# Run a malware scan and clean an infection

## Scan your site

1. Go to **Websites → [site] → Scan**.
2. Click **Run scan**. Results and any **detections** appear in the scan log (recent history is kept).
3. Review flagged files. Infected files may be **quarantined** automatically.

## Clean up

- Restore a **known-clean backup** from before the infection (see *Back up and restore*).
- Update WordPress core, plugins, and themes, and remove anything unused.
- Change your admin and database passwords.
- For stubborn infections, request **professional malware cleanup** from the Security page.

## Prevent reinfection

Keep everything updated, use strong passwords + 2FA, and enable the **WAF**.

## Troubleshooting

- **False positive** — review the file; if it's legitimate you can restore it from quarantine.
- **Keeps coming back** — an outdated plugin is often the entry point; update or remove it, then restore a clean backup.

**Related:** Configure the web application firewall (WAF) · Back up and restore your website