WordPress Website Suspended for Malware: Recovery Guide

When a host suspends a site for malware, it is protecting its other customers and its own reputation. Reinstatement usually depends on showing the site is clean and the cause is dealt with. Here is how that normally goes.

Understand what the host found

Ask the host for specifics: which files were flagged, what the scanner detected and when. Hosts differ in what they share, but file paths and detection names help enormously. Ask whether they can provide access and error logs for the last few weeks, and whether the suspension covers the whole account or just this site.

Get access without making things worse

Many hosts keep SFTP or a file manager available during suspension, or provide a restricted access mode for cleanup. Use it to take a full copy of files and database before you change anything. That copy is your evidence and your safety net.

Clean the whole account

A flagged file is a lead, not the full picture. Check the whole compromise: core files against the official release, plugins and themes, uploads, mu-plugins, .htaccess, the database, users and scheduled tasks. If the hosting account holds more than one WordPress site, check them all, since cross-infection is common. The WordPress Malware Cleanup Checklist lists the steps.

Rotate everything

Change hosting, SFTP/SSH, database, WordPress and email credentials from a clean device, and replace the WordPress salts. If you skip this, the infection can return with the original credentials.

Fix the way in

Update or remove vulnerable and abandoned plugins and themes, and apply the basics from How to Secure WordPress After Malware Removal. Hosts re-suspend sites that were reinfected shortly after reinstatement.

Request reinstatement

Tell the host what you found, what you removed and what you changed. A short written summary helps; if you used a professional cleanup, a report from them carries weight. Hosts will often re-scan the account before restoring it.

After reinstatement

• Check Google Search Console for Security issues and request a review if needed. See flagged and blacklisted sites.
• Watch the site closely for a few weeks.
• Consider ongoing WordPress security so updates and backups don't lapse again.

If you'd rather not do this under time pressure, hacked-site recovery and malware removal start from $199. The complete process is in the The Complete WordPress Hacked Site Recovery Guide.