Your Host Suspended Your Site for Malware. Here’s How to Get It Back Online

If your website was suspended for malware, your host has found infected files and switched the site off to protect its other customers. To get it back online, get the list of flagged files, back up, clean the whole site (not just those files), close the hole the attacker used, then ask the host for a review. Done properly, most sites can be restored. Done in a rush, they’re often suspended again within days.

Why did my host suspend my website for malware?

On shared servers, one infected site can put every other site at risk. Sucuri notes that malware can threaten other sites on the same server, and that a host’s IP addresses can be blacklisted when malware is detected coming from its servers (Sucuri). Spam sent from your site can also land the whole server on email blocklists.

So the host isolates the problem. Some suspend just one folder, others the whole account. Either way, your site and sometimes your email go offline until the infection is dealt with.

What should I do first?

Stay calm and read the suspension notice properly. It usually says what was found, where, and what the host needs from you. Note any deadline, because some hosts remove suspended accounts after a set time.

Then reply to the notice and ask for three things:

• The list of flagged files and what the scanner found in each.
• Temporary access so you or your developer can work on the site. Many hosts can allow access from your IP address only.
• A full backup of the files and database, in case anything goes wrong during the clean-up.

Label that backup as infected. It’s useful for recovering content, but never restore it as it is.

How do I clean the site so it stays clean?

The flagged files are where the host’s scanner noticed something. They’re rarely the whole story. Sucuri’s research found backdoors on 49% of compromised sites, and malicious admin users in 55% of infected databases (Sucuri report). Miss those, and the attacker walks straight back in.

1. Replace, don’t patch. Reinstall WordPress core, plugins and themes from fresh copies, rather than editing infected files.
2. Check uploads and the database. Look for PHP files in the uploads folder, unknown admin users and injected scripts in posts and settings.
3. Change every password. That includes hosting, FTP or SSH, the database, every WordPress admin, and the security keys in wp-config.php.
4. Close the way in. Update everything and delete unused or pirated plugins. The same Sucuri report found 39.1% of content management systems were out of date when infected.
5. Scan again. Run a server-side scan as well as a remote one, and keep the results.

Our guide on how to remove malware from WordPress covers when this is a fair DIY job and when it isn’t. For the full recovery process, including blacklists and passwords, see our step-by-step guide for when your website is hacked.

How do I ask my host to reinstate the site?

Reply to the original ticket rather than opening a new one. Hosts rarely reinstate a site on your word alone, so show your work:

• what you found and removed, including any users or backdoors
• what you updated, and which passwords you changed
• how the attacker got in, if you know
• your clean scan results

If the host finds more malware on review, the site stays offline. That’s why a thorough clean saves time overall.

Is Google warning visitors too?

Check Google Search Console’s Security Issues report. If it lists problems, fix them on every page, then request a review. Google says partial fixes won’t earn a partial return, and that malware reviews can take from a few days to a few weeks (Google Search Central). Don’t resubmit while a review is pending.

Should I just move to a different host?

Not with the infected site. Moving it copies the malware, and a new host may suspend it too. Clean first, then decide.

A move can be the right call once the site is clean, especially if this keeps happening. If your website keeps getting hacked, the cause is often still there, or the server isn’t isolating accounts well. Our secure web hosting runs in Australian NEXTDC data centres, with free SSL on every plan and free migration once the site is clean.

Then keep it clean. Our website maintenance plans add weekly high-risk security updates, daily malware scans and off-site backups. If you need hands-on help right now, start with our hacked website repair service.

Frequently asked questions

How long does it take to get a suspended website back online?

It depends on how fast the site is cleaned and how quickly your host reviews it. A simple infection can be cleaned in a day. Sites with backdoors, many plugins or a long-running infection take longer, and the host’s review adds more time.

Can I just delete the files my host flagged?

You can, but it rarely fixes the problem. Attackers usually leave backdoors and hidden admin users elsewhere, so the malware comes back and the site is suspended again. Clean the whole site and change every password.

Will I lose my website if my host suspends it?

Not usually, as long as you act. The files and database are normally kept while suspended. Some hosts remove accounts after a deadline, though, so read the notice, reply quickly and ask for a full backup.

Is my email affected when my site is suspended?

It can be. If your email is hosted on the same account, a full account suspension may stop it too. Ask your host exactly what’s been switched off, and whether email can be restored while the site is cleaned.

Should I restore an old backup instead of cleaning?

Only if you know it was taken before the infection started, and you also fix the way in. Otherwise the restored site has the same weakness and gets hacked again. Change every password after restoring.

Sources

1. How to fix “This account has been suspended”, Sucuri, January 2024
2. 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024
3. Security Issues report, Google Search Console Help