My Host Suspended My WordPress Site for Malware

What's happening

When your hosting company suspends or disables your site for malware, it means their scans found harmful code in your site's files, and they switched the site off to protect visitors and the other sites on their servers. The first safe thing to do is read the host's email or support notice in full, because it usually says what they found, which files are affected, and what they need from you before they turn the site back on.

Visitors may see an "account suspended" page, an error, or nothing at all. Your files and database are usually still on the host's servers, just not public. A suspension is a pause, not a deletion.

Hosts do this because one infected site can be used to send spam, attack other sites, or harm visitors. It's a safety step on their side, not a judgment of you.

Why it happens

The usual way in is an outdated plugin or theme with a known security hole, or a weak or reused password. Free copies of paid plugins and themes from unofficial download sites are another common source, because some come with malware built in. An old, forgotten site or test copy in the same hosting account can also get infected and spread to the others. For the bigger picture, see My WordPress site was hacked.

What you can safely try

• Save the host's notice and its list of flagged files. Whoever cleans the site will need it.
• Ask your host three questions. What exactly did you find? What do you need before you switch the site back on? Can we still reach the files and backups while it's suspended?
• Change your hosting and email passwords from a device you trust.
• Don't delete the flagged files yourself. Some are real WordPress files with bad code tucked inside, and deleting them can break the site and still leave the infection behind.
• Don't move to a new host or restore an old backup to get around it. The infection travels with your files, and an old backup may already contain it.

When to call us

We work on business websites, and a suspended site is the kind of cleanup we do. We remove the infection from your files and database, close the gap the attacker used, and give you a summary of what we found and fixed to send your host with your request to switch the site back on. Turning it back on is your host's call. We clean it up at a flat rate you approve before any work starts. Start with our Hacked Site Cleanup.