How to fix a malware-infected WordPress website at Hostinger

Fix a malware-infected WordPress website at Hostinger by identifying signs of infection, removing malicious content, and preventing future attacks.

Signs of a malware infection

There are a few things to look for that can indicate a potential malware infection:

• Unexpected deny rules on your .htaccess file.

• Files on your website’s root folder that you did not create either manually or via a custom script/cron job.

• Files such as index.php containing large amounts of unreadable code.

• Your WordPress admin page does not load the style properly.

• Your website is redirected to another site which you don’t recognize

• A fake Cloudflare verification screen prompts you to copy and run a command in your terminal or Run dialog

• Our Malware Scanner has identified and removed compromised or infected files

Remove the malware

At Hostinger, on our Web Hosting and Cloud Hosting plans, we have an automatic Malware Scanner that will help identify and remove malicious files on your account.

If your website presents issues after cleanup, you can consider restoring it from a backup. Please note that this would revert any changes you made after the backup date.

Remove malware that keeps reinfecting your WordPress website

Malware that returns shortly after you remove it usually persists somewhere other than your website files, such as your database, a hidden WordPress user account, or a browser login cookie. Complete the following steps to remove a persistent infection:

1. Delete any WordPress administrator account you don’t recognize in the Users section of your WordPress Admin area. Malware can create a hidden admin account that stays logged in through its own cookies, so a password reset alone does not remove it.
2. Generate new authentication keys and update your wp-config.php file with them to invalidate old login cookies.
3. Review your wp-content/mu-plugins folder and remove any file you don’t recognize. Files in this folder run automatically and do not appear in your WordPress Admin area plugin list.
4. Restore your website’s files and database together from the same backup point. Restoring only the files can leave a reinfected database in place.

Contact Hostinger support about a paid malware cleanup if the infection returns after completing these steps.

NOTE

• The exact entry point of a malware infection usually can’t be confirmed after the fact. Outdated or cracked plugins and themes, and compromised local devices, remain the most common causes.

Prevent future infections

Keep in mind that only removing the infected files may not be enough to contain the infection. It is very important that you tackle the reason why the infection occurred in the first place. In order to eliminate any vulnerabilities and keep your websites safe, please do the following steps:

• Use strong passwords: unique, with more than 8 characters using letters, numbers, and special characters

• Keep WordPress, themes, and plugins updated to the latest stable version

• Avoid plugins and themes from unknown or third-party providers

• Protect your website’s contact/registration/login forms with reCAPTCHA

• Generate and download backups of your website periodically

• Scan your local device with an antivirus software such as Malwarebytes

Learn more: Keeping your WordPress website safe