Guide · Host suspensions · Bluehost
When Bluehost’s scan finds malware, the affected website is suspended to protect other customers, and visitors see a page that says “This account has been suspended.” Sometimes only one folder is suspended rather than the whole account. Bluehost writes what it found into a file in the site’s root, and expects you to clean it, with its own tools or someone else’s, before support reinstates the site. This guide covers each step from Bluehost’s published help pages, and the part that catches people out: Bluehost does not provide backups to suspended accounts.
Published Last reviewed
What Bluehost does
Bluehost’s suspension article says the affected website will be suspended when malware is found, and that the owner can resolve the issue or move to dedicated hosting. In some cases only a specific directory is suspended instead of the whole account, so part of a site can stop working while the rest still loads. Its malware FAQ explains the reason: the suspension protects other customers on the same servers.
Visitors to a suspended account see “This account has been suspended.” The page carries a login link; signed in, the owner sees the reason and Bluehost’s instructions. A malware warning banner also appears in the Bluehost Portal, and Bluehost emails the account; check the spam folder if nothing has arrived.
Where to look
Bluehost writes the scan result to one of these files in the site’s root folder. Each entry gives the malware type, the file path, the detection time and the threat level. Open it from Portal › Hosting › My Plans › File Manager, with hidden files shown.
Under Security › Malware Protection › Manage, or Websites › Manage Site › Security. Its Antivirus list shows each file with its status, quarantined or cleaned, and its type.
The files the scan matched, and Bluehost’s scan can rename or quarantine them. It does not show how the attacker got in, and on most plans it does not cover the database.
Getting reinstated
Figure 1 · Getting a Bluehost site back
Read malware.txt, clean past it, then ask Bluehost to verify.
Understand it
Fix, then verify
Bluehost does not provide backups to suspended accounts unless agreed in writing, and its scan can rename or quarantine files. Download the site files and a database export if File Manager or SFTP still works, and keep malware.txt.
Bluehost’s instruction is to use Bluehost Malware Protection to scan, clean and fix the infected files. Malware Scan & Clean is included with the Starter plan and AI Malware Defense, which adds a web application firewall, with Business and above. Full WordPress database scanning and cleanup by a person is in the paid Complete Security tier; Bluehost’s own pages quote different prices for it. Its older SiteLock article is blunter: Bluehost support does not remove malware, and removal is paid.
On plans without database scanning, the injected scripts in options and posts, the administrator accounts nobody created, must-use plugins, scheduled tasks, and the vulnerable plugin or reused password that let the attacker in. Change every password from a clean device and turn on two-factor authentication.
By chat around the clock, or by phone in Bluehost’s published hours. Bluehost’s blog says security suspensions may need the provider to verify the remediation before reinstating; it gives no timeline for malware cases.
What Bluehost’s pages leave open
Read on 5 November 2026 from Bluehost’s help centre and blog. SiteLock appears in some of Bluehost’s older help articles; its current product pages describe Bluehost Malware Protection instead, so the SiteLock detail is treated here as legacy.
Common questions
Bluehost found malware, or another policy issue, and suspended the site to protect other customers. The page has a login link; signed in, you see the reason and the instructions. For malware, the details are in malware.txt or scanreport.txt in the site’s root folder.
Bluehost Malware Protection scans and cleans files on every plan, with more on higher ones. Database scanning and cleanup by a person are in its paid Complete Security tier, and its older SiteLock article says support does not remove malware itself. Whatever tool you use, the database, rogue administrators and the way in still need checking.
Not while the account is suspended, unless agreed in writing. Its courtesy backups also overwrite each other weekly, so the copy may already be infected. A backup you made yourself, from before the infection, is the one to rely on.
Bluehost sometimes suspends a single directory instead of the whole account. The infection that put malware in that folder could have written elsewhere too; check the whole site and every other site in the account before treating the rest as clean.
Bluehost does not publish a timeline for malware cases. Its blog says security suspensions may need it to verify the remediation, so the realistic route is to clean thoroughly once and contact support with what was found and changed.