Antivirus reports a virus on your site: what it means and what to do
PrintIn short: when your antivirus blocks your own website, someone has most likely added harmful code to its pages (a hidden script, a redirect, an infected download). In rare cases it is a false alarm, or the problem sits on your computer rather than on the site. First find out which of these it is, then clean the site and close the way in. Do not ignore the warning: visitors see the same thing.
First, find out where the problem is
- Read the warning carefully. Write down the name of the threat and the exact address that was blocked. Sometimes it is not your domain but a third-party script the page loads (an ad network, a counter, a chat widget). Then the fix is to remove that script from the site.
- Open the site from another device and network, for example a phone on mobile data. Some injected code shows itself only to visitors coming from Google or from phones, so also try opening the site from a Google search result.
- Check the site with independent scanners: VirusTotal (URL tab) runs the address through dozens of antivirus engines, and Sucuri SiteCheck looks for known injections and blocklist entries. Keep in mind that these tools see only what the public pages show; a hidden back door in the files stays invisible to them.
- Look at the server scan. In cPanel, open Security, then Imunify360. If files were flagged, you will see their paths there. If you received a notice from us, follow what to do after an Imunify notice.
| What you found | What it usually means |
|---|---|
| Only one antivirus complains, all scanners and Imunify360 are clean | Probably a false alarm. Report the address to that antivirus vendor through its false-positive form. |
| The warning appears on every site you open, not only yours | The problem is on your computer or in the browser (an extension, malware). Scan the computer first. |
| Several engines flag the site or Imunify360 lists files | The site is infected. Go on with the steps below. |
How the code usually gets in
- A stolen password. Malware on a computer used for FTP or cPanel reads saved passwords and sends them to the attacker, who then edits the site with a perfectly valid login. That is why the computer comes first in the clean-up.
- An outdated plugin, theme or CMS with a known security flaw, which bots look for automatically.
- A "free" copy of a paid theme or plugin downloaded from an unofficial site. These often come with a back door already built in.
- A weak or reused password for the site's admin area.
What to do, in order
- Run a full antivirus scan on every computer and phone used to manage the site, cPanel or FTP.
- From a clean device, change the passwords of the client area, cPanel, all FTP accounts, the database users and the site's administrators. In your FTP program (such as FileZilla), remove saved passwords or protect them with a master password.
- Find and remove the malicious code using the step-by-step check in cPanel. If you know roughly when the problem began, restoring a copy from before that date is often faster: see restoring files with JetBackup 5.
- Update the CMS, plugins and themes, and delete the ones you do not use. For WordPress, use WP Toolkit in cPanel first; the WordPress dashboard is the alternative.
- If browsers or Google also flagged the site, ask for a review once it is clean: removing the browser warning.
The full sequence for a compromised site, including what to keep as evidence and which back doors to look for, is in the first steps after a site is hacked.
Frequently asked questions
Is the TopHost server infected?
Almost never. Each hosting account is isolated, and the server is scanned by Imunify360. What antivirus programs find is code inside the files or database of one site, which the site owner has to clean. Under the Terms, if we notify you about malicious files, you have 24 hours to clean them and let us know.
Should I take the site offline while I clean it?
If visitors are being redirected to other sites or offered infected downloads, yes: a short maintenance page is better than infecting your customers. For a WordPress site, the maintenance mode in WP Toolkit does this in one click.
Can you help?
Yes. Open a support ticket with the site address, the exact antivirus message and what you have already checked. We will tell you what the server scan found and help restore a backup. Repairing the site's own code remains a job for you or your developer.
