Run a malware scan and clean an infection

Scan your site

1. Go to Websites → [site] → Scan.
2. Click Run scan. Results and any detections appear in the scan log (recent history is kept).
3. Review flagged files. Infected files may be quarantined automatically.

Clean up

• Restore a known-clean backup from before the infection (see Back up and restore).
• Update WordPress core, plugins, and themes, and remove anything unused.
• Change your admin and database passwords.
• For stubborn infections, request professional malware cleanup from the Security page.

Prevent reinfection

Keep everything updated, use strong passwords + 2FA, and enable the WAF.

Troubleshooting

• False positive — review the file; if it's legitimate you can restore it from quarantine.
• Keeps coming back — an outdated plugin is often the entry point; update or remove it, then restore a clean backup.

Related: Configure the web application firewall (WAF) · Back up and restore your website