Malware scanning: what we check and what happens if something is found

Every website is scanned automatically every night, and you can run a scan yourself at any time with Scan now in the Security section. The scan looks for known malware, hidden back doors and suspicious files such as PHP code hidden in an uploads folder.

What happens if something is found

1. We review it first. Your website stays online while our team checks whether it is genuine, because some plugins do unusual things legitimately.
2. If it is a false alarm we mark the file safe and you hear nothing.
3. If it is real your website is paused to protect your visitors and other customers, and we email you with the list of files.
4. You clean up. You can delete the files from Files in the control panel. A paused website lets you delete and rename files, but not upload new ones.
5. You press Scan now in Security. If a complete scan finds nothing, the website comes back by itself.

If you would rather we do the clean-up, choose Request clean-up and we will contact you. This may be a paid service.

What a scan cannot do

A clean result is good evidence, not a guarantee. A scan cannot spot malware that only exists inside the database, or brand-new malware nobody has seen yet. Keeping WordPress, plugins and passwords up to date remains the best protection.

See also Keep your WordPress site secure.