---
title: Types of Website Malware and How to Recognise Each One
description: "**In short**Website malware is not one thing. Some is a backdoor that gives the attacker lasting control, some publishes spam pages to boost other sites in Google, some redirects your visitors to scams, steals card details or sends spam. Knowing…"
url: "https://www.hyyat.com/en/knowledgebase/website-malware-types/"
updated: "2026-10-21"
category: Website Security
---

# Types of Website Malware and How to Recognise Each One

**In short**Website malware is not one thing. Some is a backdoor that gives the attacker lasting control, some publishes spam pages to boost other sites in Google, some redirects your visitors to scams, steals card details or sends spam. Knowing the type helps you spot it quickly and choose how to clean it.

![Types of website malware: different software bugs around a protected file](https://www.hyyat.com/wp-content/uploads/2026/10/hkb-malware-types.webp)

## The most common types

| Type | What it does | Sign |
| --- | --- | --- |
| Backdoor and web shell | Gives the attacker lasting access even after passwords change. Read [C99 shell](https://www.hyyat.com/en/knowledgebase/hacking-tools-c99-shell/). | Strange PHP files, especially in the uploads folder. |
| SEO spam | Creates thousands of pages or hidden links for pills, casinos or fake goods. | Odd results when you search `site:` for your domain in Google. |
| Malicious redirect | Sends some visitors to scam or ad sites. | Often only for visitors from Google or on mobile, so the owner does not notice. |
| Card skimmer | A script on the checkout page sends card details to the attacker. | A script from an unknown domain on the checkout page. |
| Cryptominer | A script that uses visitors’ CPUs to mine cryptocurrency. | Severe slowness and a hot device when the site is open. |
| Phishing pages | Pages imitating a bank or company to steal passwords. | A strange folder in your site, or an alert from your host or Google. |
| Spam mailer | Sends thousands of emails from your account. | High-sending alerts, or your mail landing in spam. |
| Defacement | Replaces the home page with the attacker’s message. | Immediately visible to every visitor. |

## How does it get in?

- An outdated plugin or theme with a known flaw.
- Nulled themes and plugins from unofficial sites.
- A weak or leaked dashboard or FTP password.
- An infected computer of the site owner that steals saved passwords.

## What to do if you find one

1. **Scan the whole site:** Run an [ImunifyAV](https://www.hyyat.com/en/knowledgebase/cxs-tool-from-configserver/) scan from cPanel; an infection is rarely a single file.
2. **Clean it or restore a clean backup:** Follow the steps to remove malware from WordPress, or restore a backup from before the infection.
3. **Close the way in:** Update everything, remove nulled copies and change every password.
4. **Remove warnings:** If a browser warning appears, follow [fixing the Google “dangerous site” warning](https://www.hyyat.com/en/knowledgebase/fix-google-dangerous-site-warning/).

## How Hyyat Host protects your site

- **ImunifyAV** scans files daily and detects known malware types.
- **Imunify360** and **ModSecurity** rules block attempts to upload malicious files and exploit flaws.
- **CloudLinux** isolates accounts, so an infection cannot spread from one site to another.

Learn more about [our malware detection service](https://www.hyyat.com/en/malware-detection/).

## Frequently asked questions

   Why can I not see the infection when I open my site?

Much malware hides from logged-in admins, or only shows to visitors from Google or on mobile. Scan the files rather than relying on how the site looks.

   Is deleting the infected file enough?

Rarely. Attackers leave more than one backdoor, and the cause stays open until you update and change passwords.

   Does an infection hurt my Google ranking?

Yes. Spam pages and redirects can trigger a Google warning and lower visibility, so cleaning quickly matters.

   **Related guides**

- [How to Tell if Your Website Is Hacked: 10 Signs and Quick Checks](https://www.hyyat.com/en/knowledgebase/signs-your-website-is-hacked/)
- [How to Fix the Google “Dangerous Site” or “Deceptive Site Ahead” Warning, Step by Step](https://www.hyyat.com/en/knowledgebase/fix-google-dangerous-site-warning/)
- [What Is a C99 Shell? How It Gets In and How to Find and Remove It](https://www.hyyat.com/en/knowledgebase/hacking-tools-c99-shell/)
- [How to Protect Your Website from Hacking: 10 Practical Steps](https://www.hyyat.com/en/knowledgebase/protect-website-from-hacking/)

[All website security guides →](https://www.hyyat.com/en/kb/website-protection/)

  **Need this service from Hyyat Host?**Our team handles it for you, with support replying to tickets within 24 hours at most.[Web Hosting](https://www.hyyat.com/en/hosting/)[Saudi Hosting](https://www.hyyat.com/en/saudi-hosting/)