Host suspended your site for malware: how to get it back

If your host suspended the account for malware, the site is offline, customers cannot see it, and the provider sets a deadline to fix it, that is one of the most urgent situations there is. The host almost never cleans the site for you: it flags the infection and keeps the account suspended until you remove the malware. Below: why it happens, what exactly the provider asks for, and how to clean the site and pass the re-scan so it is unsuspended and not suspended again.

What happened: the host suspended the site

The provider is not punishing you, it is protecting its platform. The logic is this:

• An infected site sends spam, attacks other sites or serves malware to visitors.
• On shared hosting this hurts the server neighbours and the reputation of the IP address the spam leaves from.
• So the provider has to suspend the account until the problem is fixed. As a rule it will not clean the site for free.

For the owner this means the site comes back only after you remove the malware and pass the host re-scan.

Check your site right now

If the site still opens, the tool shows the infection from the outside: defacement, a redirect, cloaking. If the account is already suspended and the site is offline, the check will confirm that, and after it is unsuspended you run it again to make sure the site really is clean. No access to the site is required.

Why the host does this

The reason is always that an infected site harms more than just you:

• Spam. A hacked site sends mail in bulk, and mail services blacklist the server.
• Attacks on other sites. Requests to third-party resources go out through your account, and the provider gets complaints.
• Serving malware. Visitors get infected, and the host risks landing on dangerous-site lists.

The provider's automated scanner catches this from logs and signatures, so the suspension often arrives before you notice the problem yourself.

What not to do

The typical mistakes that get a site suspended again:

• Do not delete everything in a panic: first work out what is infected and where.
• Do not restore blindly from an old backup: it often already contains the same backdoor.
• Do not ask for an unsuspend without cleaning the site: the provider re-scans, sees the malware and suspends it again.
• Do not simply switch hosts: the infection moves with the site and the new provider suspends it too.

What the host asks for and how to pass the re-scan

The provider usually sends a report listing infected files or URLs. It is a map of where to look, not a solution:

• Take the report as a starting point, but also check what is not in it: the database, cron jobs, hidden backdoors.
• Remove the malware and close the way in that was used.
• Request a re-scan (unsuspend) and briefly describe what you did.

How to clean it so it is not suspended again

The order that actually lifts the suspension for good:

1. Change every password: admin, FTP and SSH, database, hosting panel.
2. Find and delete backdoors: unknown .php files, often via eval(base64_decode(...)).
3. Check the database and template files for injections, and cron jobs for code that restores the infection.
4. Find the entry point in the server logs and close it: update the CMS and extensions.
5. Confirm the site no longer sends spam or redirects, and only then request the unsuspend.

If the site is on Joomla or WordPress

Summer 2026 has seen a wave of mass hacks, and many hosting suspensions are a result of it. On Joomla attackers get in through vulnerable extensions (iCagenda, Balbooa Forms, JCE, Helix3), on WordPress through neglected plugins. Details and the version list are on the summer 2026 hack wave page. If you do not update the vulnerable extension, the site is reinfected and the host suspends it again.

When to call a specialist

It is worth calling in a specialist if:

• the site is offline and every hour of downtime costs you customers;
• you deleted the files from the report but the host suspended it again;
• the backdoor cannot be found and the malware keeps returning;
• the code is in the database, not in files, and you do not know where to look;
• there is no working clean backup.