The signs your site is infected
Website malware announces itself in a fairly consistent set of ways, and most of them are second-hand — someone or something tells you, rather than you noticing directly. The classic warning is a red interstitial screen when someone tries to visit your site, put there by the browser or by Google, saying the site may be dangerous. Your host may email you or suspend the account because their scans found malicious files. Customers might report being redirected to a pharmacy or gambling site, or seeing pop-ups, especially on their phones, that you never see on your desktop.
Other tells are subtler. Search results for your site suddenly show gibberish titles or foreign-language spam — "pharmaceutical" and "replica goods" text that you never wrote, injected purely to manipulate search engines. New administrator accounts you did not create appear in your dashboard. Files with strange names show up in your hosting file manager. Your site suddenly runs slowly because it is spending its resources on someone else’s spam campaign. Any one of these deserves immediate attention; several together mean you are almost certainly compromised.
Why you cannot see it but Google can
The reason you can look at your own site and see nothing wrong is that modern website malware is deliberately selective about who it shows itself to. It commonly checks who is visiting and behaves differently depending on the answer. It will often show the clean, normal site to a logged-in administrator and to repeat visitors from your area, while showing the malicious version to first-time visitors, to people arriving from Google, or to mobile users. Some of it only activates for visitors from certain countries, or only at certain times.
This cloaking is why "it looks fine to me" is worthless as an all-clear, and why automated scanners and search engines catch infections that owners miss for weeks. Google crawls your site as a brand-new anonymous visitor from many locations, exactly the audience the malware is targeting, so it sees what you cannot. The practical lesson is to trust the scanners and the warnings over your own eyes. If Google, your host, or a reputable scanner says your site is infected, it is infected, even if every page looks perfect when you load it.
How to confirm an infection
Before you tear anything apart, confirm what you are dealing with. Run your site through a reputable public malware scanner — several security companies offer free remote scans that load your site the way an anonymous visitor would and report injected code, redirects, and whether you appear on any security blocklists. Check Google Search Console, if you have it connected, because Google reports security issues it has found directly there, often with example URLs. Ask your host to run a server-side scan; because they can see the actual files, their scan catches things a remote scan cannot.
A remote scan tells you the site is compromised from the outside; a server-side scan finds the malicious files themselves. You generally want both, because malware often lives in two places at once — a visible symptom on the pages and a hidden backdoor buried in the files that lets the attacker back in after you think you have cleaned up. Confirming the infection properly, rather than guessing, is what stops you from doing a cleanup that misses the part that actually matters.
The safe way to clean an infected site
Once you have confirmed an infection, work in a safe order. First, if you can, take the site offline or into maintenance mode so you are not actively harming visitors while you work, and change every password involved — your hosting login, your site administrator accounts, your database password, and your file-transfer credentials — because you must assume the attacker has some of them. Then take a full backup of the site in its current infected state before you change anything, purely as a forensic copy in case you need to see what happened.
The cleanup itself has two reliable routes. The cleaner approach, when you have a known-good backup from before the infection, is to wipe the site and restore that clean backup, then immediately update everything and change passwords so the original hole is closed. The other route, when you have no clean backup, is to replace the core software and every plugin and theme with fresh copies from official sources — which overwrites tampered program files — and then carefully inspect what remains, especially your uploads and configuration, for injected code and unfamiliar files. This is exactly why the backup advice on this site matters so much: an infection is the moment a good backup turns a disaster into an afternoon. The one thing you must not skip in either route is hunting down the backdoor. If you clean the visible malware but leave the hidden re-entry file behind, you will be reinfected within days, and people conclude the cleanup "did not work" when really they only cleaned half of it.
Getting off Google’s blocklist
If your site was flagged by Google or landed on a security blocklist, cleaning it is only step one; you also have to tell the gatekeepers you have fixed it. Those warning screens do not disappear on their own just because the malware is gone. In Google Search Console, once the site is genuinely clean, you request a review through the security issues section, and Google re-crawls and, if satisfied, lifts the warning — usually within a day or two. If your domain ended up on other blocklists that email providers or browsers use, each may have its own review request process.
The critical mistake here is requesting a review before the site is actually clean, including that hidden backdoor. If Google re-checks and still finds a problem, you go back to the end of the queue and rebuild trust the hard way. Clean thoroughly, verify with a fresh scan, and only then ask for the review. Getting the warning removed matters commercially as much as technically — a "this site may be dangerous" screen scares away essentially every visitor and every customer for as long as it is up.
How to stop it coming back
Almost every website infection traces back to one of a small number of causes, and the same short list prevents almost all of them. Out-of-date software is the biggest — an old plugin or theme with a known vulnerability is the most common way in, which is why keeping everything updated promptly is the single highest-value security habit there is. Weak or reused passwords and the absence of two-factor authentication are the next, letting attackers simply log in; strong unique passwords and 2FA close that door. Abandoned plugins and themes you no longer use are silent liabilities — delete them rather than leaving them installed and unpatched.
On top of good hygiene, a security layer that watches for trouble pays for itself the first time it stops an attack: a reputable security plugin or, better, a web application firewall that filters malicious traffic before it reaches your site, plus regular automated scanning so the next infection is caught in hours instead of weeks. This is a large part of what managed hosting quietly buys you — the updates, the firewall, the scanning, and the monitoring all handled so an infection is prevented or caught early rather than discovered by an angry customer.
When to call a professional
Be honest about the limits of a do-it-yourself cleanup. If the infection keeps coming back after you clean it, that is a clear sign a backdoor is still hiding somewhere you have not found, and it is time for someone who does this routinely. If the site handles customer payments or personal data, if you cannot tell whether attacker access reached anything sensitive, or if you are simply not confident you have removed everything, professional help is the safer call — and remember that a serious breach involving personal information can carry notification obligations under Canadian privacy law, which I cover in the hacked-site response guide on this site.
There is no shame in handing this off; even experienced people bring in specialists for a stubborn infection, because the cost of a half-finished cleanup is a reinfected site and a lost search reputation. Cleaning up compromised sites, closing the hole that let the attacker in, and hardening things so it does not happen again is part of the security work I do for clients at Design Menu. Whether you clean it yourself or bring in help, the principles are the same: confirm it properly, remove the backdoor as well as the symptoms, get off the blocklists, and fix the underlying cause so you are not back here next month.