Malware & your website explained

Malware, short for malicious software, is code that an attacker places on your website without your permission. It can do many things: redirect your visitors, display ads, steal customer data, or turn your site into a spam sender. Most website owners have no idea it's there until something goes visibly wrong.

In short

On every platform, malware can get in through a stolen login. On WordPress, outdated or vulnerable plugins and themes are the other main route; on Squarespace, Shopify, Webflow and Wix, the other route the platforms warn about is third-party code or apps added to your site. Signs include unexpected redirects, security warnings from Google, new pages you didn't create, or a sudden slowdown. On WordPress, removal requires a full scan and clean, not just deleting what you can find visually. On a hosted platform, it means securing the account and removing code, apps and users you didn't add. On a custom-coded site, your developer checks the code history and recent deploys and fixes whatever let the attacker in. Prevention is mostly about strong passwords, two-factor authentication, and keeping what you're responsible for up to date.

How malware gets onto websites

Stolen or weak credentials

If an attacker gets your website login (through phishing, a data breach at another site, or by guessing), they can simply log in and add malware themselves. This applies to every platform: a WordPress admin password, or your Squarespace, Shopify, Webflow or Wix account.

Strong, unique passwords and two-factor authentication prevent this. Protect the email account you log in with too, since it can reset your other passwords.

Untrusted plugins, themes, apps or code

Adding software or code from a source you can't vouch for is a direct path to malware.

On WordPress: installing plugins or themes from untrusted sources, unofficial websites, or pirated ("nulled") versions is the risk. Only install plugins from the official WordPress repository or from reputable commercial developers.
On Squarespace: there are no plugins, but custom code is a route in. Squarespace says Google flags sites for suspicious code, phishing or unauthorized changes, including custom code added from an unverified third party.
On Shopify: be cautious about the permissions each app requests. Some apps add code to your theme that isn't removed automatically when you uninstall them. See Shopify apps explained.
On Webflow and Wix: only add custom code, embeds and apps you trust.

Outdated or vulnerable software

This is a WordPress (and self-hosted) risk. On Squarespace, Shopify, Webflow and Wix, the platform runs and secures its own software. On a custom-coded site, keeping the code up to date is your developer's job.

On WordPress, this is one of the two most common routes in: password guessing is the other. When a vulnerability is discovered in a WordPress plugin or theme, attackers write automated tools to exploit it, and sites still running the unpatched version get found by those tools. WordPress's own hardening guide puts this first of the two: attackers "sending specially-crafted HTTP requests to your server with specific exploit payloads for specific vulnerabilities. These include old/outdated plugins and software."

Keeping WordPress, themes, and plugins up to date is the most effective way to close this route.

Infected hosting environment

This applies to sites on shared hosting, such as many WordPress sites. On shared hosting, a compromised neighboring website on the same server can sometimes lead to yours being compromised too. Managed WordPress hosting, which keeps sites more isolated from each other, reduces this risk. On Squarespace, Shopify, Webflow and Wix, the platform provides and secures the hosting.

What malware does on your site

Type	What it does
Redirects	Sends your visitors to spam, scam, or adult websites
SEO spam	Adds hidden links to your pages to boost the attacker's rankings
Spam email sender	Uses your server to send bulk spam, harming your email reputation
Credential harvesting	Captures login information from your own visitors
Cryptomining	Uses your visitors' computers to mine cryptocurrency
Backdoor	A hidden access point that lets the attacker return even after you change passwords
Defacement	Replaces your homepage with the attacker's message
Ransomware	Encrypts your files and demands payment to unlock them

Spam sending and ransomware, as described here, work on a site's own server and files, so they mainly concern WordPress and other self-hosted sites.

Signs your site may have malware

Visitors report being redirected to other sites
Google Search Console shows a security warning
Your browser or antivirus shows a warning when visiting your own site
You see pages, posts, or links you didn't create
You find code, embeds or apps on your site that you didn't add
Your hosting provider sent an alert or suspended your account (if you pay a separate host)
Sudden significant drop in search traffic
The site runs much slower than usual
You notice unfamiliar users with access to your site, such as admin accounts in WordPress or contributors, staff or collaborators on a hosted platform

Troubleshooter

What should you do next?

Are you seeing any of the signs above?

How malware is removed

How removal works depends on your platform.

On Squarespace, Shopify, Webflow and Wix

The platform secures its own software and servers, so there are no server files for you to scan. Removal is about your account and what has been added to your site:

Lock down the account: change your email password, then your platform password, sign out other sessions where your platform offers it, and turn on two-factor authentication.
Remove code you didn't add. On Squarespace, check code blocks, Code Injection and Custom CSS, and copy anything suspicious into a document first: deleted code there can't be restored. On Shopify, the code editor's Timeline view can restore individual theme files to an earlier version. On Webflow, content editors can't add custom code, so look at who has more access than a content editor.
Uninstall apps you don't recognize, and on Shopify check for code the app left behind in your theme.
Remove users you don't recognize.
Restore an earlier version only where your platform allows it, and know its limits.

Recovering from a hacked website has the details for each platform.

On a custom-coded site

Your developer checks the code history and recent deploys, puts a known-good version back live, and fixes whatever let the attacker in. A rollback doesn't undo changes to your database. Any password or key that may have been exposed has to be replaced, because deleting it from the code doesn't remove it from the code history. See environment variables and secrets.

On WordPress

Don't try to clean manually without expertise

Malware often places copies of itself in multiple locations and installs backdoors so it can return. Deleting visible files without a full scan almost never works: the site gets reinfected within days.

There are two reliable approaches:

Option 1: Restore from a clean backup Contact us before restoring, and screenshot and note what changed first. If you have a backup from before the malware was installed, restoring it is often the cleanest solution. You lose any content changes made since the backup. Check the restored site is clean before it goes live, because a backup made after the attacker got in can be infected too. See How backups work.

Option 2: Professional malware removal Sucuri and Wordfence both offer this. Sucuri includes malware removal in all of its platform plans and says it removes malicious code from your files and database and works on getting you off search engine blocklists. On Wordfence's side, its Care plan includes hands-on support with security incidents, and its Response plan adds 24/7 support from Wordfence's incident response team. This is what we recommend when no clean backup is available.

After cleanup, on any platform, you must:

Update what you're responsible for: on WordPress, WordPress itself, all plugins, and all themes; on Shopify, your Theme Store theme if an update is available
Change all passwords (on WordPress: WordPress admin, hosting, FTP/SFTP, database; on a hosted platform: your platform account and your email)
Remove user accounts you didn't create
Address the vulnerability that allowed the infection

Preventing malware

For every website

Use strong passwords and 2FA on every account that can change your site, and on the email account behind it. See two-factor authentication
Only add code and apps you trust: custom code from an unverified third party is one of the things Squarespace says gets sites flagged by Google, and Shopify asks you to be cautious about the permissions each app requests
Remove apps and code you don't use: on Shopify, check whether an app needs extra uninstall steps, since some leave code in your theme
Keep a copy you can get back: what that looks like depends on your platform. See How backups work

On WordPress

The most effective prevention steps, in order of importance:

Keep everything updated: WordPress core, plugins, and themes
Use strong passwords and 2FA on all WordPress admin accounts and your hosting account
Remove plugins and themes you don't use: WordPress's hardening guide is direct about it: "if you are not using a specific plugin, delete it from the system." Deactivating leaves the files on your server
Install only from reputable sources: WordPress's guidance is to "restrict yourself to the WordPress.org repository or well known companies"
Use a security plugin: Wordfence adds a firewall plus a malware scanner that checks core files, themes, and plugins for malware, backdoors, SEO spam, and malicious redirects. Kadence Security (the plugin previously called Solid Security, and iThemes Security before that) adds login protection, firewall rules, and scanning for known vulnerabilities
Maintain backups: so recovery is fast if something does get through
Use good hosting: many managed WordPress hosts will scan your site for malware and help you clean it

Common questions

My site looked fine: how did I not notice sooner?

Much malware is specifically designed to be invisible to the site owner. It may only show redirects to visitors who came from search engines, or only on mobile, or only on first visit. Attackers want to remain hidden as long as possible.

Can visitors get malware from visiting my infected site?

Some types of malware attempt to install malicious code on visitors' devices. This is called a drive-by download. Modern browsers and antivirus software catch many of these, but not all. This is why it's important to take your site offline if you know it's infected, and to address it urgently. On WordPress that usually means maintenance mode; other platforms each have their own switch, listed in the first 30 minutes of hacked-site recovery.

Will my SEO recover after cleaning?

Once the malware is removed and Google completes a review, rankings generally recover. When you have confirmed the problem is fixed, request a security review in the Security Issues report in Google Search Console. Google says that review "can take from a few days to a few weeks to complete", so the faster you clean the site, the sooner that clock starts. On Squarespace, note that Squarespace can't remove Google's warnings itself, and Search Console is outside the scope of its support.

What is a 'nulled' plugin and why is it dangerous?

A nulled plugin is a premium (paid) WordPress plugin that someone has distributed for free, often with the license check removed. These frequently contain malware planted by whoever redistributed them. Never install nulled plugins or themes.