❗ What Is Website Malware?

“Malware” means malicious software. On websites, this usually means code that was added by a hacker without your permission. Malware can hide in your files, themes, plugins, database, or even inside your hosting account.

Common Malware Types

• Hidden injected code
• Redirect scripts
• Phishing pages
• Backdoor shells
• Spam content and ads
• Keyloggers
• Crypto miners

⚠️ Most malware is invisible on the surface. Your site may appear normal to you while spreading spam or collecting stolen data.

❗ How to Know If Your Website Is Infected

Your site may be hacked if any of these happen:

• Website redirects somewhere else
• Unknown links, ads or pop-up appears
• Admin account added without your permission
• Google shows “This site may be harmful” warning
• Your email is sending spam
• Hosting CPU usage is unusually high
• Files appear that you did not create
• Your hosting company automatically suspended you

⚠️ A malware infection will NOT fix itself. The longer you ignore it, the worse the damage becomes.

✔️ Step 1: Scan Your Website for Malware

You should run both an external scan AND an internal scan.

External Online Malware Scanners

• SiteCheck by Sucuri
• VirusTotal URL Scan
• Google Safe Browsing Diagnostic

Internal Malware Scanners

For WordPress users:

• Wordfence malware scanner
• iThemes Security scanner
• MalCare plugin

✔️ External scanners cannot see everything. They can only detect visible or public malware. Internal scans are more accurate.

✔️ Step 2: Make a Backup of Your Website

Before cleaning, always make a backup — even if your site is infected. This allows you to restore or manually inspect files later.

Use:

• cPanel File Manager ZIP backup
• JetBackup (if available)
• UpdraftPlus (WordPress)

⚠️ Never delete files randomly without backup — you may break your site further.

✔️ Step 3: Clean the Infection (Beginner-Safe Methods)

Method 1: Automatic Malware Cleaning (WordPress)

Recommended tools:

• Wordfence → Scan → Repair files
• MalCare → Auto-clean
• iThemes Security → File change scan

✔️ Wordfence FREE version can clean most infections automatically if the original WordPress core files were modified.

Method 2: Replace Core Files Manually

If only WordPress core files are infected:

1. Download a fresh copy of WordPress from wordpress.org
2. Delete wp-admin and wp-includes on your server
3. Upload the clean ones in their place
4. Do NOT replace wp-content or wp-config.php

Method 3: Clean Files by Hand (Advanced but Necessary Sometimes)

Common malicious code patterns include:

eval(base64_decode(...))
gzinflate...
preg_replace('/e'
system($_GET["cmd"])

⚠️ If you do not understand PHP or code, do NOT try to manually edit infected code. Use a security plugin or request support.

✔️ Step 4: Scan and Clean the Database

Malware can also hide inside your database, often inside:

• wp_posts table
• wp_options table
• Injected JavaScript code
• Hidden backlinks

✔️ If malware keeps coming back after file cleanup, it is almost always stored in your database.

❗ Step 5: Remove Backdoors

Malware often leaves behind “backdoor” scripts so the hacker can get back into your site.

These can hide in:

• /uploads
• /wp-includes
• /wp-content/themes/
• /wp-content/plugins/
• randomly named .php files

⚠️ If you do not remove ALL backdoors, the hacker will return even after you clean the site.

⚙️ Step 6: Change All Passwords

After cleaning, change these immediately:

• WordPress login
• cPanel / DirectAdmin
• FTP / File Manager
• Database user
• Email accounts

✔️ Use strong, unique passwords and enable 2FA wherever possible.

✔️ Step 7: Re-Scan After Cleaning

Scan again using both:

• External tool like Sucuri SiteCheck
• Internal scanner like Wordfence

If everything is clean, the site should now be safe.

❗ If Your Website Was Blacklisted by Google

Once malware is gone:

1. Sign in to Google Search Console
2. Verify your domain (if not already done)
3. Go to Security Issues
4. Request review after confirming cleanup

⚠️ A hacked website can lose ALL SEO ranking if not cleaned quickly. Time matters.

✔️ How to Prevent Future Malware Infections

• Use a security plugin and enable auto-blocking
• Never use nulled themes or plugins
• Update WordPress regularly
• Use 2FA on all admin logins
• Disable file editing
• Install SSL and force HTTPS

⚙️ What Nairahost Does to Help Protect You

• Firewall protection at the server level
• Malware scanning in the background
• Account isolation — infected sites can’t spread to others
• Free SSL certificates
• Secure nameservers:

  cPanel: ns1.nairahost.cloud / ns2.nairahost.cloud
  DirectAdmin: ns1.nairahost.com.ng / ns2.nairahost.com.ng

✔️ Final Malware Removal Checklist

• ✔️ Website scanned
• ✔️ Backup created before cleaning
• ✔️ Infected files removed or replaced
• ✔️ All passwords changed
• ✔️ Database checked
• ✔️ Backdoors removed
• ✔️ Security plugin installed
• ✔️ Google review submitted (if blacklisted)
• ✔️ Regular backups enabled