fren
Log In

Clean an infected website

3 min read07 November 2026

An infected site is not just a defaced page. It can redirect visitors, inject commercial links or send spam from your hosting. Deleting visible files is not enough: without identifying the entry point, the infection returns within days.

Isolate and keep evidence

Put the site in maintenance mode or protect it with a password, without deleting logs. Download a full copy of the files and export the database before changing anything: this copy is for understanding the attack, not for putting the site back online.

Note the date of the first symptoms and recent changes: plugin update, new form, added administrator account, weak password. On KeyHelp, files are available over SFTP and the database from the panel; on a VPS, use tar and mysqldump.

Identify the payload

Classic signs are obfuscated PHP, eval or base64_decode calls, injected iframes, a redirecting .htaccess, unknown administrator users and recent files in upload folders.

Bash
grep -rIl --include='*.php' -E 'eval\(|base64_decode\(|gzinflate\(|str_rot13\(' /var/www/your-domain
find /var/www/your-domain -type f -mtime -14 -ls

For WordPress, WP-CLI compares official files and lists accounts:

Bash
wp core verify-checksums
wp plugin verify-checksums --all
wp user list --role=administrator
wp cron event list

A mismatch on core or an extension means a modified file. Unknown cron events and administrators you did not create should be handled first.

Clean or rebuild

If you have a verified backup from before the infection, restore it, then update the application and all extensions before going live. If the backup is doubtful, rebuild from official sources: reinstall core, themes and extensions from their repositories, then reimport only checked content and media.

The database may also contain injections: posts, options, widgets, users. Do not simply delete suspicious rows; compare with a clean database or clean content item by item. Remove unused extensions and themes: every abandoned component is a door.

Rotate secrets and harden

Infection means credentials probably leaked. Rotate the database password, administrator accounts, FTP/SFTP access, SSH keys and API tokens. In wp-config.php, regenerate the salt keys and set the file to 600. Standard permissions are 644 for files and 755 for folders; 777 is never a solution.

Update PHP, the application and extensions, disable the file editor when the application allows it and enable two-factor authentication on administrator accounts.

Verify after cleaning

Run the scan again, then check:

  • key pages and redirects with curl -I https://your-domain.tld;
  • logs for POST requests to unknown scripts;
  • administrator accounts and scheduled tasks.

If the site was flagged, request a review from the service concerned.

Monitor for at least two weeks. A reinfection means the entry point, a backup or a forgotten account was not handled. If the infection goes beyond your site, contact support: on KeyHelp web hosting you do not have root, and on a VPS a system compromise requires a rebuild.

Advertisement

Was this article helpful?

Read next