Harmful code was found on your site: what to do
We told you that something harmful was found on one of your sites. Here is what that means, whether your site is still online, and the steps to take in order.
We scan the sites we host for harmful code. When something is found on your site, we tell you — because the file is usually still there, still running, and getting worse the longer it is left.
What this means
Harmful code is a file (or a change to one of your existing files) that someone put on your site without your permission. It normally arrives through an out-of-date plugin, theme or application, or through a password someone else has obtained.
It is used to send spam, to show pages you did not create, to redirect your visitors somewhere else, or to keep a way back in for whoever placed it.
Is my site still online?
Yes. We do not take your site down or delete anything when we notify you. The file is reported to you so that you can decide what to do with it — some flagged files are legitimate, and deleting the wrong one breaks a working site.
What to do, in order
- Change your passwords first. Your dashboard password, your site's administrator password, and your FTP or file-manager password. If the way in is still open, cleaning the file only buys you a few days.
- Look at the file we named. We tell you the site and the path within it. Ask yourself: is this part of a plugin, theme or script you installed on purpose? Or is it something you have never seen, in a folder that should only hold uploads?
- Update everything. Your application core, every plugin, every theme — including the ones you do not use. An inactive plugin is still a way in.
- Remove or replace the file. If it is not yours, delete it. If it is a modified copy of a legitimate file, replace it with a clean copy from the original plugin or theme rather than trying to edit the harmful part out.
- Restore from a backup if the damage is wide. Restore to a point before the first detection, then immediately update and change passwords — otherwise you restore the hole along with the site.
- Remove what you are not using. Old plugins, abandoned themes, test copies of your site in subfolders. These are the most common way in and the least likely to be updated.
If you think it is a false alarm
It happens — some legitimate tools look a lot like harmful code. Do not ignore it: open a ticket from the Support section of your dashboard, tell us the site and the file, and we will look at it with you.
If you would rather we handled it
Open a ticket and say so. Tell us the site, when you first noticed anything unusual, and whether you have a backup you trust. Telling us early matters far more than arriving with a tidy summary.
Keeping it from happening again
- Keep your application, plugins and themes updated — this is the single biggest factor.
- Delete what you no longer use rather than deactivating it.
- Use a distinct, strong password for your site administrator account, and turn on two-factor authentication where your application supports it.
- Keep your own backups as well as ours, and check occasionally that they restore.
Related reading: What to do if your website is compromised and Malware scanning and quarantined files.