Moatline

Host suspended your WordPress site for malware? What to do next

A suspension email is stressful, but it is usually the start of a routine process, not the end of your site. Here is what to ask your host, how to clean the account properly and how to get back online quickly.

By the Moatline team at Next Nova Technologies · Published 15 October 2026 · 4 min read

Why hosts suspend sites

Hosts suspend an account to protect other customers on the same servers and their own reputation. The usual triggers are:

  • Their malware scanner found infected files on the account.
  • The account was sending spam or phishing emails.
  • Someone reported a phishing page or malware download on your site.
  • A script was using so much CPU or memory that it slowed the server down.

The email usually says which one. That tells you what to look for.

First: don’t make it worse

  • Don’t cancel the account or delete the site. You will need the files and database, and the evidence of how the attacker got in.
  • Don’t just restore the newest backup and ask to be switched back on. The backup may contain the same malware, and the hole is still open.
  • Download a full backup (files and database) as soon as you have any access, even if it is infected. Keep it offline, clearly labelled.

What to ask your host

Reply to the suspension email or open a support ticket and ask:

  1. The list of infected files their scanner found, and the type of problem (malware, spam, phishing).
  2. Temporary access for cleanup. Many hosts can give you file access, or unblock the site for your IP address only, while visitors still see the suspension page.
  3. Their backups, and the dates they cover.
  4. What they need from you to switch the account back on, and whether they will rescan first.

If your hosting control panel has a malware scanner (many cPanel hosts include one), its results page often shows the same file list.

Clean the whole account

The host’s list is a starting point, not the full picture. Scanners on the server usually flag the noisiest files and miss backdoors hidden in the database or disguised as images.

  1. Every site on the account. Include old copies, staging sites and test installs in other folders. They are often the way in.
  2. Remove the listed files, after checking each one isn’t a normal file that was edited. Infected core and plugin files should be replaced with fresh copies, not deleted.
  3. Scan each WordPress site fully. Once you can reach the dashboard, the free Moatline Malware Scanner checks files, the uploads folder, the database and your live pages, and compares plugins with their official copies. If you can’t reach the dashboard yet, use the file list and the steps in our malware removal guide.
  4. Look for mailer scripts if the suspension mentions spam: unknown PHP files in the site root, the uploads folder and theme folders.
  5. Change every password: hosting control panel, FTP/SFTP, database, every WordPress admin and email accounts on the domain. Then generate new WordPress security keys.
  6. Update everything and delete plugins and themes you don’t use.

Getting switched back on

Reply to your host with a short list of what you did. For example:

Hi, we've cleaned the account:
- Removed the 14 infected files from your list, plus 3 more we found
  (2 in wp-content/uploads, 1 fake plugin).
- Replaced WordPress core and all plugins with fresh copies.
- Deleted an unknown admin user and changed all passwords
  (cPanel, FTP, database, WordPress admins).
- Updated all plugins; the entry point was an outdated form plugin.
Please rescan and reactivate the account. Thanks!

A clear, specific reply like this usually gets a faster reactivation than “it’s fixed now”.

After you’re back online

  • Scan again the next day and a few days later.
  • Block PHP in uploads and turn on two-step login for admins. Both are in Moatline’s free Hardening and Lockdown tabs.
  • Check blacklists. If spam was sent, check your domain and server IP with a blacklist checker, and look in Google Search Console for security warnings.

Frequently asked questions

Will I lose my website?
Usually not. A suspension blocks visitors, but the files and database are normally kept while you clean up. Ask your host how long they keep a suspended account, and download a backup as soon as you can.
Can I just restore an old backup?
Only if you know it is from before the infection, and even then you must close the hole the attacker used, or they will be back. Restoring also loses everything since that backup, such as orders and form entries.
I have several sites on one hosting account. Do I need to clean them all?
Yes. On most shared hosting, all sites on one account can read and write each other’s files. Malware on one site spreads to the others, and cleaning just one leads to a second suspension.
Why was my site sending spam emails?
Many infections include a mailer script that sends spam or phishing emails through your server. That gets your server’s address blacklisted and is a common reason for suspension. Once the script is removed, check your domain and server IP on a blacklist checker.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides

All guides →