> For the complete documentation index, see [llms.txt](https://docs.hostinger.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hostinger.com/websites/malware-scanner.md).

# Malware Scanner

Learn how Hostinger's Malware Scanner automatically checks website files for malicious code, how to read scan results in hPanel, and how to clean infections.

Automatic background scanning of your website files for malicious code, with reporting in hPanel. Included on Web and Cloud hosting plans.

## What it scans

* All files in `public_html` and subdirectories
* PHP, HTML, JavaScript, shell scripts, and other executable content
* Recently modified files (tracked by timestamp)
* Upload directories (a common infection vector for WordPress)

The scanner runs in the background — there's no schedule to configure and nothing to trigger manually.

## What it looks for

* Known malware signatures (backdoors, webshells, SEO-spam injectors, phishing kits)
* Obfuscated PHP (`eval(base64_decode(…))`, encoded payloads)
* Suspicious file modifications (e.g., core WordPress files changed outside an update)
* Unauthorized admin or cron entries that commonly drop when a site is compromised

## View scan results

1. Open your website dashboard in hPanel.
2. Click **Malware Scanner** in the sidebar.

The dashboard shows:

| Field                        | Meaning                                                    |
| ---------------------------- | ---------------------------------------------------------- |
| **Total discovered malware** | How many infected files were found in the most recent scan |
| **Actions taken**            | Files the scanner removed or cleaned automatically         |
| **Status**                   | Clean, infected, or partially cleaned                      |
| **Recent activity**          | Detection log over time                                    |

## If malware is detected

You have three options:

1. **Clean it yourself.** Restore the affected files manually — replace WordPress core files from a fresh download, reinstall plugins/themes from official sources, and remove any unfamiliar files in `public_html`.
2. **Restore from a clean backup** with a pre-infection timestamp. See [Backups](/websites/backups.md).
3. **Order a paid malware cleanup.** A one-time service where Hostinger's security team performs the cleanup for you. Offered for WordPress sites from the Malware Scanner panel in hPanel — availability and current pricing are shown there when you order.

> **Warning:** Before manually deleting a flagged file, verify it's not a legitimate plugin or theme file that was modified. Restore from [Backups](/websites/backups.md) if you're unsure.

## After a confirmed compromise

1. Restore the site from a clean backup (pre-infection timestamp).
2. Change all admin, FTP, SSH, and database passwords.
3. Update WordPress core, all plugins, and all themes.
4. Review [WordPress Security](/wordpress/security.md) and [IP Access Rules](/websites/ip-access-rules.md).
5. Rotate any API keys or tokens stored in `wp-config.php` or elsewhere on the server.

## Notes

* The scan database covers **files only** — it detects malicious files, not database-level infections (e.g. injected posts or options). For database cleanup, restore from a backup or clean manually.
* Scanning runs on the server; it doesn't slow down visitor-facing performance.
* Not every theme/plugin modification is malicious — the scanner uses heuristics that occasionally flag legitimate code. Review before deleting.

***

*Last updated: July 22, 2026*