How to secure your VPS from abusive activity at Hostinger

To secure your Hostinger virtual private server (VPS) from abusive activity, identify whether the Hostinger dashboard shows a CPU limited, Stopped, or Suspended status, then remove the cause and close the entry point. Malware is a likely cause if your VPS runs slowly with no clear reason, shows a central processing unit (CPU) limitation in the Hostinger dashboard, or has been stopped by our system. Most cases come from outdated software, weak or exposed credentials, or services open to the internet that should not be. Each status has its own fix, and the prevention steps stop it from happening again.

Understand the Hostinger VPS statuses

Three statuses look alike in the Hostinger dashboard: CPU limited, Stopped, and Suspended. Each has its own fix.

• CPU limited. Your VPS keeps running, but its CPU capacity is reduced. CPU limiting happens after sustained high CPU usage or when our system detects abusive processes. A CPU limitation is not a sign that your plan is too small, and upgrading will not lift it.
• Stopped. Our system stopped your VPS after detecting malware or abusive activity. No data is deleted. You can start the VPS again from the Hostinger dashboard, but our system may stop it again if the cause is still there.
• Suspended. The VPS plan itself is suspended for an abuse report. You cannot start it yourself, and our abuse team handles the appeal.

CPU credits are a separate mechanism. Read How CPU credits work on Hostinger VPS if your VPS is limited because its burst balance is empty. A high steal value in top or htop also does not prove malware, as explained in Understanding CPU steal and its impact on VPS at Hostinger.

Fix a CPU limited Hostinger VPS

To lift a CPU limitation on your Hostinger VPS, find and remove whatever is using the CPU. Restrictions lift on their own once CPU usage returns to normal, usually after a few hours. Fixing the cause is what ends the cycle, so check what is using the CPU first. The limit values are listed in What is the CPU use limit for VPS at Hostinger?

1. Open your VPS in the Hostinger dashboard and go to Server usage to see when the spike started, as covered in How to check VPS resources usage at Hostinger.
2. Connect via Secure Shell (SSH) and list the heaviest processes with top -o %CPU or ps aux --sort=-%cpu | head -15.
3. Look for processes you do not recognize, random-looking names, or anything running from /tmp, /var/tmp, or /dev/shm.
4. Check for unexpected scheduled jobs with crontab -l and ls -la /etc/cron.*, and for unknown services with systemctl list-units --type=service --state=running.
5. Check established outbound connections with ss -tunap | grep ESTAB.

A process that uses most of the CPU, has an unfamiliar name, and talks to an unknown host is most likely a cryptominer such as XMRig. Stop it, delete the files it runs from, and remove whatever started it (a cron job, a systemd service, or a container).

You can use Remove limitations in the Hostinger dashboard once per week. Remove limitations gives you a short window to work on the VPS. Remove limitations does not fix the cause, and the limitation returns if the high usage continues.

Contact Hostinger support through the live chat if CPU usage has been normal for many hours and the limitation is still there.

Recover a Hostinger VPS stopped for malware

To recover a Hostinger VPS stopped for malware, remove the malware, rotate every credential, and patch the entry point before you rely on the VPS again. You will usually get an email naming the process we detected.

1. Start the VPS from the Hostinger dashboard with Start. If it does not boot, use rescue mode to reach your files or restore a backup.
2. Find and remove the malicious process and files: list the heaviest processes with top -o %CPU, check scheduled jobs with crontab -l, and check outbound connections with ss -tunap | grep ESTAB.
3. Run the malware scanner under Security. The malware scanner checks files only and does not check databases, so a clean result does not rule out an infected database.
4. Rotate every credential that was on the server: root and user passwords, SSH keys, database passwords, application admin accounts, and application programming interface (API) tokens.
5. Patch the application or service the attacker used to get in. Restoring a clean backup or reinstalling the operating system is the safest option if you cannot tell how they got in. A reinstall erases everything on the server, so back up what you need first.

Do not restart the VPS and leave it as it is. The malware comes back and the VPS is stopped again if the entry point stays open. For a broader checklist, see What to do if your VPS has been hacked at Hostinger?

Resolve a suspended Hostinger VPS

To appeal a suspension, reply to the suspension email with what you found and what you changed. A suspension means we received an abuse report or confirmed abusive activity from your VPS. The suspension email states the reason. Our abuse team reviews each case, and repeated suspensions can lead to permanent termination, so fix the cause before you ask for reactivation. Rescue mode is a recovery tool and does not bypass a suspension.

Secure AI agents running on your Hostinger VPS

AI agents such as OpenClaw and Hermes Agent can run shell commands, install packages, read files, and call application programming interfaces (APIs) on your behalf. These capabilities make AI agents useful, and they also mean anyone who gains control of the agent gets everything the agent can do on your VPS. A compromised agent is a backdoor with a friendly interface. Attackers target AI agents for the same reasons they target any open service, and the result is often a cryptominer or a botnet client running under the agent’s account.

Watch for these five risks:

• Exposed agent interfaces. An agent’s web user interface (UI), gateway, or API port that is reachable from the internet, with weak or no authentication, can let anyone send it commands. Bind these ports to localhost and reach them through an SSH tunnel or virtual private network (VPN), or restrict them with the firewall and require authentication. The steps are covered in Securing publicly accessible services on your VPS.
• Untrusted skills, plugins, and Model Context Protocol (MCP) servers. Add-ons run with the agent’s permissions. Public skill marketplaces have already hosted malicious skills that install credential stealers, miners, and reverse shells. Install add-ons only from sources you trust, and read what they do first.
• Excessive permissions. Do not run the agent as root. Create a dedicated user, give it access only to the folders it needs, and consider running it in a container.
• Prompt injection. Web pages, emails, and documents the agent reads can contain hidden instructions that make it run commands. Require your approval before the agent runs commands that change the system, and do not give it access to SSH keys or other credentials it does not need.
• Leaked API keys. Keys for AI providers are valuable and get abused quickly. Use separate keys with spending limits, keep them out of files the agent can freely read and share, and rotate them if you suspect a leak.

Also check which processes and scheduled jobs exist on the VPS after the agent has been working: list processes with top -o %CPU and scheduled jobs with crontab -l. For a longer checklist, see OpenClaw security: risks, best practices, and a checklist. For the Hostinger-specific steps, see How to secure and harden OpenClaw security (formerly Moltbot/Clawdbot) on a Hostinger VPS.

Identify common ways a Hostinger VPS gets infected

Four common entry points lead to infected VPS servers:

• Weak SSH access. Brute-force attacks on root with a password are the most common entry point. Use SSH keys, disable password login and root login, and install Fail2Ban.
• Exposed management interfaces. An open Docker API, an unprotected Traefik dashboard, or a database port reachable from the internet gives an attacker direct control. Bind these services to localhost or restrict them with a firewall, as covered in Securing publicly accessible services on your VPS.
• Vulnerable web applications. Outdated WordPress plugins, nulled themes, and unpatched frameworks are used to drop miners and backdoors. On WordPress, also check for hidden admin users and unknown files in wp-content/mu-plugins.
• Exposed or untrusted AI agents. Exposed agent interfaces, untrusted add-ons, excessive permissions, prompt injection, and leaked API keys let attackers control an AI agent running on your VPS.

Prevent abusive activity on your Hostinger VPS

Follow these seven steps to prevent abusive activity on your VPS:

• Keep the operating system, applications, plugins, and containers updated.
• Avoid nulled or cracked software.
• Use strong, unique passwords and SSH keys.
• Close ports and services you do not use, for inbound and outbound traffic. Enable the firewall in the Hostinger dashboard.
• Scan regularly with the built-in malware scanner, ClamAV, or Rootkit Hunter.
• Watch Server usage in the Hostinger dashboard. A sudden, sustained CPU rise you cannot explain is the earliest warning.
• Keep backups so you can restore a clean copy.

Handle other kinds of abuse on your Hostinger VPS

Four other kinds of abuse can affect a Hostinger VPS: outgoing spam, malware or phishing pages, illegal or copyrighted content, and botnet or DDoS participation.

Removing the cause, rotating credentials, and closing the entry point returns your Hostinger VPS to normal operation and stops CPU limits, stops, and suspensions from coming back.