In shortWebsite malware is not one thing. Some is a backdoor that gives the attacker lasting control, some publishes spam pages to boost other sites in Google, some redirects your visitors to scams, steals card details or sends spam. Knowing the type helps you spot it quickly and choose how to clean it.
The most common types #
| Type | What it does | Sign |
|---|---|---|
| Backdoor and web shell | Gives the attacker lasting access even after passwords change. Read C99 shell. | Strange PHP files, especially in the uploads folder. |
| SEO spam | Creates thousands of pages or hidden links for pills, casinos or fake goods. | Odd results when you search site: for your domain in Google. |
| Malicious redirect | Sends some visitors to scam or ad sites. | Often only for visitors from Google or on mobile, so the owner does not notice. |
| Card skimmer | A script on the checkout page sends card details to the attacker. | A script from an unknown domain on the checkout page. |
| Cryptominer | A script that uses visitors’ CPUs to mine cryptocurrency. | Severe slowness and a hot device when the site is open. |
| Phishing pages | Pages imitating a bank or company to steal passwords. | A strange folder in your site, or an alert from your host or Google. |
| Spam mailer | Sends thousands of emails from your account. | High-sending alerts, or your mail landing in spam. |
| Defacement | Replaces the home page with the attacker’s message. | Immediately visible to every visitor. |
How does it get in? #
- An outdated plugin or theme with a known flaw.
- Nulled themes and plugins from unofficial sites.
- A weak or leaked dashboard or FTP password.
- An infected computer of the site owner that steals saved passwords.
What to do if you find one #
- Scan the whole site: Run an ImunifyAV scan from cPanel; an infection is rarely a single file.
- Clean it or restore a clean backup: Follow the steps to remove malware from WordPress, or restore a backup from before the infection.
- Close the way in: Update everything, remove nulled copies and change every password.
- Remove warnings: If a browser warning appears, follow fixing the Google “dangerous site” warning.
How Hyyat Host protects your site #
- ImunifyAV scans files daily and detects known malware types.
- Imunify360 and ModSecurity rules block attempts to upload malicious files and exploit flaws.
- CloudLinux isolates accounts, so an infection cannot spread from one site to another.
Learn more about our malware detection service.
Frequently asked questions #
Why can I not see the infection when I open my site?
Much malware hides from logged-in admins, or only shows to visitors from Google or on mobile. Scan the files rather than relying on how the site looks.
Is deleting the infected file enough?
Rarely. Attackers leave more than one backdoor, and the cause stays open until you update and change passwords.
Does an infection hurt my Google ranking?
Yes. Spam pages and redirects can trigger a Google warning and lower visibility, so cleaning quickly matters.
