WordPress incident response
The hosting provider says my WordPress site is infected - what does it mean?
The hosting provider says my WordPress site is infected - what does it mean?
If the hosting provider says WordPress is infected, do not treat it as an administrative nuisance. Providers usually do not send these notices because they dislike a plugin. They saw something server-side: a suspicious file, bulk email, phishing content, malicious redirects or PHP code that can affect other customers.
The homepage may still look normal. An infected WordPress site can work from the outside while sending spam, running a backdoor or serving malicious content only to selected visitors.
What the provider may be seeing
Hosting companies raise alerts from different signals:
- malware scanner detection in the file system,
- suspicious PHP under
uploads, - high outbound email volume,
- phishing content under your domain,
- redirect code,
- abnormal server load,
- attack traffic leaving the hosting account,
- Google Safe Browsing or blacklist reports.
Many automated alerts are based on filenames and code patterns. That does not make them meaningless. If the provider gives you a file path, start there.
Why the site may be suspended
Because the infection is not only your site's problem. On shared hosting, one compromised WordPress installation can affect other customers, IP reputation, mail delivery and server stability. If a site sends spam or hosts phishing pages, the provider has to act.
Sometimes only infected files are quarantined. Sometimes the full website is disabled until cleanup. If you are dealing with a hosting suspended WordPress site, that is frustrating, but the provider is protecting the infrastructure.
What not to do
Do not only delete the one file they reported. It may be a symptom, not the cause. Do not reply with "I deleted it, please turn the site back on" if the entry point is still open.
Do not restore blindly from backup either. If you do not know when the compromise happened, the backup may contain the same backdoor. Read this first: restore from backup or clean the infected WordPress site.
What to ask from the provider
Ask for specifics. You do not need a long essay; you need data you can investigate.
Useful details:
- infected file path,
- detection time,
- scanner signature or detection name,
- affected domain or subdomain,
- outbound spam volume,
- blocked process or request,
- IP or URL contacted by the code.
If all you get is "infected", investigation is still possible, just slower.
Where to look
For WordPress, start here. In a WordPress virus hosting incident, the first clue often appears in file scans, outgoing mail, process limits or server logs rather than in the WordPress dashboard.
wp-content/uploads/
wp-content/plugins/
wp-content/themes/
wp-content/mu-plugins/
wp-config.php
.htaccess
Review administrator users, application passwords, cron events and database-injected scripts. If the warning was about email sending, also check mail plugins, SMTP settings and access logs.
If an unknown admin appeared, use this guide: unknown admin user in WordPress.
When to ask WebShield for help
If the site is suspended, ads are stopped, the provider gave a deadline, or you cannot prove the site is clean, guessing is expensive. WebShield reviews files, database records, administrators, cron tasks and logs, then you can give the provider a concrete response instead of "we deleted something".
Managed WordPress protection helps when you do not want to restart the investigation from zero every time a provider sends a warning. Without logging, backups, update control and expert response, a WordPress virus can become a recurring business problem. WordPress malware removal matters only if you can show that the cause was handled, not just one file deleted.
What to tell the hosting provider
Keep it short and concrete:
- you received the warning,
- investigation is underway or completed,
- which files were removed,
- which credentials were rotated,
- which vulnerable component was updated or deleted,
- whether you request reactivation or rescanning.
The provider does not need marketing copy. They need evidence that the cause was handled.