How to detect and remove malware from your website
A compromised website can lose search visibility, damage customer trust and expose visitors to harmful scripts. Malware may redirect users to scam pages, inject unwanted advertisements, steal login details or quietly create hidden links for an attacker. In many cases, the site appears normal to its owner while search engines, browsers or security scanners detect suspicious activity first.
For Australian businesses, the impact can be immediate. A slow or blocked website can interrupt online bookings in Melbourne, reduce sales for a Brisbane retailer or undermine trust in a Sydney professional service. Malware removal should therefore be treated as both a technical security task and a customer-protection responsibility, supported by website analysis, reliable backups and clear monitoring.
Recognise the warning signs
A sudden warning from Google Search, Chrome, Safari or a web hosting company is one of the clearest signs of infection. Visitors may see messages such as “Deceptive site ahead”, an antivirus alert or a browser redirection. Search results can also display a warning beside your domain, or pages may disappear from the index after being identified as hacked content.
Other indicators are less obvious. Your homepage might load normally while specific pages redirect mobile visitors to gambling, adult or fake software websites. New administrator accounts, unfamiliar files, altered page titles, strange JavaScript and unexpected WordPress plugins are common clues. A spike in outbound links, unexplained server activity or a sharp increase in hosting resource use can also indicate a hidden compromise.
Performance changes deserve attention too. Malware often adds scripts that slow page rendering, consume server resources or create repeated database queries. Check loading statistics and domain information with a website analysis service such as site security resource checks, then compare the results with your own analytics and hosting logs. A single poor score does not prove infection, but a sudden change combined with suspicious behaviour warrants investigation.
Do not rely only on what appears in your own browser. Attackers frequently use cloaking, showing clean content to administrators while serving malicious code to search crawlers or visitors from particular locations. Test the site in a private browsing window, on a mobile connection and from a separate device, while avoiding interaction with suspicious pop-ups or downloads.
Isolate the infection safely
Once malware is suspected, reduce exposure before editing files. Put the site into maintenance mode or temporarily restrict public access if the business can operate without it. Keep a clean holding page available with essential contact details, opening hours and service information. For an Australian business, this may be preferable to allowing customers to encounter a browser warning while trying to make a booking or purchase.
Contact your hosting provider and ask whether it has detected malicious files, unusual processes, unauthorised logins or database changes. Hosting support can often identify the initial entry point through access logs and server snapshots. Preserve those logs before deleting anything, because they may reveal when the intrusion began and whether other sites in the same hosting account were affected.
Change credentials from a trusted device, beginning with hosting, website administration, database, FTP or SFTP, email and domain registrar accounts. Use unique passwords and enable multi-factor authentication wherever available. Do not assume that changing the WordPress administrator password is enough; an attacker may have created another account, inserted a backdoor or stolen an active session cookie.
Avoid immediately deleting every unfamiliar file. Some suspicious-looking files are legitimate components of a content management system, while a backdoor may be hidden inside a file that appears ordinary. Make a complete forensic copy of the infected site and database before cleaning it, storing the copy away from the live server. This preserves evidence and provides a reference if the repair needs to be reversed.
Scan files, code and databases
Start with a malware scanner designed for the platform you use. WordPress owners can use a reputable security plugin or an external scanner, while custom applications may need a developer to review source code, dependencies and server configuration. Scan the website files, database, uploads directory, scheduled tasks and user accounts rather than checking only the homepage.
Look for recently modified files, unexpected PHP scripts, encoded strings, suspicious iframe elements and JavaScript loaded from unknown domains. Common malicious patterns include functions that decode hidden content, scripts injected before closing HTML tags and code that creates administrator access. File timestamps are useful, although they can be manipulated, so compare them with deployment records and hosting logs.
Search the database for injected links, hidden iframes, fake login forms and altered settings. Attackers often place malicious content in posts, widgets, navigation menus, options tables or custom fields. Check .htaccess files, web server configuration, robots.txt and sitemap files for redirects or instructions designed to hide infected pages from search engines.
Review technology and marketing signals as well as code. An analytics account may show traffic from unexpected countries, unusual referral domains or a sudden increase in low-quality landing pages. A technical audit can reveal changes to scripts, redirects, indexability and page behaviour. For broader usability checks after the immediate threat is contained, this UX troubleshooting guide can help separate security-related performance problems from ordinary design or usability faults.
A scan result is evidence, not an automatic cleaning instruction. Security tools can produce false positives, especially when a website uses custom code, payment integrations or older plugins. Confirm each finding against a trusted original, the developer’s repository or a clean backup before removing it.
Remove malicious code and restore trust
The safest repair is usually to rebuild from a known-clean source rather than manually editing dozens of infected files. Replace the core content management system, themes and extensions with fresh copies downloaded from official sources. Keep only verified media and business content, and inspect uploaded files carefully because attackers may disguise executable scripts with image-like names.
If a clean backup exists from before the first suspicious activity, restore it to a separate staging environment. Update the application, plugins, themes, operating system and server components before making it public. A backup created after the compromise may contain the same backdoor, so confirm its date and scan it before use.
Remove unauthorised users, malicious cron jobs, unknown SSH keys and rogue email forwarding rules. Review database accounts and permissions, then apply the principle of least privilege so each service has only the access it needs. Disable unused plugins, themes and administration features. If the site uses a third-party booking, payment or customer management system, check its API keys and rotate them if they may have been exposed.
Ask a qualified developer or incident-response specialist to handle complex infections, ecommerce systems and sites containing personal information. Manual cleaning can miss a small persistence mechanism that reinfects the site days later. Professional support is particularly valuable when there is evidence of data theft, payment-page tampering or compromise across multiple domains.
Australian organisations should also consider privacy obligations. Under the Privacy Act 1988 and the Notifiable Data Breaches scheme, an entity may need to notify affected individuals and the Office of the Australian Information Commissioner when an eligible data breach is likely to result in serious harm. The exact response depends on the information involved and the organisation’s circumstances, so obtain legal or privacy advice promptly rather than assuming that a visible malware infection is only a technical issue.
Verify recovery and prevent reinfection
After cleaning, test the site in a staging environment before returning it to production. Check desktop and mobile pages, forms, checkout flows, account areas, redirects, downloads and third-party scripts. Verify that the site uses HTTPS correctly, that security headers have not been removed and that no unexpected domains appear in the page source or browser developer tools.
Run several independent scans and request a review from the relevant search or browser security service if your domain was flagged. Google Search Console can show security issues and manual actions, while hosting tools may identify remaining infected files. Recheck the site after caches and content delivery networks have been purged; an old cached script can make a clean server appear compromised.
Monitor logs, administrator accounts, file changes, outbound traffic and analytics for several weeks. Set alerts for new users, changes to critical files, failed login bursts and unusual traffic patterns. Schedule automatic backups with at least one copy stored outside the hosting account, and test restoration rather than assuming that a completed backup is usable.
Keep software current and remove anything that is no longer supported. Use a web application firewall, rate limiting and strong authentication where appropriate. Limit administrative access by role, location or VPN, and train staff not to reuse passwords or install unapproved extensions. A short security checklist completed during each website update can prevent an overlooked plugin or abandoned account from becoming the next entry point.
Local customer habits make dependable security especially important. Australians often browse on mobile devices while commuting, shopping or comparing services during the evening, and a redirect that affects only mobile traffic can escape internal testing. Businesses serving customers across Perth, Adelaide, Hobart or regional areas should also account for variable connection speeds, since malicious scripts can make an already modest connection feel unusable.
Begin with a controlled response: restrict access if necessary, preserve evidence, contact your host, rotate credentials and scan every part of the site. Once the domain is clean, verify search status, review privacy responsibilities and put monitoring and tested backups in place. A timely security check protects visitors, preserves your brand and gives your website a stronger foundation for future growth.
