The alert email
SiteGround emails the account’s administrative address as soon as Site Scanner detects malicious content, and sends a weekly summary. A URL scan finding also raises a warning in the Client Area.
Guide · Host suspensions · SiteGround
SiteGround suspended the site for malware. The scan says what, not how it got in.
SiteGround’s own FAQ is direct about it: “A suspension almost always follows a confirmed malware detection.” It calls the suspension a protective step, so an infected site cannot be used against visitors or other accounts on the same server, and says nothing about it is permanent. The way back is a clean site and a fresh scan. This guide covers where SiteGround shows you what it found, how the suspension is lifted, and the parts of a cleanup its tools do not do: the database, the accounts, and the way in.
Published Last reviewed
- Why it happens
- Confirmed malware; SiteGround calls the suspension protective and not permanent
- Where results are
- Site Tools › Security › Site Scanner, where the scanner is active
- How it lifts
- Clean the site, run a fresh scan; support reactivates manually if the clean scan does not
- Backups
- Daily: up to 30 copies on shared hosting, 7 on Cloud, restorable in Site Tools
What SiteGround does
What a SiteGround malware suspension means
The suspension follows a confirmed detection. SiteGround’s FAQ describes it as protective rather than a penalty, and not a billing issue. Its public pages do not show the exact text of the notice or what visitors see while the site is suspended, and they do not say whether File Manager, SFTP and SSH keep working during a suspension. If you cannot reach the files, ask support for access to clean them before doing anything else; that is the first thing to establish.
Detection is done by SiteGround Site Scanner. The knowledge base describes it as a paid add-on bought from the Client Area’s Marketplace, for primary domains only, in two plans. Basic runs daily URL scans and blacklist checks and weekly file scans, keeps 30 days of history and emails alerts. Premium scans files daily and new uploads as they arrive, can quarantine them, and offers a one-click Clean Up. The FAQ, by contrast, says Site Scanner is free on every plan and lists the infected files by path. The two pages do not agree; check what your own Site Tools shows.
Where to look
Finding the SiteGround Site Scanner report
Site Tools › Security › Site Scanner
The results, with tabs for Scans and Cleanups, Notifications, Site Protect and Quarantine. Note every path it lists and its timestamp before anything is changed.
What the list is
The files the scanner matched. It is a starting point for the cleanup, not its boundary: the knowledge base does not say the scan covers the database, and a backdoor that matches no signature is not on any list.
Getting reinstated
How to get a SiteGround site unsuspended after malware
Figure 1 · Getting a SiteGround site back
The rescan lifts the suspension. Only the cleanup keeps it lifted.
Understand it
- Site Scanner resultsSite Tools › Security
- Preserve a copyBefore deleting anything
- Database and accountsNot in the scan
Fix, then rescan
- Clean every layerFiles, database, users
- Close the entryUpdate, passwords, 2FA
- Fresh scanFrom Site Tools
- ReactivatedOr support confirms
- 01
Preserve a copy first
Download the site files and a database export before cleaning, from Site Tools or over SFTP. The copy is how you find out later what was there and when it arrived.
- 02
Clean it yourself, or have SiteGround do it
SiteGround’s FAQ gives both routes. Premium’s Clean Up removes what the scanner matched; if it cannot, SiteGround opens a ticket for manual review, where “an additional cleanup fee may apply”. Expert Care, a monthly credit-based subscription in which one credit covers up to 30 minutes, is SiteGround’s paid route for hands-on work. Its pages do not quote a price for malware cleanup.
- 03
Clean what the scanner does not
The database (injected scripts in options and posts, changed siteurl and home values), administrator accounts nobody created, must-use plugins, scheduled tasks, and the plugin or password that let the attacker in. SiteGround’s own manual-cleanup article adds the basics: restrict the site to your own IP while you work, scan your computer, remove obfuscated code, and change every password.
- 04
Run a fresh scan
From Site Tools. The FAQ says a clean result “usually lifts the suspension on its own; if it doesn’t, support can confirm and reactivate manually.” SiteGround does not publish a timeline for either.
Backups
Restoring a SiteGround backup after a malware infection
SiteGround keeps free daily backups: up to 30 copies on shared hosting and 7 on Cloud, with Premium Backup adding more copies and hourly backups for the last 48 hours. A full site, files only, the database or email can be restored from Site Tools › Security › Backups; there is no preview, and only Premium allows downloading. SiteGround’s backup page names malware injection as a reason to restore, and its Academy article on hacked sites says to restore the last known clean backup and “go back as far as you can”.
A restore puts back the files and the database as they were on that day, including the vulnerable plugin and the password that was used to get in. Restore to a date before the infection, then update everything and change every password before the site goes public again, or the same entry is used a second time.
What SiteGround’s pages leave open
What this guide could not confirm from SiteGround
Read on 5 November 2026 from SiteGround’s FAQ, knowledge base and Academy. Third-party accounts of SiteGround suspensions exist, including claims about short cleanup deadlines and IP allowlisting, but none is confirmed by SiteGround’s own pages, and they are not repeated here as fact.
- The wording of the suspension notice and what visitors see while a site is suspended
- Whether File Manager, SFTP and SSH remain available to the owner during a suspension
- Whether Site Scanner is free on every plan, as the FAQ says, or a paid add-on, as the knowledge base says
- Any timeline for reactivation after a clean scan or a manual review
- Whether the scanner reads the database at all
Common questions
Common questions about SiteGround malware suspensions
Is a SiteGround malware suspension permanent?
No. SiteGround’s FAQ says nothing about it is permanent and that it is not a billing issue. A clean fresh scan from Site Tools usually lifts it automatically, and support can reactivate the site manually if it does not.
Will SiteGround clean the malware for me?
Partly, and not for free in every case. Site Scanner Premium has a one-click Clean Up for what it detects, with a manual review that may carry an extra fee if that fails, and Expert Care is SiteGround’s paid hands-on service. None of it covers the database, rogue administrators or the way the attacker got in, according to SiteGround’s published descriptions.
Should I just restore a backup?
A backup from before the infection is a good base, and SiteGround keeps up to 30 daily copies on shared hosting. But a restore also brings back the vulnerable plugin and the old passwords. Update and change credentials before the site is public again, and check that the backup you chose really predates the first malicious file.
The rescan came back clean. Is the site clean?
It is clean of what the scanner recognises. A backdoor with no signature, a script stored in the database, or an administrator account created by the attacker would not stop a clean scan. Check those before relying on it, or the next suspension follows the next payload.
Do other sites on my SiteGround account need checking?
Yes, if they share the account. SiteGround describes the suspension as protecting other accounts on the same server; the same reasoning applies inside your own account, where one infected site can usually write to the others.