Website Malware Warning Signs: What to Check Before Reinstalling

A compromised website may still look normal to its owner. Attackers can show redirects only to search visitors, create hidden spam pages or add administrator access for later use.

Signals worth investigating

• Unknown administrator or deployment keys
• Unexpected redirects or pop-ups
• Search results for pages you did not publish
• Modified core files or new executable uploads
• Outbound mail or CPU spikes

Contain before cleaning

Preserve logs and a copy for investigation, restrict access and rotate credentials from a clean device. Include hosting, database, SFTP, DNS and email—not only the CMS password.

Find persistence

Replace trusted core and plugin files from official packages, inspect uploads and scheduled tasks, remove unknown users and patch the entry point. Simply deleting visible spam leaves the original weakness.

Recover deliberately

Restore only from a known-clean point, test in isolation and monitor after reopening. Notify affected users and authorities when law or the nature of exposed data requires it.

Search Console can reveal hidden impact

Unexpected indexed titles, security warnings or new URL patterns may appear before the homepage changes visibly. Compare sitemap URLs with indexed reports and server files, but do not delete evidence before investigation.

Communicate accurately

If users were exposed, describe what happened, the affected period and the action they should take. Avoid claiming the incident is resolved until credentials, persistence and the original entry point have been addressed.

Compare behavior from clean vantage points

Malware may appear only to search crawlers, mobile visitors or referral traffic. Check the rendered page, response headers, recent file changes, scheduled tasks, administrator accounts and search-index reports. Preserve copies and timestamps before cleaning so the entry point can be investigated.

Recovery requires more than deleting one file

Take the site offline or restrict it if users are at risk, rotate hosting, database, CMS and deployment credentials, remove persistence, patch the exploited component and restore from a verified source where appropriate. Review other sites sharing the same account.

After recovery, request security review through the relevant search or browser system only when external tests are clean. Communicate the affected period and user actions accurately; do not declare success because the homepage looks normal once.