Your host suspended your site for malware. What to do now.

A suspension is worse than a hack, because your site is not just compromised — it is gone, and often your email with it. It also comes with a deadline, since most hosts will not restore anything until they can see the problem is fixed.

Here is how to get back up in the shortest time without making it worse.

First, understand what has been suspended

Ask the host to confirm, because the answer changes what you can do:

• Website only — files intact, site offline, you can usually still access SFTP and cPanel
• Full account — email down too, and you may have no access at all
• Files quarantined — they have moved the malicious files somewhere you cannot reach

Also ask for the list of infected files they found. Almost every host will provide it, and it is the single most useful thing you can get. It tells you exactly what triggered the detection and usually points straight at the entry point.

Do not restore a backup

This is the reflex, and it is usually wrong.

Most infections sit dormant for weeks before doing anything visible. A backup from before the suspension almost certainly contains the same backdoor, and often the same vulnerable plugin. You will restore, get reinfected, and be suspended again — this time with a host who is less patient.

Restore only if you know precisely when the infection started and you have a backup from clearly before it, and even then, patch before putting it live.

Getting access back

If SFTP still works, you can clean in place. If not, most hosts will grant temporary access specifically for cleanup if you ask — say you are cleaning the infection and need access to do it. They want the problem solved as much as you do.

If they will not, you have two options: pay their cleanup service, which is typically $100–300 and usually a scanner run rather than a real investigation, or ask them to provide an archive of the account so you can clean it elsewhere.

Clean it, with the host's list as a shortcut

Work through the full recovery sequence, but start from their list of infected files. That tells you where to look first and often reveals the pattern immediately — if every file is in one plugin folder, you have found your entry point in ten seconds.

The essentials: replace core, plugins and themes with clean copies rather than editing; delete every PHP file in uploads; clean the database; remove unknown admin users and scheduled tasks; rotate every credential including the salts.

Ask for the review properly

Hosts respond much better to specifics than to reassurance. Reply with:

• What you found, referencing their file list
• How it got in — name the plugin and version if you know
• What you replaced or deleted
• Which credentials you rotated
• What you changed so it does not recur

A message like that usually gets an account restored within hours. "I have cleaned it, please restore" often does not, because they have no way to judge whether it is true.

Once you are back

Two things, immediately:

Check Google. A suspension often follows a Safe Browsing flag, which is a separate problem with its own review process. Being back online with a red warning in search is only half a recovery.

Sort out backups. If you were relying on your host's, you have just learned the limitation: host backups live on the same infrastructure, and a suspended account often means you cannot reach them. Off-site, daily, tested.

Should you change host?

Not automatically. A host that detects malware and tells you is doing its job, even though it does not feel like it.

Change if the same account is repeatedly compromised through no fault of your site, if their PHP version is years out of date, or if they refused you access to clean your own files. Otherwise the suspension was the symptom, not the cause.

If you want this handled rather than handled by you, our cleanup is $249 within 24 hours and includes writing the reply to your host — which in a suspension is often the step that actually determines how fast you are back online.