Guide · Hosting suspension
Your host suspended the site for malware. Here is how to get it back — and keep it.
The site is down, visitors see a suspension page, and the hosting provider’s email lists infected files and asks you to “clean the account and reply”. Deleting the listed files and replying is the fastest way to be reinstated — and the most common way to be suspended again a week later, sometimes with the account terminated. This guide explains what the host actually knows, what to ask them for, and the sequence that gets a suspension lifted once.
Published Last reviewed
- Symptom
- Suspension page, host email listing infected files, account access limited
- What the host saw
- A scanner hit, outbound spam, abuse reports, or resource abuse
- First step
- Get the scan report and a full copy of the account before changing anything
- Risk
- Re-suspension, account termination, blacklisting, and loss of evidence
What is happening
A suspension is the host protecting its server, not diagnosing your site
Shared and managed hosts suspend accounts when their own systems — usually ImunifyAV, a mail-abuse monitor, or an abuse-report queue — decide the account is a risk to the server or the IP reputation. The notice lists what tripped the alarm: a set of flagged file paths, spam volume, phishing pages, or CPU abuse. That list is evidence of a symptom. It is not a list of everything that is wrong.
Most hosts do not investigate further, and most will not clean the site for you (some will offer a paid partner service). Their reinstatement condition is usually “the account no longer trips our scanner”, which is a much lower bar than “the site is clean and the entry path is closed”. Meeting the lower bar and stopping there is how people end up suspended twice.
The good news: a suspension usually preserves evidence. The files are still there, the logs are still there, and the host has a scan report. Use that before it disappears.
What to ask the host
Get the evidence while the account is frozen
- 01
Request the full scan report
Ask for the complete list of flagged paths with detection names and timestamps, not the summary in the email. Ask which scanner produced it and whether files were quarantined or left in place.
- 02
Ask what else they observed
Outbound mail volume, abuse reports, unusual processes or cron activity, and the date the account first showed signs. Hosts often know more than the notice says.
- 03
Request read access, not a reset
Ask for SFTP or file-manager access to the suspended account without changing anything. If they insist on a reset first, ask them to snapshot the account before the reset.
- 04
Pull a complete copy
Download the entire account — every directory, not just public_html — plus a database export and any logs you can reach. Keep it as evidence and as the source for the investigation.
- 05
Ask about their reinstatement criteria and timeline
Know exactly what they will check before reactivating and how many strikes remain before termination. Ask whether a temporary reactivation for cleanup is possible with the site in maintenance mode.
Why quick fixes fail
The listed files are the output, not the infection
A scanner flags what it recognises: known web shells, obfuscated PHP, injected JavaScript. It does not flag the vulnerable plugin that admitted the attacker, the rogue administrator account, the base64 payload in the wp_options table, the cron job that re-downloads the shell, the .user.ini directive that loads code before WordPress starts, or the SSH key in the account. Delete the flagged files and every one of those is still there.
On shared servers there is a further problem: the account may have been compromised through a neighbour, or the neighbour through you. Cleaning one account on a server with weak isolation is temporary by design.
The sequence that works
From suspended to reinstated — once
- 01
Investigate from the copy
Work from the downloaded copy first: identify the flagged files, find what they do, look for siblings the scanner missed, check the database for injected options and users, and read the access logs around the earliest timestamps to find the entry path.
- 02
Rebuild, do not patch
Replace WordPress core, plugins, and themes from official sources, remove abandoned components, clean the database, review .htaccess and any .user.ini or php.ini files, and remove unknown cron entries and SSH keys.
- 03
Rotate everything the account could see
WordPress, database, cPanel/hosting, FTP/SFTP, and email passwords; API keys stored in wp-config.php or plugin settings; any deployment or backup credentials.
- 04
Close the entry path
Patch or remove the vulnerable plugin or theme, enforce MFA on administrator accounts, and restrict file execution in the uploads directory. If the entry path cannot be found, say so in the reactivation request rather than guessing.
- 05
Request reinstatement with a record
Reply with what was found, what was rebuilt, what credentials were rotated, and what was closed. A host that sees a competent cleanup record is far more lenient about a second alert than one that saw “deleted the files, please reactivate”.
- 06
Verify after reactivation
Re-check files, cron, users, and outbound mail after normal traffic resumes, request a Google Search Console review if Safe Browsing flagged the site, and keep the copy and record in case the host asks again.
After reinstatement
Staying reinstated
- Keep a written cleanup record — the host will ask for it if anything trips again.
- Remove every unused plugin and theme; deactivated code is still exploitable code.
- Turn on the host’s own malware scanning and mail-abuse alerts if they are optional, and route them to someone who reads them.
- Review administrator accounts and hosting-panel users monthly; remove anything temporary.
- If the same server keeps producing incidents across accounts, the problem is above your site — consider a host with account isolation, or a server you control and can have audited.
Common questions
Common questions about hosting suspensions
Will the host clean the site for me?
Usually not. Most shared and managed hosts identify and suspend; cleanup is your responsibility or a paid add-on through a partner. Some managed WordPress hosts include cleanup — check the notice and your plan terms before assuming either way.
Can I just move the site to another host?
You can, but migrating an infected site moves the infection, and the new host will suspend it too — often faster, because the malware is now on their radar. Migrate after the cleanup, or migrate the clean rebuild rather than the current files.
How long does reinstatement take?
Hosts typically reactivate within a few hours of a credible cleanup reply. The cleanup itself is the variable: a single site with hosting access is usually 1–3 business days when done properly, including evidence review and verification.
Will the suspension hurt my search rankings?
A short outage rarely does lasting damage. Weeks of serving spam, phishing pages, or malware before the suspension can, and a Safe Browsing flag needs its own review request after cleanup. The faster the site is genuinely clean, the faster search recovers.
The host terminated the account. Is the site gone?
Ask immediately for a full backup of the account; most hosts retain terminated accounts for a period. Treat that backup as evidence, rebuild from trusted sources, and do not upload the old files unchanged to a new host.