If your website is suspended for malware, it is natural to want to delete anything suspicious and get the site back online quickly. Pause before changing files. First preserve the suspension notice, contact your hosting provider through its official support channel, and ask for the evidence behind the decision. Those steps can help you understand what was flagged and avoid removing information that could explain how the problem started.
A suspension notice is an alert, not a complete diagnosis. Treat the issue seriously, but work with the host to verify the finding and plan the next steps.
Start with a short first-response checklist
- Save the suspension notice. Keep the email or dashboard message, including its full wording and any attached report. Record when you received it and the time zone shown. If you speak with support, keep the case reference and a note of what was discussed.
- Contact the host using an official channel. Use the provider’s support portal, published phone number, or a verified email address. Ask what access is restricted and what the host needs from you before it can investigate or restore service.
- Hold off on file changes. Don’t delete flagged files, reinstall the site, restore a backup, or run a cleanup tool until you’ve asked whether the host can preserve a snapshot or quarantine copy and retain relevant logs.
- Coordinate urgent containment. If the host says the site is actively causing harm or must remain offline, follow its containment instructions. Preserving evidence does not mean leaving a confirmed threat exposed.
NIST and CISA incident-response guidance supports a coordinated, documented response rather than ad hoc changes during an investigation. See the NIST incident response recommendations and CISA response playbooks.
Ask the hosting provider for specific evidence
A message that says only “malware detected” leaves important questions unanswered. Ask the provider to share whatever it can safely provide, including:
- The exact file paths or URLs that were flagged, including the affected domain or hosting account.
- The scan or abuse report, with the detection name or reason and the time the finding was recorded.
- Whether the detection was confirmed by a person or came from an automated scan, if the provider can say.
- Relevant access, error, security, or scan logs, and how long those logs will be retained.
- Whether the provider has preserved a snapshot or quarantine copy of affected files.
- What access is currently available, what actions are restricted, and what conditions or deadlines apply before reinstatement.
Ask the host to clarify unfamiliar file names or findings. A flagged file may be compromised, but you need enough context to assess it. The location, modification details, related log entries, and the provider’s explanation can help distinguish a malicious change from a file that needs further review.
Don’t erase the trail before it is documented
Deleting an infected file may seem like the fastest route to a clean website. But if that file, a copy of it, or the surrounding logs are needed to investigate the incident, removing them first can make it harder to identify what happened. The same goes for replacing the site with a backup or reinstalling its software: those steps can overwrite evidence.
Ask the provider whether it can preserve the relevant material before cleanup. If it cannot, ask what you can safely save and how to do so without violating the provider’s instructions. Keep copies of the suspension notice, reports, log files supplied to you, and your notes in a place separate from the affected website.
Also remember that an infected backup can be useful as evidence without being a safe restore point. Before restoring, ask when the backup was made, whether it may contain the same suspicious files, and whether the host or your website administrator has checked it. For background on backup planning, see how long to keep website backups.
Plan passwords and cleanup with the host
Changing passwords is often part of recovery, but coordinate the timing. If credentials may be compromised, ask the provider which accounts to secure and whether changing access now could interfere with its investigation. Use a trusted device and a clean connection, and avoid sending passwords through ordinary email or support messages.
Once evidence is preserved and the immediate response is coordinated, review the accounts that can change the website: hosting, site administration, database, and any related access your provider identifies. Replace affected credentials and review who has access. Then have the flagged files assessed and remove or repair confirmed malicious changes with the host or a qualified website administrator.
For WordPress, recovery may also involve reviewing extensions, themes, and core files. A practical starting point for later prevention work is our WordPress security hardening checklist. Don’t treat a checklist as a substitute for investigating the specific incident.
Use the investigation to find the entry point
Removing suspicious files can restore normal operation without answering how they got there. Ask the host or your administrator to review available logs and compare the timing of suspicious activity with changes to the site. Check whether software, extensions, themes, administrator accounts, or other access points need attention. If you cannot determine a cause from the available evidence, say so rather than assuming the site is fully clean.
After the investigation, review whether your software and access practices need changes. Google’s guidance on preventing malware can help with prevention considerations. If you use Google Search Console, check for security notices there as part of your follow-up.
What if you can’t access WordPress?
A suspended WordPress site may block access to wp-admin, the hosting control panel, or both. Don’t try to work around a restriction by changing files through another route. Ask the host which access remains available and whether it can provide the scan findings, preserve a copy, or help coordinate a review. You can still save the suspension notice and request information while the site is offline.
After the provider confirms that access is appropriate, recovery can continue through the permitted tools and with the evidence already saved. If you’re evaluating how managed hosting handles ongoing updates and care, see what managed hosting includes.
Frequently asked questions
Could a malware suspension be a false positive?
It is possible for a detection to need further review. Ask for the flagged file path, scan details, and the reason it was identified. Don’t dismiss the warning, but don’t treat a short notice as proof of the exact cause either.
Should I restore my website from a backup?
Not before checking whether the backup may contain the same suspicious files. Ask the host or your website administrator to review the backup and coordinate the restore after evidence has been preserved.
How can I tell how malware got onto my website?
Use the available logs, scan findings, file details, and account history to look for a possible entry point. The evidence may not establish the cause, so avoid guessing when the records are incomplete.
Take the next step carefully
When a hosting provider suspends a website for suspected malware, document first, request specific findings, and coordinate containment and cleanup before overwriting files. If you’re reviewing your hosting and website care options, Zevonix Cloud hosts WordPress, Joomla!, Laravel, and static websites. Every client gets an isolated managed virtual server, with encrypted off-site backups that run nightly and are checked, plus security monitoring and malware scanning around the clock. You can call the Jacksonville or Palm Coast office to discuss support.