> For the complete documentation index, see [llms.txt](https://docs.hostinger.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hostinger.com/websites/malware-scanner.md).

# Malware Scanner

Automatic background scanning of your website files for malicious code, with reporting in hPanel. Included on Web and Cloud hosting plans.

## What it scans

* All files in `public_html` and subdirectories
* PHP, HTML, JavaScript, shell scripts, and other executable content
* Recently modified files (tracked by timestamp)
* Upload directories (a common infection vector for WordPress)

The scanner runs in the background — there's no schedule to configure and nothing to trigger manually.

## What it looks for

* Known malware signatures (backdoors, webshells, SEO-spam injectors, phishing kits)
* Obfuscated PHP (`eval(base64_decode(…))`, encoded payloads)
* Suspicious file modifications (e.g., core WordPress files changed outside an update)
* Unauthorized admin or cron entries that commonly drop when a site is compromised

## View scan results

1. Open your website dashboard in hPanel.
2. Click **Malware Scanner** in the sidebar.

The dashboard shows:

| Field                        | Meaning                                                    |
| ---------------------------- | ---------------------------------------------------------- |
| **Total discovered malware** | How many infected files were found in the most recent scan |
| **Actions taken**            | Files the scanner removed or cleaned automatically         |
| **Status**                   | Clean, infected, or partially cleaned                      |
| **Recent activity**          | Detection log over time                                    |

## If malware is detected

You have three options:

1. **Clean it yourself.** Restore the affected files manually — replace WordPress core files from a fresh download, reinstall plugins/themes from official sources, and remove any unfamiliar files in `public_html`.
2. **Restore from a clean backup** with a pre-infection timestamp. See [Backups](/websites/backups.md).
3. **Order a paid malware cleanup.** A one-time service where Hostinger's security team performs the cleanup for you. Offered for WordPress sites from the Malware Scanner panel in hPanel — availability and current pricing are shown there when you order.

> **Warning:** Before manually deleting a flagged file, verify it's not a legitimate plugin or theme file that was modified. Restore from [Backups](/websites/backups.md) if you're unsure.

## After a confirmed compromise

1. Restore the site from a clean backup (pre-infection timestamp).
2. Change all admin, FTP, SSH, and database passwords.
3. Update WordPress core, all plugins, and all themes.
4. Review [WordPress Security](/wordpress/security.md) and [IP Access Rules](/websites/ip-access-rules.md).
5. Rotate any API keys or tokens stored in `wp-config.php` or elsewhere on the server.

## Notes

* The scan database covers **files only** — it detects malicious files, not database-level infections (e.g. injected posts or options). For database cleanup, restore from a backup or clean manually.
* Scanning runs on the server; it doesn't slow down visitor-facing performance.
* Not every theme/plugin modification is malicious — the scanner uses heuristics that occasionally flag legitimate code. Review before deleting.

***

*Last updated: July 22, 2026*