If your website is showing strange ads, redirecting visitors to unknown pages, or Google is flagging it as dangerous, you likely have malware. The good news: in most cases you can detect it, remove it, and get back online without losing your site.
How to Tell If Your Website Has Malware
Before you start cleaning, confirm the infection. The most common warning signs are:
- Unexpected redirects: visitors land on spam or adult pages they never searched for.
- Google warning: search results show "This site may harm your computer" or Safe Browsing blocks the URL.
- Unauthorized ads or popups: advertising appears that you never installed.
- Hosting account suspended for malicious activity or spam email sending.
- Unexplained changes: new pages, admin users, or files that nobody created.
- Sudden slowdown with no recent server changes.
If you recognize two or more of these symptoms, act immediately. Every hour of delay can damage your SEO, your brand reputation, and your visitors' security.
Free Tools to Scan for Malware
Before touching any files, run an external scan to get objective evidence:
- Google Search Console → Security & Manual Actions: shows whether Google has already flagged malicious code on your pages.
- Sucuri SiteCheck (
sitecheck.sucuri.net): analyzes your public HTML and lists suspicious scripts, blacklist entries, and hidden iframes. - VirusTotal: submit your site URL and cross-reference it against 70+ antivirus engines.
- MXToolbox Blacklist Check: verifies whether your domain or IP is on email or browser blacklists.
Document the results before deleting anything — you'll need them for your Google review request.
Steps to Remove Website Malware
1. Change all passwords first
Cut off the attacker's access before cleaning files. Change passwords for your hosting control panel, FTP/SFTP, database, and your CMS (WordPress, etc.). Use passwords of at least 16 characters with special characters.
2. Take a backup (even if it's infected)
Download a full backup. You'll need it to compare original files against modified ones. Don't restore this backup — use it only as a reference.
3. Identify modified files
In your hosting file manager or via FTP, sort by modification date. Look for files changed on dates you don't recognize. Malware typically hides in:
index.php,wp-config.php,.htaccess- WordPress plugin and theme folders
- Files with random names like
x7fk2.php
4. Clean or replace infected files
For WordPress: download a fresh copy from wordpress.org and replace the entire wp-admin and wp-includes folders. Reinstall themes and plugins from their official sources. Manually check wp-content/uploads — PHP files there have no legitimate reason to exist.
For custom sites or other CMSs, compare each suspicious file against the original from your repository or a clean backup. Remove or fix lines containing eval(base64_decode(...)) or $_POST/$_GET executing code.
5. Clean the database
Malware sometimes injects scripts into database content. Export a SQL dump and search with a text editor for strings like <script src=, eval(, or suspicious external URLs in text fields. Fix them before reimporting.
6. Update everything
Your CMS, plugins, themes, and PHP version must all be on the latest stable release. Most malware exploits known vulnerabilities in outdated software.
7. Request a Google review
In Google Search Console, go to Security & Manual Actions → Security Issues and request a review once your site is clean. Google typically responds within 24–72 hours.
How to Prevent Malware from Coming Back
- Web Application Firewall (WAF): filters malicious requests before they reach your code.
- Automated daily backups with at least 14 days of retention, so you can restore to a clean point.
- Two-factor authentication (2FA) on your hosting panel and CMS.
- Correct file permissions: folders at 755, files at 644. Never 777 on production.
- File integrity monitoring: tools like Wordfence (WordPress) alert you when a file changes without your authorization.
- Hosting with account isolation: if a neighboring site gets infected, it can't contaminate yours.
Prevention is far cheaper than cleanup. If you want hosting that includes automated backups, a built-in WAF, and Spanish-speaking technical support, the team at elenlace.com is ready to help.
Browse more resources on website protection in our security SSL & web category.
Key Takeaways
- Malware warning signs include redirects, Google warnings, unauthorized popups, and hosting suspension.
- Use Sucuri SiteCheck, VirusTotal, and Google Search Console to confirm the infection before acting.
- Change all passwords first, then clean files and the database.
- On WordPress: replace the core, plugins, and themes from official sources — don't just patch the bad lines.
- A WAF, daily backups, and 2FA are the minimum prevention stack.
- Submit a Google Search Console review after cleaning to recover rankings as quickly as possible.
Is your site already showing infection signs? Don't wait — reach out to elenlace.com and our team will help you diagnose and clean it today.
FAQ
Can I remove malware myself without technical knowledge?
For WordPress sites with minor infections, yes: reinstall the core and plugins from official sources and change all passwords. For deeper infections in server files or the database, it's safest to get professional help to ensure no malicious code is left behind.
How long does it take for Google rankings to recover after cleaning?
Once Google approves your Search Console review request (typically 24–72 hours), warnings disappear within hours. Full ranking recovery can take anywhere from a few days to a few weeks, depending on how long the infection was active.
Can website malware infect my visitors?
Yes. Some types of web malware attempt to download files to the visitor's device or steal form data (known as skimming attacks). That's why it's urgent to act as soon as you detect an infection.
Does restoring a backup remove malware?
Only if the backup predates the infection. Restoring a compromised backup brings the malware back with it. This is why maintaining at least 14 days of backup retention is critical.
Further reading
Other providers and guides worth comparing:
