Malicious Code on the Site: How to Understand That You Have Been Infected
‘The site is infected’ means that foreign code has appeared on it: in files, in the database, or in the template. It works quietly and usually not for you, but for visitors and search robots — showing them what you did not publish.
Analogy for the Site Owner
It’s like an outsider has settled in the store's storeroom. He does not break the showcase — it’s not in his interest for you to notice. He quietly uses your address and makes a duplicate key to return after you change the lock. Therefore, cleaning without searching for the entry point usually ends in reinfection.
Signs Visible from the Outside
| What You Notice | What Usually Lies Behind It |
|---|---|
| A search result redirects to a foreign site, but a direct visit does not | Conditional redirect based on the source of the transition |
| In the search results, your pages have foreign titles — pharmacies, casinos | Cloaking: the robot is given a different page than the human |
| Sharp drop in traffic without changes in positions | Browser warning 'the site may be harmful' upon entry |
| Emails from the domain are massively going to spam | The domain has been blacklisted due to spamming |
| New files and admins that you did not create | Backdoor and account for re-entry |
Search engines mark such sites, reduce trust in the domain, and remove infected pages from the index; with spam injections, manual sanctions may also occur. Restoring positions takes weeks: first, search engines and reputation services must confirm that the site is clean.
How It Looks in the Security Shield Report
If at least one sign of infection is found, the report starts not with an assessment, but with the verdict 'Infected' — a red traffic light level. From the outside, the scanner sees obfuscated JavaScript, mining scripts, invisible frames, interception of form fields, hidden spam links, signs of cloaking and redirects, as well as domains in blacklists.
Part of the infection is fundamentally not visible from the outside: web shell in a file, modified core files of the CMS, PHP file in the uploads directory, rules in .htaccess, code in the database, foreign administrator. This is found by an optional server agent — a script that you place on your hosting. More details can be found in the article about Security Shield.
Removing found files is not enough: if the entry point remains, the code will return in hours. Look not only for the file itself but also for how it got in — outdated plugin, stolen FTP password, foreign site on the same hosting account.
What to Do Step by Step
- Make a copy 'as is'. Files and the database in their current form are both evidence and insurance in case of unsuccessful cleaning.
- Find the modified. Sort files by modification date and compare the CMS core and plugins with official versions.
- Restore clean versions. Reinstall the core and extensions over the top, clean the template and uploads selectively.
- Update the CMS, theme, and plugins, remove unused ones and those that have fallen out of the official catalog.
- Change all passwords and keys: admins, database, FTP and SSH, hosting panel, email. Check administrators and scheduled tasks.
- Run a rescan — the verdict should change, and findings with signs of infection should disappear.
- Submit a reconsideration request to reputation services and in the webmaster panel — the mark does not get removed by itself.
How to Prevent Reinfection
Updates and a minimum number of plugins provide more than a paid 'antivirus for the site'. Keep file permissions strict, prohibit PHP execution in the uploads directory, and enable two-factor protection for the admin panel. After cleaning, check pages through SEO audit, and for publications — indexing.