Your Host Suspended Your Website for Malware. Here's How to Get It Back

An email arrives, usually early in the morning: your account has been suspended for malicious activity. The site is gone. Often the email is gone too. And the message rarely explains what was actually found.

When a host suspended your website, it feels punitive. It generally is not — they are protecting other customers on the same server, and their own reputation. Understanding that shapes how you get it lifted quickly.

Why they suspend rather than warn

Hosts act fast, and usually without notice, when a site starts affecting others:

• Sending spam — your account is exhausting mail quotas and getting the server's IP addresses blacklisted, which affects every customer on it
• Serving malware or phishing pages — the host risks their whole IP range being flagged
• Consuming excessive resources — crypto mining or acting as part of a botnet
• An abuse complaint from a third party or a security vendor

Spam is the most common trigger by some margin, and it is also the one people find most surprising — the site looks completely normal while the server quietly sends thousands of messages.

First: get the actual details

The suspension notice is usually vague. Before doing anything else, contact support and ask for specifics:

1. What exactly was detected — malware, spam, resource abuse, or an abuse report
2. The file paths of anything flagged
3. The timestamps of the activity
4. Whether you can have read-only or FTP access to clean it
5. Exactly what they require before lifting the suspension

That second point is the one worth pressing on. Most hosts run a scanner and have a list of flagged files. Getting that list turns a blind search into a targeted clean-up, and can save you a day.

Ask for the scan log. Support will often send it if asked directly, and it is the single most useful thing you can obtain in the first ten minutes.

Getting access to work on it

Suspensions vary. Some block public access but leave you FTP and control panel access. Others lock everything.

If you are fully locked out, ask for temporary access specifically to clean the site — most hosts grant it, because they want the problem resolved as much as you do. If they will not, ask them to provide a full backup you can clean elsewhere and restore.

Take a copy of the site as-is before changing anything, including the logs. You will need them to establish when the compromise started.

Clean it properly, not quickly

The temptation under pressure is to delete the flagged files and ask for reinstatement immediately. That fails often, and a second suspension is harder to lift than the first.

The flagged files are what the scanner found. They are rarely everything. A proper clean-up means replacing WordPress core, reinstalling every theme and plugin from official sources, cleaning the database, and finding the backdoor.

Our guide to removing malware from WordPress covers the full process. The backdoor step is what decides whether the suspension stays lifted.

Then close the entry point: change every password, regenerate the security keys in wp-config.php, update everything, and delete plugins you do not use.

What to send when you request reinstatement

How you write this genuinely affects how fast it moves. Support teams review a lot of these, and a specific, competent reply gets prioritised over a vague one.

Include what you found, what you removed, how you believe they got in, what you changed to prevent recurrence, and the scan results showing the site is now clean.

A reply along the lines of "we identified an outdated plugin as the entry point, removed the injected files and two backdoors in the uploads directory, cleaned the database, rotated all credentials and updated everything" gets acted on quickly. "We deleted the files, please unsuspend" tends not to.

The email problem

Frequently overlooked in the panic. If your email is hosted on the same account, a suspension takes it down too — and messages sent to you during that period may bounce permanently rather than queue.

This is why keeping email separate from web hosting is worth doing before you need it. A website outage is bad. A website outage that also silences your inbox, on the same day you need to communicate with customers, is considerably worse.

After you are back online

Three things remain.

Check your blacklist status. If the site was sending spam, your domain may be on mail blacklists. Request delisting from the major ones, or your legitimate email will keep landing in spam folders for weeks.

Check Google Search Console. A site suspended for malware has often been flagged by Google too. See our Search Console security guide.

Watch closely for a fortnight. Reinfection almost always happens in the first two weeks, and almost always means a backdoor was missed.

Should you change hosts?

The instinct after a suspension is to move. Sometimes that is right, often it is not.

Moving does not help if the compromise came from your own site — an outdated plugin follows you to the new host. It is worth considering if your host was unhelpful and gave no detail, if suspension came with no warning for a minor issue, or if you have reason to think the compromise originated on the shared server.

Do not migrate an infected site to a new host. You will simply be suspended somewhere else, having lost a day.

If you are suspended right now

Every hour costs you traffic, sales and possibly email. This is one of the situations where getting it right the first time matters more than getting it cheap — a failed reinstatement request costs more time than the clean-up did.

Our WordPress security and error fixing service handles suspensions regularly: we clean the site properly, find the backdoor, and write the reinstatement request in the form hosts respond to. There is a clean-or-free guarantee.

Once you are back up, our security monitoring service makes sure the next problem is caught in hours — well before a host notices.

Send us your web address and the suspension notice, and we will tell you what we can see.