SiteLock: My Website is Infected
- What is a Malware Infection?
- Find Out How You Were Hacked
- Options for Infected Websites
- Removing Infected Files and Directories
- Google Attack Page
What is a Malware Infection?
Malware, short for malicious software, refers to programs used by cybercriminals designed to access and damage computers and websites without a user's consent. There are a variety of ways a cybercriminal can use malware to infect your website or computer based on their intent.
Find Out How You Were Hacked
If you have an active SiteLock plan set up, it will automatically detect and remove malware on your website. Our SiteLock team will provide you with clues about what happened to your website and possible solutions to prevent your account from being compromised again during the cleanup process.
Tip: SiteLock's Free Scan will not include automatic malware removal. Upgrade to Essentials, Prevent, or Prevent Plus to take advantage of automatic malware removal.
You can also check your File Manager for scanned files to help identify what needs to be cleaned, and that may reveal what was infected.
Options for Infected Websites
Knowing that your website has been infected with malware can be incredibly frustrating. Luckily, you can contact Bluehost support about malware infection, and we will help you choose the best option to secure your site.
Note: Bluehost support does not offer any direct malware removal services; however, we can scan it and put it into a one file called "scanreport.txt" to identify the infected files inside your File Manager.
There are several ways you can remove malware:
-
Professional Malware Cleaning Services
Having experts that can clean the malware infection from your website is an excellent option if you don’t have the time or ability to do it yourself. Our security partners with the SiteLock team can provide the most convenient ways to remove malware from your site. They can also discuss solutions to prevent future infections proactively.
-
Restore Your Site
You can restore your website using a backup made before your site became infected with malware. If you do not have a backup, you can contact Bluehost support for options or see Backup and Restore File or Folders for more information.
It is critical that you use a backup made prior to the site being infected to remove the malicious code altogether; if not, your restored site will remain infected.
Note: Be aware that you will lose any changes made to your site after creating the backup you use. Even after the restoration process, your site will have the same vulnerabilities that would allow it to be compromised again. It is highly recommended that you take a proactive approach to prevent future infections.
-
Create a New Site
If you are unable to restore your website or have it cleaned, then the final option would be to create a brand new site.
Important Note: Preventing website attacks is always easier and faster than repairing a site that has been infected with malware. Bluehost recommends you choose a website security plan from our partners at SiteLock. Check out the discounts available to Bluehost customers in How to Order SiteLock.
Removing Infected Files and Directories
When a site is compromised by malware, we recommend using a professional service to guarantee resolution and prevent future infection. If you are not able to hire a professional, you can attempt to fix your website yourself.
To do this, you need to scan your website to see the infected files. Usually, you may locate all of them inside the "scanreport.txt" file. You also need to identify and remove recently added or modified files or directories.
You need to exercise extreme caution when removing website files and directories. You can disable features and functionality on your site, and it does not guarantee the removal of malicious code.
Additionally, file removal does not address vulnerabilities that allow attackers to gain access to your site. By choosing to self-service a site infection, you take full responsibility for changes made to the site, any files deleted, and/or breaks in functionality.
Note: If your website is currently under investigation, please DO NOT MAKE CHANGES, including the removal of files and directories.
Google Attack Page
If you see a Google Reported Attack Site! Warning on your website, you must read the following article to learn how to clean the site and remove the warning:
Important note: Not all browsers will display the warning page. This warning only happens in browsers that have a relationship with Google, including Google Chrome, Mozilla Firefox, and some Safari versions.
If you need further assistance, feel free to contact us via Chat or Phone:
- Chat Support - While on our website, you should see a CHAT bubble in the bottom right-hand corner of the page. Click anywhere on the bubble to begin a chat session.
- Phone Support -
- US: 888-401-4678
- International: +1 801-765-9400
You may also refer to our Knowledge Base articles to help answer common questions and guide you through various setup, configuration, and troubleshooting steps.