Hosting account suspended for malware

A hosting suspension for malware means your host turned the site off, or limited it, because a scanner reported unwanted software or a similar abuse issue. Visitors may see the host's notice instead of your pages. You usually cannot finish the cleanup until the host lets you reach the files, and you should not restore a backup until you know that copy is clean.

What you are seeing

The website does not load as usual. Visitors see a suspension notice, a forbidden error, or a parked page. The control panel may mark the account suspended, SFTP may fail, or email may still work while the site does not. The message that matters is the host's email or ticket. It often says malware, phishing, or outgoing spam, and it sometimes lists file paths.

Read that list closely. PHP under wp-content/uploads is a different job from a path inside a plugin you installed, and both differ from a mailbox that sent a flood of messages. "Malware" in the email is their category, not a full diagnosis. Some flags are real. Some are a legitimate plugin their scanner dislikes.

If several sites share the login, one site can get the whole account suspended. Check which document root the paths point at before you delete anything.

Why it happens

The scan is a detector, not a cleanup. On WordPress, named files are often PHP in wp-content/uploads, an altered theme, or core that no longer matches wordpress.org. An unknown administrator is a common reason they return. If the ticket mentions mail, ask whether a mailbox was involved.

A flag inside a real plugin can be wrong. Compare it with a clean copy, then say so or replace it. How the site was changed matters after it is back online.

How to check if you are affected

If the site is already offline, a public scanner mostly sees the suspension page. The check below is read-only and does not log in. "We could not load the real site" fits a suspension. It does not tell you what is inside the account.

Site URL Scan my site free

Read-only scan · No install · Results in about 30 seconds

1. Save the host email and every path it names. If there are no paths, reply and ask. Guessing which file offended the scanner is how the wrong file gets deleted.
2. Note what the public site returns now. A screenshot is enough for your records.
3. Try the file manager or SFTP they still allow. Many hosts leave a cleanup login and block public HTTP. If every door is locked, the next step is the ticket, not another password guess.
4. Compare each flagged path with a clean copy. Core should match the archive from wordpress.org. A plugin should match the zip from WordPress.org or the vendor. PHP in uploads is not normal media. See strange PHP files in uploads.
5. If WordPress still opens, list administrators and posts you did not write. If it does not, do that as soon as you have a way in.
6. If the ticket mentions mail, ask which address, and plan to reset that mailbox as well as WordPress.

Do not upload a fixer script the host did not ask for. Their scanner will treat it as another finding.

How to fix it yourself

1. Leave the site isolated. Ask for file access instead of a temporary unsuspend.
2. Download a backup before you delete, if they allow it. Label it as the suspended copy. Restoring it blindly often gets the account suspended again.
3. Remove unexpected PHP from uploads. Replace flagged core from wordpress.org: wp-admin, wp-includes, and root PHP files, not wp-config.php. Replace flagged plugins and themes, or remove them if you cannot get a clean copy.
4. When you can log in, remove unknown administrators.
5. Update what you reinstalled, from the official source only.
6. Reset administrator, SFTP, hosting, database, and any mailbox passwords the ticket named. Update DB_PASSWORD in wp-config.php if needed. Replace salts from the WordPress salt service.
7. Ask the host to disable PHP execution in wp-content/uploads. On Nginx, .htaccess does nothing.
8. Reply with what you removed and ask for a re-scan. Cleaning files without telling them does not turn the site back on.

DIY is a bad idea with no backup, when each re-scan suspends you again, or when you cannot open the file manager. Do not delete wp-includes because the email said "malware." See how to clean a hacked WordPress site.

When to get help

Get help when the host listed more paths than you can compare, when this is the second suspension, or when the panel is locked and the only copy is on their disk. Bring the ticket and the path list. You do not need the malware's name.

Emergency Cleanup is a flat $499. The 30-day reinfection guarantee means we clean again, or we refund the fee if we cannot clean it. We start only after you confirm you own the site. The host may also need to hear that you authorize the work. There is no countdown. Email daniel@daniellasek.com or use the button below.

Fix it now — $499 Talk to us by email

FAQ

Can I unsuspend a hosting account myself from the control panel?

Usually no. The host turns the site back on after their check passes, or after you remove what they flagged and ask them to look again. Use the ticket they opened rather than clicking random panel buttons.

The host flagged a file inside a plugin I use. Should I delete the whole plugin?

Compare it with a fresh copy from the author or from WordPress.org. If the files differ, replace them. If the plugin is abandoned, or you got it from a random download, remove it and pick a maintained alternative.

Will restoring a backup lift a malware suspension?

Only if that backup is clean and the host agrees to review it. Restoring yesterday's files often restores the same malware. Ask the host before you overwrite anything they quarantined.

The site is suspended and I have no backup. What should I do?

Stop experimenting on the only copy. Ask the host for the flagged paths and for a download of the files if the panel is locked. That is a sensible time to get help instead of deleting core files you cannot replace.