Host email: "account suspended — malware detected." The site shows a browser warning. In wp-content/uploads/2024/: an obfuscated shell.php. Panic reflex: delete the file by hand, re-enable — infection rebounds forty-eight hours later because the vector is still there.
On shared hosting, you share infrastructure with other sites. Active malware can mean suspension to protect the network. The useful sequence: isolate → clean properly → understand the entry — not random clicks in the file manager.
Phase 1: isolate to limit damage
Put the site in maintenance to stop visitors executing malicious code. Change panel, FTP or SFTP, database, and WordPress admin passwords — from a clean machine. Revoke WordPress sessions and API keys if compromise is suspected. Inform the host: suspension may be mandatory; request recent access logs. Do not delete only the flagged file without a restore plan.
On shared hosting, an infected neighbor can also hurt shared IP reputation — see shared IP addresses.
Phase 2: clean — restore beats surgery
| Approach | When | Risk |
|---|---|---|
| Restore pre-infection backup | Known clean backup < 30 days | Recent content loss |
| Scan + quarantine | Localized infection | Residual backdoor |
| Reinstall core + clean themes | Compromised uploads | Long DB audit |
Compare official WordPress core checksums. Reinstall plugins from source — not from a possibly infected local backup. Audit the database: unknown admin users, suspicious autoload options, malicious wp-cron tasks. Deny .php in uploads via nginx or Apache. Test restore before crisis — otherwise backup may be infected too.
Phase 3: understand the entry
Frequent causes on shared hosting: nulled or outdated plugin/theme — exploited CVE; weak admin password without 2FA; compromised FTP credentials via local malware or accidental commit; upload form without validation — webshell. Document timeline, remove unused plugins, enable admin 2FA. A WAF complements patches; it does not replace them.
The climax: malware is a symptom
The host suspends; you must prove cleanliness before reactivation. See hosting abuse investigation for shared context.
Decide and move forward without blind spots
Isolate the site and rotate all credentials at the first alert, before any partial cleanup attempt. Restore from a clean backup or reinstall in a controlled way with official checksums. Audit database and uploads for persistent backdoors. Identify and close the entry vector — remove plugin, strengthen password, secure uploads. Monitor thirty days after going live again and harden patches and application firewall. Compare shared and VPS via the directory if reinfections pile up.
Frequently asked questions
Must the host clean for free?
Varies by contract — often basic scan and account suspension, not full forensics. Read terms; plan restore from clean backup or expert help if the site is critical.
Is deleting infected files enough?
Rarely. Backdoors recreate via DB cron or compromised admin. Change all passwords, rotate API keys, restore files plus audit database.
Does moving to a VPS avoid malware?
It reduces noisy-neighbor risk, not outdated plugins or FTP leaks. Hygiene stays the same; VPS adds patch responsibility on you.
How do you find the entry point?
Rebuild timeline: last plugin installed, FTP access logs, WordPress version, file modification times. Specialized scanners or expert support complete the analysis.
Malware on shared hosting: isolate, restore clean, then find the door — otherwise you clean the same intrusion in a loop.