.htaccess<\/code> file.<\/li>\n- Your website’s root folder contains files you didn’t create manually or through a script or cron job.<\/li>\n
- Files such as
index.php<\/code> contain large amounts of unreadable code.<\/li>\n<\/ul>Update all Scripts to the latest version<\/h2>
Make sure that all of your applications and scripts are always up to date. If you use WordPress, check if there are any new updates in your website’s Admin and plugins\/themes section.<\/p>
Also, make sure to enable the auto-update feature, so that your WordPress is always automatically updated to the latest version:<\/p>
![\"WordPress](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/55\/2020\/01\/621157a0-d149-4652-818a-a2a870e43610.jpg\/public\")
<\/div>Kill mode on proactive defense Imunify360<\/h2>
By default, Kill Mode is enabled in the Proactive Defense Imunify360 software, which can immediately stop malicious scripts and prevents them from spreading.<\/p>
To check it, log in into your cPanel<\/a><\/b>, and select Imunify360<\/b> from the Security section:<\/p>![\"cPanel](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/55\/2020\/01\/c305bd02-95a9-4329-b95e-51d82988bdec.jpg\/public\")
<\/div>Click the Proactive Defense<\/b> menu on your Imunify360 dashboard, you’ll see the Kill Mode enabled:<\/p>![\"Imunify360](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/55\/2020\/01\/4e48fc00-3775-4d4e-aa14-e6763c5c9965.jpg\/public\")
<\/div>In case a suspicious file is detected but it was not automatically deleted, go to the Malware Scanner <\/b>tab and delete the malicious file by clicking on the broom icon under Actions <\/b>section:<\/p>![\"Imunify360](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/55\/2020\/01\/bf51faeb-bab9-42a0-8e0d-1ba95f6b7ffb.jpg\/public\")
<\/div>Next, click Yes, Clean Up to delete the file. <\/b>You will get a notification like below in the upper right corner of the Imunify dashboard if the file is successfully deleted:<\/p>![\"Success](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/55\/2020\/01\/681a2012-e912-4def-bc13-9e96ccacb9e1.jpg\/public\")
<\/div>If there are several files, you can use Clean Up All<\/b> to delete them all at one time:<\/p>![\"Hostinger](\"https:\/\/imagedelivery.net\/LqiWLm-3MGbYHtFuUbcBtA\/wp-content\/uploads\/sites\/55\/2020\/01\/6169d48e-ef00-4fd6-ac0e-826520c5beba.jpg\/public\")
<\/div>Check the Imunify360 malware cleanup results<\/h2>
Check the status of each detected file in the Imunify360 Malware Scanner<\/b> tab to confirm the cleanup is complete. A file still marked Infected<\/b> was not cleaned. There are four file statuses:<\/p>\n- Infected<\/b> – Imunify360 detected malware in the file, and the file is not clean yet.<\/li>\n
- Cleanup in progress<\/b> – Imunify360 is still cleaning the file.<\/li>\n
- Cleaned<\/b> – Imunify360 removed the malicious code and kept the rest of the file content.<\/li>\n
- Content removed<\/b> – the file contained only malicious code, so Imunify360 removed its content.<\/li>\n<\/ul>
Run the cleanup again for any file still marked Infected<\/b>. Then run a new scan and confirm no new detections appear after your cleanup date.<\/p>Check your WordPress database for malware in phpMyAdmin on cPanel<\/h2>
Check your WordPress database manually in phpMyAdmin after the Imunify360 cleanup, because malware can also be stored in database tables. Injected scripts in the options, posts, or users tables cause redirects, spam, or phishing pages that return even after the files are clean.<\/p>
\n- Export a copy of your database before you change anything, following How to export a database with phpMyAdmin on cPanel at Hostinger<\/a>.<\/li>\n
- Open your website’s database in phpMyAdmin, following How to access phpMyAdmin in cPanel at Hostinger<\/a>.<\/li>\n
- Check the table prefix in your
wp-config.php<\/code> file. The prefix may not be wp_<\/code>, so use the one your website is set to.<\/li>\n- In the
wp_options<\/code> table, confirm the siteurl<\/code> and home<\/code> values show your own domain.<\/li>\n- Use the Search<\/b> tab to look for
<script<\/code> tags and links to unfamiliar domains in the wp_options<\/code> and wp_posts<\/code> tables.<\/li>\n- In the
wp_users<\/code> table, look for user accounts you don’t recognize.<\/li>\n- Remove only the entries you confirm are malicious.<\/li>\n<\/ol>
Remove hidden malware access from a WordPress website on cPanel<\/h2>
Remove the hidden access points that malware leaves behind, because they let an attacker reinfect your WordPress website after the Imunify360 cleanup. There are five places to check:<\/p>
\n- WordPress administrators<\/b> – delete any administrator account you don’t recognize in the Users<\/b> section of your WordPress Admin area. A hidden administrator account stays logged in through its own login cookies, so a password change alone does not remove it.<\/li>\n
- WordPress security keys<\/b> – replace the authentication keys and salts in
wp-config.php<\/code> with new ones from the WordPress secret-key generator<\/a>. New keys log out everyone, including an attacker who stole a login session.<\/li>\n- Must-use plugins<\/b> – in cPanel, open Files<\/b> → File Manager<\/b> and delete any file you don’t recognize in the
wp-content\/mu-plugins<\/code> folder. Files in this folder run automatically and don’t appear in your WordPress plugin list.<\/li>\n- Root folder and .htaccess file<\/b> – delete PHP files you didn’t create from the
public_html<\/code> folder. Remove rules you didn’t add from the .htaccess<\/code> file, such as deny rules, redirects, or lines that load unknown PHP files.<\/li>\n- Cron jobs<\/b> – delete any cron job in cPanel that you didn’t create.<\/li>\n<\/ul>
Change your passwords after an Imunify360 malware cleanup<\/h2>
Change every password connected to your website after an Imunify360 malware cleanup so stolen login details can’t be used to reinfect it. There are seven types of credentials to change:<\/p>
\n- cPanel password<\/b> – on the Hostinger dashboard home page, click Manage<\/b> next to your cPanel hosting plan, scroll to the cPanel details, and click Change password<\/b>.<\/li>\n
- FTP accounts<\/b> – in cPanel, open FTP Accounts<\/b> and change the password of each FTP account. Delete any FTP account you didn’t create. Follow How to find FTP details on cPanel at Hostinger<\/a> for the account options.<\/li>\n
- Email accounts<\/b> – in cPanel, open Email Accounts<\/b> and reset the password of every email account linked to the website, following How to reset an email account’s password for cPanel Email at Hostinger<\/a>.<\/li>\n
- WordPress administrators<\/b> – change the password of every administrator in the Users<\/b> section of your WordPress Admin area, and enable two-factor authentication (2FA) for each administrator. Delete any administrator account you don’t recognize.<\/li>\n
- Database user<\/b> – change the password of the database user your website connects with. Update the
DB_PASSWORD<\/code> value in wp-config.php<\/code> afterward so your WordPress website can still connect to its database.<\/li>\n- SSH keys<\/b> – remove any SSH key you didn’t create.<\/li>\n
- Hostinger account<\/b> – change your Hostinger account password<\/a> and set up two-factor authentication (2FA)<\/a>.<\/li>\n<\/ul>
Delete unused and unofficial WordPress plugins and themes<\/h2>
Delete every WordPress plugin and theme you don’t use after the Imunify360 cleanup, because inactive and outdated items are a common way back in for malware. Deactivating a plugin stops it from running, but its files stay on the server.<\/p>
\n- Delete inactive plugins and themes from your WordPress Admin area.<\/li>\n
- Delete any plugin or theme from an unofficial, nulled, or cracked source.<\/li>\n
- Reinstall a fresh copy from the official source if you still need an infected plugin or theme.<\/li>\n<\/ul>
Restore your cPanel website from a backup if malware remains<\/h2>
Restore your website from a JetBackup 5 backup created before the infection if malware remains after the Imunify360 cleanup. Use the detection date of the earliest infected file in Imunify360 to choose the backup. Restoring a backup reverts every change made after the backup date.<\/p>
\n- Download a copy of your website’s current files and database, following How to download backups on cPanel at Hostinger<\/a>.<\/li>\n
- In cPanel, go to Files<\/b> → JetBackup 5<\/b>.<\/li>\n
- Restore Files<\/b> and Database<\/b> from the same backup date, before the earliest detection date. Restoring only the files can leave an infected database in place.<\/li>\n<\/ol>
Update WordPress core, themes, and plugins again after the restoration, since the backup contains their older versions. For more details on the restore options, check How to restore backups on Hostinger cPanel\/WHM<\/a>.<\/p>Confirm your cPanel website is clean after the malware removal<\/h2>
Confirm the malware removal by testing your website as a visitor over several days. Some malware appears only at certain times or to certain visitors, so a single test is not enough.<\/p>
\n- Clear your website cache, and also clear your CDN or Cloudflare cache if you use one. Wait 5 minutes.<\/li>\n
- Open your homepage and the pages that showed signs of malware in a private browser window while logged out of WordPress. Test in at least two browsers.<\/li>\n
- Repeat these tests later the same day and again over the next two days.<\/li>\n
- Run a full scan with a trusted security plugin, such as Wordfence or MalCare, including its database checks.<\/li>\n
- Request a review in the Security issues<\/b> report of Google Search Console if Google flagged your website, such as after an SEO spam hack. Request the review only after your entire website is clean, following How to identify and remove an SEO spam hack on a Hostinger website<\/a>.<\/li>\n<\/ol>
Prevent malware reinfection on your cPanel website<\/h2>
Prevent malware from returning by securing your access and closing common entry points on your cPanel website. There are six practices that reduce the risk of reinfection:<\/p>
\n- Use strong, unique passwords and enable two-factor authentication (2FA) wherever it’s available.<\/li>\n
- Install plugins and themes only from official or trusted sources.<\/li>\n
- Protect your website’s contact, registration, and login forms with reCAPTCHA.<\/li>\n
- Disable directory browsing by adding
Options -Indexes<\/code> to your .htaccess<\/code> file.<\/li>\n- Set permissions to 644 for files and 755 for folders in cPanel File Manager<\/b> → Permissions<\/b>. Restrict
wp-config.php<\/code> to 400 or 440.<\/li>\n- Keep copies of your backups on your own computer, following How to download backups on cPanel at Hostinger<\/a>.<\/li>\n<\/ul>
Fix malware that returns to your cPanel website<\/h2>
Repeat the hidden access checks if malware returns after the Imunify360 cleanup. Delete administrator accounts you don’t recognize, and remove unknown files from the wp-content\/mu-plugins<\/code> folder. Check every other website on the same hosting plan too, since one infected website can reinfect the others. Follow How to fix a malware-infected WordPress website at Hostinger<\/a> for more steps to remove a persistent infection.<\/p>Contact Hostinger support if the malware still returns after these checks.<\/p>
Your cPanel website is clean once Imunify360 shows no infected files, your database and hidden access points are checked, every connected password is changed, and the website stays clean over several days of testing. Keep Kill Mode enabled in Proactive Defense so Imunify360 continues to stop malicious scripts automatically. If you rebuild the website from scratch instead of cleaning it, see How to add a website in Hostinger cPanel<\/a>.<\/p>NOTE<\/b><\/p>\n- Inform your visitors if their personal data may have been exposed. Websites subject to the General Data Protection Regulation (GDPR) must disclose data breaches that put visitors’ personal data at risk.<\/li>\n<\/ul>
Additional resources<\/strong><\/p>\n- WordPress hacked: effective steps to restore and protect your website<\/a><\/li>\n
- How to diagnose and fix a hacked website<\/a><\/li>\n
- Web hosting security best practices<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
Use Imunify360 on Hostinger cPanel to scan for malware, clean infected files, enable Kill Mode, and secure your website after an infection.<\/p>\n","protected":false},"author":581,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_content_updated_date":"","include_on_kodee":true,"footnotes":""},"categories":[190],"tags":[],"class_list":["post-1290","post","type-post","status-publish","format-standard","hentry","category-getting-started-cpanel"],"hreflangs":[{"locale":"en-US","link":"https:\/\/www.hostinger.com\/support\/3621450-how-to-use-imunify360-on-hostinger-cpanel","default":1},{"locale":"fr-FR","link":"https:\/\/www.hostinger.com\/fr\/support\/3621450-comment-utiliser-imunify360-sur-hostinger-cpanel","default":0},{"locale":"id-ID","link":"https:\/\/www.hostinger.com\/id\/support\/3621450-cara-menggunakan-imunify360-di-hostinger-cpanel","default":0},{"locale":"pt-BR","link":"https:\/\/www.hostinger.com\/br\/support\/3621450-imunifique-proteja-e-remova-os-malwares-com-imunify360-no-cpanel-na-hostinger","default":0},{"locale":"uk-UA","link":"https:\/\/www.hostinger.com\/ua\/support\/3621450-\u044f\u043a-\u0432\u0438\u043a\u043e\u0440\u0438\u0441\u0442\u043e\u0432\u0443\u0432\u0430\u0442\u0438-imunify360-\u0432-cpanel-\u043d\u0430-hostinger","default":0}],"include_on_kodee":true,"_links":{"self":[{"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/posts\/1290","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/users\/581"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/comments?post=1290"}],"version-history":[{"count":9,"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/posts\/1290\/revisions"}],"predecessor-version":[{"id":25241,"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/posts\/1290\/revisions\/25241"}],"wp:attachment":[{"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/media?parent=1290"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/categories?post=1290"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hostinger.com\/support\/wp-json\/wp\/v2\/tags?post=1290"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}