How to Fix an Infected Website: A Complete Recovery Guide

Your website is loading slowly. Visitors are reporting unexpected redirects. Google Search Console is showing a security warning. Or worse — your hosting provider has suspended your account entirely.

These are the signs of a malware infection. And if you're seeing any of them, every minute counts.

This guide walks you through exactly what to do — from initial diagnosis through full recovery and hardening — in plain language, step by step.

How Websites Get Infected

Understanding the entry points helps you close them permanently after cleaning. The most common ways websites get compromised:

Most infections aren't targeted attacks — they're automated bots scanning the internet for known vulnerabilities and exploiting them at scale. That means even small websites are at risk.

Common Types of Website Malware

Malicious Redirects

Visitors land on your site and get silently redirected to spam, phishing, or adult content sites. Often only triggers for mobile users or visitors arriving from Google — making it hard to detect as the site owner.

Drive-by Downloads

The site automatically pushes malware downloads to visitors without any interaction. Exploits browser or plugin vulnerabilities to install viruses, trojans, or ransomware on visitor devices.

Backdoors

Hidden code that gives attackers persistent access to your server — even after you've changed passwords. Backdoors are often buried deep in file structures and survive basic cleanup attempts.

Phishing Pages

Fake login pages or payment forms embedded in your site, designed to steal visitor credentials or financial information. Often invisible in normal browsing but indexed separately by Google.

SEO Spam

Hidden links or keyword-stuffed pages injected into your site to boost the rankings of gambling, pharmaceutical, or adult content sites. Destroys your own SEO authority in the process.

Cross-Site Scripting (XSS)

Malicious scripts injected into your site's content that execute in visitors' browsers — stealing session cookies, capturing form data, or hijacking accounts.

Step 1: Confirm the Infection

Before taking any action, confirm what you're dealing with. Run your domain through these free scanners:

Sucuri SiteCheck — sucuri.net/website-security-platform/sitecheck The most comprehensive free website malware scanner. Checks for malware, blacklist status, injected spam, and outdated software in one scan.

Google Safe Browsing — transparencyreport.google.com/safe-browsing/search Check whether Google has flagged your site as dangerous. If it has, visitors using Chrome will see a full-page warning before reaching your site.

VirusTotal — virustotal.com Scans your URL against 70+ antivirus engines simultaneously. Useful for confirming what Sucuri found and identifying specific malware strains.

Quttera — quttera.com Detects malicious code, suspicious files, and infected elements with detailed remediation guidance.

Norton Safe Web — safeweb.norton.com Cross-reference with Norton's threat database for additional confirmation.

Run at least two scanners. No single tool catches everything. Combining results gives you a more complete picture of the infection scope.

Step 2: Take the Site Offline

Once infection is confirmed, take your site offline immediately. This prevents further damage to visitors and stops the malware from spreading.

Most hosting control panels allow you to:

• Put the site into maintenance mode
• Password protect the directory temporarily
• Contact your host to suspend the site while you clean it

Notify your hosting provider about the infection — they may have server-level logs that help identify exactly how the breach occurred, and some managed hosting providers include malware removal assistance in their support offering.

Step 3: Back Up Everything — Including the Infected Files

This seems counterintuitive, but back up the infected version before touching anything.

Why: You need a reference point to identify exactly what changed. Comparing the infected backup against a clean version helps you find every compromised file — including any that scanners missed.

Back up:

• All website files (via FTP or File Manager)
• The complete database
• Your DNS records and server configuration

Store the backup somewhere off-server — local drive or cloud storage.

Step 4: Change Every Password Immediately

Before cleaning a single file, lock down access:

• Hosting control panel (cPanel, Plesk, etc.)
• FTP / SFTP accounts — delete any FTP accounts you don't recognize
• Database password — update in both the database and your CMS config file
• CMS admin password (WordPress, Drupal, etc.)
• Email accounts associated with the domain
• Domain registrar account

Enable two-factor authentication on every account that supports it. Attackers often leave access credentials behind even after you think you've cleaned the infection.

Step 5: Remove Malware — The Systematic Approach

Option A: Restore From a Clean Backup

If you have a verified clean backup from before the infection, this is the fastest path. Restore the backup, then update all software and passwords before bringing the site back online.

Verify the backup date — make sure the backup predates the infection. Check your server access logs to estimate when the breach first occurred.

Option B: Manual Cleanup

If no clean backup exists, you'll need to clean manually.

1. Download all files via FTP Pull a complete copy of your site to your local machine for inspection.

2. Identify modified files Look for files modified around the date the infection likely began. In cPanel, use File Manager's sort-by-date feature. Via command line:

find /public_html -mtime -30 -type f -name "*.php"

This finds all PHP files modified in the last 30 days.

3. Look for common malware signatures Search file contents for these patterns — they're common in injected malware: