Hardening Reference
Malware — Finding injected code before your rankings find it for you
Something on the account is spending CPU on work you never asked for, and search results noticed before you did.
The short answer
Website malware is executable code running under your account that you did not put there — spam page generators, conditional redirects, phishing forms and, always, at least one back door to let the intruder return.
It behaves like any other workload, which is the useful part: it burns CPU, opens database connections and slows uncached responses. Plenty of infections are noticed first as a performance complaint and only later as a security incident.
By the HostingFast team · Reviewed 24 August 2026
0
Hand-waving in this entry
100+
Entries wired to each other
Real
Numbers you can reproduce
Free
To read, no gate
It arrives through an unpatched component or a reused password, then converts your domain's reputation into money for somebody else. Injected pages appear in search results, visitors get thrown to scam destinations, and a quiet second entry point makes sure the cleanup you are about to do does not stick.
Detection has to be layered, because the code actively hides from anything running inside the application it has already compromised. A scanner at server level sees the file that WordPress itself has been persuaded to ignore. On plans here that is ImunifyAV+, sweeping every site on the account rather than trusting a plugin to audit its own neighbours.
The first symptom is usually a number
Uncached response times drift upward. PHP workers stay busy at hours with no traffic. The database sees queries nobody wrote. Outbound mail volume climbs. None of that names an infection on its own, but all of it is measurable, and all of it moves before anyone reports a redirect.
That is why performance monitoring doubles as an early warning system. If you have a baseline for uncached time to first byte on a quiet morning, a compromise shows up as a deviation from it days before Search Console gets round to telling you.
Three passes that narrow it down
First, timestamps. Listing files modified in the last week over SSH surfaces the injection immediately on a site that only changes when you deploy. Second, checksums: WordPress can verify core files against the official hashes, and anything that fails is either modified or does not belong. Third, content — grep the tree for the small vocabulary of obfuscation, eval on decoded strings, gzinflate wrappers, long base64 blobs sitting in a theme file.
None of the three is conclusive alone and together they are usually enough to find the entry point. Note what they cost: a few minutes over SSH, which is available on every plan here alongside Git and Composer.
Why one deleted file is never the whole job
Persistence is the point. Expect a second copy in an uploads directory, an addition to a must-use plugin, a scheduled task recreating the file after you remove it, an unfamiliar administrator account and possibly an SSH key you did not add. Deleting the visible file and declaring victory is the single most common way an infection returns within the week.
So the order matters: restore from a backup taken before the first sign of trouble, then patch what let them in, then rotate every credential the account touches, including database passwords and any API keys stored in configuration.
What the platform does and does not do for you
Server-level scanning runs on every account and daily backups give you a clean point to return to, restorable from the panel in a click rather than through a support ticket. WordPress Toolkit will keep core and plugins updated, which closes the route most infections actually take.
What no platform can do is choose your plugins or your passwords for you. Related entries worth reading next: WAF, Brute-Force Attack, Backup and Phishing.
A reference that assumes you have a terminal open
These entries are written for someone who can act on the answer. Where a command settles the question, the command is in the text rather than in a support article three clicks away.
Daily backups run on every plan and a restore is a click in the panel, which is the difference between a bad morning and a bad week.
- Commands over reassurance
- Written for people with SSH access
- Linked to the terms either side
- Kept current by the support team
Why HostingFast
Standard on every plan
Malware as a workload
It costs CPU, workers and response time, which means your monitoring can find it before your rankings do.
Three passes, in order
Timestamps, core checksums, then obfuscation strings — the sequence that finds the entry point fastest.
Persistence, named
Second copies, must-use plugins, scheduled tasks and unfamiliar admin users are where reinfection lives.
Restore, patch, rotate
The order matters. Cleaning before patching just resets the clock on the same compromise.
Server-level scanning explained
Why a scanner outside the application sees what a plugin inside it has been persuaded to miss.
Neighbours mapped
WAF, Brute-Force Attack and Backup are the three entries that complete this one.
Quick Start
From order to online
- 1
Take a baseline while things are calm
Record uncached response time and worker activity on an ordinary morning. Without it you cannot tell a compromise from a busy week.
- 2
Hunt by timestamp first
List everything modified since your last deploy. On a site that only changes when you change it, the injection is usually in that list.
- 3
Restore, then patch, then rotate
Return to a known-clean backup, close the route in, and change every credential the account touches. Doing those in the wrong order buys you a repeat.
Built In
Loaded onto every plan
- Spam and virus screening on every mailbox as standard
- SSH, Git and Composer on the developer-focused plans
- LiteSpeed caching built into the server rather than patched in by plugin
- 99.9% uptime as the target, monitored around the clock
- Your existing site moved over by our engineers, free of charge
- WordPress and 400+ other applications installed in one click
- A renewal price identical to the price you signed up at
- Zero setup charges — there is no joining fee, ever
- Year one of your domain free when you order annually
- Money-back cover: 30 days on hosting plans, 7 on reseller
Frequently Asked
What people ask us most often
Can I find an infection without a scanner?
Usually. Start with files modified since your last deploy, then verify core files against their published checksums, then search the tree for obfuscation markers such as eval on a decoded string or a long base64 blob inside a theme. What you cannot do by hand is prove the absence of anything, which is why a server-level scan still belongs in the process.
Would malware show up as a speed problem?
Frequently, and it is the earliest signal most people have. Injected code runs on requests, so uncached time to first byte drifts, workers stay busy at quiet hours and outbound mail climbs. If your response times moved without a deploy to explain them, an infection belongs on the list of suspects alongside a slow plugin.
What does the scanner on my account actually sweep?
ImunifyAV+ runs at server level across every site on the account, which means it inspects files the compromised application itself might be hiding. It is not a substitute for updating; it is the layer that catches what got in before you updated. Secure Hosting adds Imunify360 on top for accounts that want the full protection stack.
How far back do backups go, and can I restore one file?
Backups run daily on every plan and restores are self-service from the panel, file or database, without opening a ticket. Take your own copy as well before you start cleaning — you want the compromised state preserved for comparison, not overwritten by the next scheduled run.
Keep reading
Brute-Force Attack
Credential guessing at machine speed, and why it shows up as a speed complaint first.
Backup
Daily copies, self-service restores, and the point in a cleanup where they matter most.
How to Scan a Site for Malware
The hunt in order: what to list, what to verify, what to grep for.
Mail Filtering
Spam and virus screening in front of any mailbox, wherever that mailbox is hosted.
VPS Hosting
KVM virtual servers with root access, edge filtering and one flat monthly price.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
Get it clean, then keep it patched.
Daily backups, server-level scanning, free migration and support that answers technical questions properly.
View Mail Filtering plans