Hosting account suspended for malware: recovery steps

If your host suspended your account for malware, read the notice first, copy the site before you change anything, find and remove the infection and its way in, change every credential and the WordPress keys, then ask the host in writing to lift the suspension. Each host's rules differ. A restored backup alone often brings the flag back.

What does a malware suspension actually mean?

The host has stopped serving your site, or your whole account, because something told it the account is serving or spreading malicious code. The something is usually a server-side scanner or an abuse report from outside.

Bluehost says the affected website is suspended and the owner can resolve the issue or upgrade to a Dedicated server. The same page says a suspension can cover a single directory or the entire account, decided case by case.

The WordPress project lists "Host has disabled your website" among the clear indicators of a hack. An indicator is a sign to investigate, and it is not a diagnosis. The notice tells you that something was flagged. It does not tell you how the attacker got in, how long they stayed, or whether other sites on the same account are affected.

If this is a PHP-level incident rather than a plugin problem, the patch question is separate. See the PHP runtime flaw write-up for the runtime side.

Which email should I read before I touch anything?

The one on the account. HostGator says notifications about security or terms issues go to the account's primary email, and Bluehost says it emails the address on file. Check that inbox and its spam folder before you open a support ticket.

Write down three things from the notice: the date and time, the file paths or URLs it names, and the exact action it asks for. Bluehost's acceptable use policy (last modified 5 September 2025) says that failing to answer an abuse-team email within 48 hours, or the time given in the message, may lead to suspension or termination. Reply inside the stated window even if all you can say is that you are working on it.

In what order should I recover?

The order matters more than any single tool. Each step below depends on the one before it.

1. Keep a copy before you delete anything

WordPress.org's own guide tells owners to take a snapshot of the environment before cleaning, even if it is infected, so there is a bad copy to reference if the cleanup goes wrong. Ask the host whether you can still reach the files over SFTP or a file manager while suspended. DreamHost warns that suspended and disabled accounts are at risk of data loss and that it generally keeps a two-week backup that DreamHost does not promise.

2. Find the way in before you restore

A backup restores files. It does not close the hole that let the attacker in. If the cause was an outdated plugin, a weak password or a stolen login, restoring puts you back where you started and the scanner flags the site again. The detailed version is in restored backup still hacked and why malware keeps coming back.

Hostinger's WordPress cleanup page adds a specific rule. When you restore, it says to restore files and database from the same backup point. Mixing a file backup from one day with a database from another is a common source of fatal errors.

3. Change every credential, then the WordPress keys

WordPress.org lists the access points to change: SFTP or FTP, wp-admin, the hosting control panel and the database. It says to change them again after the site is confirmed fixed, because the first change may have happened while the attacker still had access. The same page says to update the secret keys in wp-config.php to log out anyone still signed in.

The WordPress handbook confirms the effect: changing the keys will invalidate all existing cookies, so every user has to log in again. If API keys, payment keys or mail credentials lived on the server, the order for rotating them safely is covered separately. If you are locked out of wp-admin, see locked out after a hack.

4. Ask the host to lift the suspension, in writing

Send the request after the work is done, not before. Use a message you can keep:

My account [account or domain] was suspended on [date] after the notice [reference] about [files or URLs named]. I have removed the flagged files, found the entry point as [plugin, login or other cause], restored from [backup date], and changed all SFTP, panel, database and WordPress credentials and keys on [date]. Please re-scan the account, tell me what the scan found, and lift the suspension. If anything is still flagged, list the exact paths.

Then keep the reply. If the host later says the account was only partly cleaned, you need the paths. Once the site is stable, hardening WordPress after an incident closes the usual gaps.

What does each host say about getting reinstated?

These are the hosts' own pages at our check on 24 October 2026. Where a page is silent, the table says so. A silent page means "ask", not "no". For how hosts handle patching rather than suspensions, see the other hosting guides and which managed hosts patch automatically.

Sources for this table: Bluehost, HostGator, GoDaddy, Kinsta, WP Engine.

Kinsta's free cleanup comes with homework. The customer must, within one business day, update plugins, themes and core, reinstall removed items from fresh sources, delete unknown admin users and change passwords. Kinsta says that if these steps are skipped, a later infection can cost $100. Read the offer's conditions before you rely on it. If you are weighing a paid security product against a one-off cleaner, what cleanup usually costs is compared on its own page.

Does a restore, a cleanup or a rebuild fit my case?

Am I affected? A three-state self-test

Why is my site still flagged after the host lifts the block?

Because the flags are separate. The host's suspension is the host's decision. Google's warning lives in Search Console's Security Issues report, which covers hacked content, malware and social engineering. Google's help page says to fix every issue listed and then select Request Review, and says most reviews can take several days or weeks.

The page carries no revision date at our check, so confirm the current wording in Search Console. If visitors still see a browser warning, check the report before you write to your host again. Your host cannot clear it.

Email can be affected too. WordPress.org's guide notes that sites abused to send spam can get their server IPs blocklisted for email. If customer mail has bounced since the incident, ask the host which IP the mail leaves from.

Who is responsible for the infection?

On shared hosting, the account holder is generally the one the host holds responsible for what runs in the account, and the help pages above ask the customer to fix and report. The host runs the server and its scanners. You run the application and its logins. That split is explained in who handles patching on a hosted site.

Hostinger's page makes one useful point. A compromise is typically isolated to the affected account and does not necessarily mean the server was breached. Ask the host to confirm that for your server in writing. If you handle other people's data, the client email template covers what to say and when, and the wider incident-handling steps cover the rest of the sequence. The UK NCSC advises that a victim of a significant attack start by reporting it; check the equivalent national contact for your country.

What can an outside check tell me after recovery?

After the host lifts the suspension, an outside look at your site is useful for one narrow job: to see what the site still serves. The free scan reads the stack your site serves and matches each version to known vulnerabilities. It is a lookup, so it can say a version is affected, not whether your setup is exposed or whether anything is still planted. The limits of outside scanning are listed separately. Only your server files, the host's logs and your own records can settle the rest.