Malware on Shared Hosting: Detect and Remove It

Q: Can malware on my site affect my visitors?

Yes. Depending on the type of malware, your visitors may be redirected to fraudulent sites, see unauthorized intrusive ads, or even unknowingly download malicious files. That's why it's urgent to act as soon as you detect the infection.

Q: How long does Google take to remove the warning after the site is clean?

After cleaning the site, you must request a review in Google Search Console (under "Security Issues"). Google typically reviews within 1 to 3 business days and, if everything is clean, removes the warning.

Q: Should I notify my users if my site was infected?

If the site collected user data (emails, passwords, payment info) and that data may have been exposed, the answer is yes—and in many countries it's a legal obligation. Consult a legal advisor based on your jurisdiction.

Q: Does an SSL certificate protect against malware?

No. SSL encrypts the communication between the browser and server, but it doesn't protect your site's code. A site with HTTPS can be perfectly infected with malware. They are independent security layers.

If your website has been flagged by Google, is loading slowly for no apparent reason, or you're seeing strange redirects, your shared hosting account likely has malware. The good news: with the right process you can detect and remove it without losing your content.

Why Is Shared Hosting Vulnerable to Malware?

On shared hosting, your website lives on the same server as dozens or hundreds of other sites. If one of those neighbors has a vulnerability, in some cases malware can spread or server resources become compromised.

But the most common cause of infection is not your neighbor—it's your own outdated code. The main entry points are:

Outdated WordPress plugins, themes, or CMS core files
Weak or reused passwords (FTP, control panel, database)
Forms without proper injection protection
File uploads without type validation
Overly permissive file permissions (e.g., 777)

Signs Your Site Has Malware

Before scanning, check whether you're experiencing any of these red flags:

Google warning: "The site ahead contains malware"
Unexpected redirects to phishing, pharmacy, or gambling sites
Your hosting provider suspended your account for malicious activity
Spam emails being sent from your domain without your knowledge
Unknown PHP files inside image folders or theme directories
Sudden traffic drop in Google Search Console

Even one of these symptoms is enough reason to run a full scan.

How to Detect Malware on Shared Hosting: Step by Step

1. Scan from the Outside (No Server Access Needed)

Start with external tools that analyze your URL without needing credentials:

Sucuri SiteCheck (sitecheck.sucuri.net): detects malware, blacklists, and outdated CMS versions.
VirusTotal: checks your domain against 70+ antivirus engines.
Google Safe Browsing: confirms whether your site is on Google's blacklist.

2. Review Files via File Manager or FTP

Log into your cPanel file manager or connect via FTP. Look for:

.php files in folders that should only contain images (e.g., /uploads/)
Files with random names like xjk39a.php
Recent modifications to files you didn't touch (sort by date)
Obfuscated code using base64_decode, eval(), or gzinflate() at the top of PHP files

3. Scan with a Plugin If You Use WordPress

If your site runs on WordPress, install Wordfence Security or MalCare. Both offer free scanning and pinpoint exactly which files are compromised.

4. Check the Database

Malware can also inject itself into the database. Export a SQL dump and search for suspicious strings like <script src="http://, eval(base64, or unknown domain URLs inside posts or widget settings.

How to Remove the Malware

Option A: Restore from a Clean Backup

If you have a recent backup from before the infection, this is the fastest and safest option. Restore the files and database, then immediately update all plugins, themes, and the CMS before bringing the site back online.

Option B: Manual Cleanup

If you don't have a backup, or the backup is also infected, follow this order:

Put the site in maintenance mode to protect your visitors.
Download a clean copy of the CMS from the official source and replace the core files.
Download clean copies of every plugin and theme from their official repositories.
Manually delete the injected PHP files you found during the scan.
Clean the database by removing or correcting rows containing malicious code.
Change all passwords: control panel, FTP, database, email, and CMS admin account.

Option C: Professional Cleanup Service

If the infection is complex or the site is business-critical, consider hiring a cleanup service such as Sucuri or a specialized agency. The cost is usually worth the certainty of a thorough cleanup.

After Cleanup: Prevention

Removing the malware is only the first step. If you don't fix the vulnerabilities that allowed entry in the first place, you'll be reinfected within days or weeks.

Update your CMS, plugins, and themes as soon as new versions are released.
Enable two-factor authentication on your admin panel.
Set correct file permissions: folders to 755, files to 644.
Install a web application firewall (WAF), such as Cloudflare's free plan.
Set up automatic daily backups and periodically verify they work.
Use unique, long passwords for every access point; store them in a password manager.

For more comparisons and security tool recommendations to protect your online presence, visit our web hosting and security comparisons section.

Choosing a hosting provider that takes security seriously makes an enormous difference. At elenlace.com you'll find hosting plans with daily backups, malware monitoring, and Spanish-language technical support to help you handle any incident.

Key Takeaways

Shared hosting is vulnerable mainly due to outdated code and weak passwords, not just server neighbors.
The clearest signs of infection are strange redirects, Google warnings, and unknown PHP files on the server.
Always start with an external scan (Sucuri SiteCheck, VirusTotal) before accessing files directly.
The fastest way to clean up is to restore a clean backup and update everything immediately afterward.
Without fixing the underlying vulnerabilities, reinfection is just a matter of time.

Suspect your site is infected, or want to harden it before an incident occurs? Reach out to the elenlace.com team for a security audit and, if needed, a migration to safer hosting.

FAQ

Can malware on my site affect my visitors?