scans your site's publicly visible pages for known malware signatures, blacklist status, and injected code. It is a good first step and takes about 30 seconds.
MalCare is a WordPress plugin that performs a deep server-side scan, catching hidden malware that surface-level tools miss. The scan is free, though cleanup requires a paid plan.
VirusTotal lets you submit your URL and checks it against dozens of antivirus engines simultaneously.
Start with Sucuri SiteCheck for a quick read, then use MalCare if you need a deeper diagnosis.
How to Clean a Hacked WordPress Site
Step 1: Take the site offline temporarily. Use a maintenance mode plugin or your host's suspend option to prevent further harm to visitors while you clean up.
Step 2: Change all passwords. Update your WordPress admin password, hosting account password, FTP credentials, and database password. If credentials were stolen, cleaning the site without changing passwords is pointless.
Step 3: Scan with a security plugin. Install Wordfence or MalCare and run a full scan. These plugins will flag modified core files, injected code, and backdoors.
Step 4: Remove infected files. For WordPress core files, download a fresh copy from WordPress.org and replace the infected versions. For theme and plugin files, reinstall from official sources rather than editing manually.
Step 5: Check for backdoors. Hackers often plant hidden files that let them regain access even after a cleanup. Look for unfamiliar PHP files in your uploads folder, and scan for functions like eval(base64_decode(...)) which are common in malicious code.
Step 6: Review your database. Use phpMyAdmin to look for suspicious content in posts and options tables - particularly injected <script> tags or hidden links.
Restoring from a Clean Backup
If the infection is widespread, restoring from a clean backup is often faster and more reliable than manual cleanup. The key word is clean - restore from a backup taken before the infection occurred.
dotCanada hosting accounts include automated daily backups. Check your backup timestamps against the date you first noticed unusual activity, and restore from a point before that.
After restoring, still change all passwords and identify how the site was compromised, or the same attack will happen again.
Preventing Reinfection
Cleaning a site is only half the job. Here is how to stay protected:
- Keep WordPress, themes, and plugins updated - the majority of infections exploit known vulnerabilities in outdated software
- Delete unused plugins and themes - they are attack surfaces even when deactivated
- Use strong, unique passwords and store them in a password manager
- Enable two-factor authentication (2FA) on your WordPress admin account and hosting panel
- Limit login attempts with a plugin like Limit Login Attempts Reloaded
- Install a firewall - Wordfence and Sucuri both offer web application firewalls that block malicious traffic before it reaches WordPress
- Run regular scans - schedule monthly scans even when things seem fine
A malware infection is stressful, but recovery is absolutely possible. The best outcome is treating it as a wake-up call to tighten security before it happens again.
