If your site is redirecting to spam, showing unexpected content or flagged by Google, it may be infected. Act quickly.
1. Take a backup
Take a backup of the current state (even infected) so nothing is lost while cleaning.
2. Scan
- In cPanel, run a scan with ImunifyAV (or the virus scanner provided) to find infected files.
- In WordPress Management, use Check WordPress Integrity to compare core files against the originals and restore modified ones.
3. Clean up
- Reinstall WordPress core, and all plugins and themes from fresh copies
- Delete plugins and themes you don't use
- Look in wp-content/uploads for .php files; there shouldn't be any
- Look for unfamiliar admin users and remove them
- Search for suspicious code such as
eval(,base64_decode(or long blocks of random characters
4. Lock it down
- Change all passwords: WordPress users, cPanel, FTP, database and email
- Update everything and turn on auto-updates
- Install a security plugin and enable 2FA for admins
If it's easier, restore a clean backup from before the infection with JetBackup, then update and change passwords. Raise a ticket if you need help.
