The database
Injected scripts in wp_options and wp_posts, changed siteurl and home values, and accounts in wp_users. Hostinger’s article states plainly that the database is not scanned or cleaned.
Guide · Host suspensions · Hostinger
Hostinger’s scanner cleaned the files. It says itself that it did not clean the database.
On Hostinger’s Web and Cloud hosting, the Malware Scanner runs in the background and cleans or removes infected files on its own, so many owners first learn about an infection from a count of files already handled. Hostinger’s own hacked-site article is candid about the limit: “The database is not scanned or cleaned,” and must-use plugins and rogue administrator accounts can persist. When the problem is bad enough, a single website or the whole plan is suspended instead. This guide covers both, from Hostinger’s published pages.
Published Last reviewed
- Scanner
- Automatic on Web and Cloud hosting; cleans or removes infected files itself
- Not covered
- The database; Hostinger also names mu-plugins and rogue administrators
- Suspension
- A whole plan, or one website while the plan stays active
- Paid cleanup
- Site Cleanup for WordPress, $95, handled Monday to Friday in US business hours
The Malware Scanner
What Hostinger’s Malware Scanner does on its own
On Web and Cloud hosting the scanner needs no schedule. It scans in the background and, in Hostinger’s words, proactively cleans files; the dashboard counts files “removed or cleaned automatically”. Its 2022 launch post says the system decides whether to delete a file or strip only the injected code from it. The support article does not mention quarantine, so assume a removed file is gone and keep your own copy of anything you want to examine.
The results are in hPanel under Websites › Manage site › Malware Scanner: the malware discovered, the actions taken, a 30-day timeline, and a details view with the affected file paths. The article mentions no email on detection, only one when a paid cleanup finishes, so check the timeline yourself. On a VPS the scanner only reports; automatic cleanup there requires a paid Monarx licence.
What it leaves
Why a Hostinger site gets reinfected after the scanner cleans it
A cleaned file is the output of an infection, not its mechanism. When the scanner fixes a file and the site is reinfected a few days later, the cause is almost always one of the things Hostinger itself says the scanner does not reach, or the original way in, which no file scanner closes.
Figure 1 · What Hostinger’s scanner covers
The Malware Scanner cleans files. The rest of the infection is yours to find.
| Part of the site | Scanner | What Hostinger says |
|---|---|---|
| Files | Yes | Scanned in the background and cleaned or removed automatically |
| Database | No | Not scanned or cleaned: options, posts, users |
| Rogue administrators | No | Can persist after the files are cleaned |
| mu-plugins | No | Named as a place infections persist |
| Other sites on the plan | Scan each | Share one file system on Web and Cloud plans |
Accounts and must-use plugins
Hostinger names both: an administrator the attacker created, or a file in wp-content/mu-plugins, puts the infection back after any file cleanup.
The rest of the plan
On Web and Cloud plans all sites share one file system, so Hostinger says to scan every site. Agency Hosting isolates each site.
The way in
A vulnerable plugin, a reused password or a stolen session is still open after the files are clean. Update, remove what is unused, change every password and turn on two-factor authentication.
Suspension
Hostinger website suspended or plan suspended: the difference
Hostinger’s abuse policy allows it to restrict content, suspend services or place domain holds without prior notice in serious cases, and aims for an initial review within 24 hours. Its pages do not say whether File Manager or backups stay reachable while a site is suspended; with “Manage site” unavailable they may not be, so ask support for access to clean the files if you need it.
The whole plan is suspended
Every site on it stops working, the Websites page shows a warning, and the only actions left are tagging or deleting sites. Hostinger emails the account’s contact address with the service, the reason, and what is needed to lift it.
One website is suspended
The plan stays active and there is no warning banner. “Manage site” is unavailable and the site’s menu offers only tag or delete. Hostinger says to contact support.
A mailbox is suspended
Mailboxes can be suspended automatically for spam or suspicious activity and show the status Suspended. Secure the mailbox, switch off “Suspend receiving” in its settings, and wait two hours before sending; contact support if sending still fails after 12.
Getting reinstated
How to get a Hostinger site back after malware
- 01
Follow the suspension email
It names the reason and what Hostinger needs. On shared hosting, reply as it asks or use Contact Us in the Websites warning; for a single suspended site, contact support. Keep the email: it is the record of what Hostinger found.
- 02
Clean every layer, not only the files
The files the scanner listed, then the database, the administrator accounts, wp-content/mu-plugins, scheduled tasks, and every other site on the plan that shares the file system.
- 03
Or order Hostinger’s Site Cleanup
A paid service, $95, for WordPress sites whose domain points to Hostinger. It covers malware files and MySQL injections and is ordered with the “Request site cleanup” button; requests are handled Monday to Friday during US business hours, which matters if the site went down on a Friday evening.
- 04
On a VPS, report what you found and changed
Hostinger’s VPS guidance is to reply to the suspension email with what you found and what you changed. It warns that repeated suspensions can lead to permanent termination, and that rescue mode does not bypass a suspension.
Backups
Restoring a Hostinger backup after malware: files and database from the same date
Hostinger makes weekly backups by default, kept for six weeks, and daily backups on Business plans and above or as an add-on, kept for seven days. A full site, the files or a database can be restored from hPanel, and a restore cannot be undone. Hostinger recommends restoring from before the infection, with the files and the database from the same date; mixing a clean database with infected files, or the reverse, leaves half the infection in place.
Seven days of daily backups is a short window for an infection that may have arrived weeks before anyone noticed. Pick the date by when the first malicious file appeared, not by when the warning came, and after restoring, update everything and change every password before the site goes back online.
What Hostinger’s pages leave open
What this guide could not confirm from Hostinger
Read on 5 November 2026 from Hostinger’s support centre, its documentation site and its abuse policy.
- A malware-specific suspension article for shared hosting; the published pages cover inactive plans and VPS abuse
- Whether File Manager and backups stay reachable while a single website is suspended
- Whether files removed by the scanner can be recovered
- Which backup retention applies: the support pages say six weeks for weekly backups, an older hosting agreement says two
Common questions
Common questions about Hostinger malware and suspensions
Hostinger’s scanner already cleaned the files. Do I need to do anything?
Yes. Hostinger’s own article says the database is not scanned or cleaned and that rogue administrator accounts and must-use plugins can persist. Check those, update every plugin and theme, and change every password, or the cleaned files are rewritten.
How much does Hostinger charge to clean malware?
Its Site Cleanup service is $95 for a WordPress site whose domain points to Hostinger, covering malware files and database injections, handled Monday to Friday during US business hours.
My site is suspended but the plan is active. What happened?
Hostinger can suspend a single website while the plan stays active. There is no warning banner; “Manage site” is unavailable and the site’s menu offers only tag or delete. Contact Hostinger support for the reason and the steps to lift it.
Which backup should I restore?
One from before the first malicious file appeared, with the files and the database from the same date, as Hostinger recommends. Weekly backups are kept for six weeks and daily backups for seven days, so act quickly if the infection is old.
Do my other sites on the same Hostinger plan need checking?
Yes. On Web and Cloud plans all sites share one file system, and Hostinger says to scan every one. An infection in one can usually write to the others.