<\/p>
To secure your Hostinger virtual private server (VPS)<\/a> from abusive activity, identify whether the Hostinger dashboard shows a CPU limited, Stopped, <\/strong>or Suspended<\/strong> status, then remove the cause and close the entry point. Malware is a likely cause if your VPS runs slowly with no clear reason, shows a central processing unit (CPU) limitation in the Hostinger dashboard, or has been stopped by our system. Most cases come from outdated software, weak or exposed credentials, or services open to the internet that should not be. Each status has its own fix, and the prevention steps stop it from happening again.<\/p> Three statuses look alike in the Hostinger dashboard: CPU limited, Stopped, and Suspended. Each has its own fix.<\/p> CPU credits are a separate mechanism. Read How CPU credits work on Hostinger VPS<\/a> if your VPS is limited because its burst balance is empty. A high steal value in To lift a CPU limitation on your Hostinger VPS, find and remove whatever is using the CPU. Restrictions lift on their own once CPU usage returns to normal, usually after a few hours. Fixing the cause is what ends the cycle, so check what is using the CPU first. The limit values are listed in What is the CPU use limit for VPS at Hostinger?<\/a><\/p> A process that uses most of the CPU, has an unfamiliar name, and talks to an unknown host is most likely a cryptominer such as XMRig. Stop it, delete the files it runs from, and remove whatever started it (a cron job, a systemd service, or a container).<\/p> You can use Remove limitations<\/strong> in the Hostinger dashboard once per week. Remove limitations<\/strong> gives you a short window to work on the VPS. Remove limitations<\/strong> does not fix the cause, and the limitation returns if the high usage continues.<\/p> Contact Hostinger support through the live chat<\/a> if CPU usage has been normal for many hours and the limitation is still there.<\/p> To recover a Hostinger VPS stopped for malware, remove the malware, rotate every credential, and patch the entry point before you rely on the VPS again. You will usually get an email naming the process we detected.<\/p> Do not restart the VPS and leave it as it is. The malware comes back and the VPS is stopped again if the entry point stays open. For a broader checklist, see What to do if your VPS has been hacked at Hostinger?<\/a><\/p> To appeal a suspension, reply to the suspension email with what you found and what you changed. A suspension means we received an abuse report or confirmed abusive activity from your VPS. The suspension email states the reason. Our abuse team reviews each case, and repeated suspensions can lead to permanent termination, so fix the cause before you ask for reactivation. Rescue mode is a recovery tool and does not bypass a suspension.<\/p> AI agents such as OpenClaw<\/a> and Hermes Agent<\/a> can run shell commands, install packages, read files, and call application programming interfaces (APIs) on your behalf. These capabilities make AI agents useful, and they also mean anyone who gains control of the agent gets everything the agent can do on your VPS. A compromised agent is a backdoor with a friendly interface. Attackers target AI agents for the same reasons they target any open service, and the result is often a cryptominer or a botnet client running under the agent’s account.<\/p> Watch for these five risks:<\/p> Also check which processes and scheduled jobs exist on the VPS after the agent has been working: list processes with Four common entry points lead to infected VPS servers:<\/p> Follow these seven steps to prevent abusive activity on your VPS:<\/p> Four other kinds of abuse can affect a Hostinger VPS: outgoing spam, malware or phishing pages, illegal or copyrighted content, and botnet or DDoS participation.<\/p> Unfamiliar outgoing messages mean your VPS may be sending spam. Protect website forms with reCAPTCHA and do not let visitors edit the destination address, as covered in How to secure your contact forms against spam at Hostinger<\/a>. Disable PHPMailer and sending through port 25 if you do not use contact forms. The port 25 status is explained in Is SMTP port 25 blocked on Hostinger VPS?<\/a><\/p>\n<\/details> An infected site can host malware or phishing pages. For WordPress, follow the malware removal guide<\/a>.<\/p>\n<\/details> Attackers can store illegal files on a compromised server. Scan with ClamAV and remove any files you did not upload.<\/p>\n<\/details>Understand the Hostinger VPS statuses<\/h2>
\n
top<\/code> or htop<\/code> also does not prove malware, as explained in Understanding CPU steal and its impact on VPS at Hostinger<\/a>.<\/p>Fix a CPU limited Hostinger VPS<\/h2>
\n
top -o %CPU<\/code> or ps aux --sort=-%cpu | head -15<\/code>.<\/li>\n\/tmp<\/code>, \/var\/tmp<\/code>, or \/dev\/shm<\/code>.<\/li>\ncrontab -l<\/code> and ls -la \/etc\/cron.*<\/code>, and for unknown services with systemctl list-units --type=service --state=running<\/code>.<\/li>\nss -tunap | grep ESTAB<\/code>.<\/li>\n<\/ol>Recover a Hostinger VPS stopped for malware<\/h2>
\n
top -o %CPU<\/code>, check scheduled jobs with crontab -l<\/code>, and check outbound connections with ss -tunap | grep ESTAB<\/code>.<\/li>\nResolve a suspended Hostinger VPS<\/h2>
Secure AI agents running on your Hostinger VPS<\/h2>
\n
top -o %CPU<\/code> and scheduled jobs with crontab -l<\/code>. For a longer checklist, see OpenClaw security: risks, best practices, and a checklist. For the Hostinger-specific steps, see How to secure and harden OpenClaw security (formerly Moltbot\/Clawdbot) on a Hostinger VPS<\/a>.<\/p>Identify common ways a Hostinger VPS gets infected<\/h2>
\n
wp-content\/mu-plugins<\/code>.<\/li>\nPrevent abusive activity on your Hostinger VPS<\/h2>
\n
Handle other kinds of abuse on your Hostinger VPS<\/h2>
Outgoing spam<\/summary>\n
Malware or phishing pages<\/summary>\n
Illegal or copyrighted content<\/summary>\n
Botnet and DDoS participation<\/summary>\n