Malware

Malware is a broad term covering many types. Viruses and worms spread copies of themselves, trojans pretend to be legitimate software, ransomware encrypts files and demands payment, spyware records what you do, and botnet software quietly uses your device to attack others.

Website malware is a category of its own. A hacked site may show nothing unusual to its owner while redirecting mobile visitors to scam pages, hiding thousands of spam pages for search engines, stealing card details from checkout forms or hosting phishing pages. The site becomes the tool, and its visitors the victims.

How it works

On computers, malware usually arrives through a person's action: opening an attachment, running a download, or entering credentials on a phishing page that lets the attacker in. It can also exploit unpatched software, which is why updates matter. Once running, it often hides, connects to a server the attacker controls and waits for instructions.

On websites, the most common entry points are outdated CMS software, plug-ins or themes with known vulnerabilities, stolen admin or hosting passwords, and pirated "nulled" plug-ins that come with hidden code. Automated bots scan the internet constantly for these weaknesses, so a site does not need to be well known to be targeted. The attacker typically leaves a backdoor, a hidden file or admin account, so they can return even after the visible damage is removed.

Search engines and browsers check sites for malware. When Google detects a problem, it can show a warning in search results or a full-page browser warning, and it reports the issue in the Security Issues section of Google Search Console. Traffic can drop sharply until the site is cleaned and a review is requested.

Example

A restaurant owner hears from a customer that her website sent him to a gambling page on his phone. On her laptop the site looks normal. Her developer finds malicious code added to a theme file through an old slider plug-in that had not been updated in two years, plus an unknown admin account created the same week.

The fix takes several steps: restore files from a clean backup taken before the infection, update everything, remove the unused plug-in, delete the rogue account, change all admin, hosting and database passwords, and check for other hidden files. Two weeks later a second check shows no new changes, and the browser warning that had appeared for some visitors is cleared after a review request.

Why it matters for your business

Malware can lock you out of your files, leak customer data, damage your search rankings and turn your website into a tool against your own customers. Recovery costs time and money, and the reputational harm can outlast the technical fix. Most infections on small sites are preventable with regular updates, fewer plug-ins, strong unique passwords with two-factor authentication, and off-site backups that let you restore quickly. You can check your own site for free: look at the Security Issues report in Search Console and use Google's Safe Browsing site status check. Be aware that cleaning only the visible symptom without removing the backdoor usually leads to reinfection.

Common mistakes

• Deleting the obvious malicious file but leaving the backdoor and the vulnerable plug-in, so the site is reinfected within days.
• Installing pirated premium plug-ins or themes, which often contain hidden malicious code.
• Keeping backups only on the infected server, where they may be compromised too.
• Paying a ransomware demand without advice, which does not guarantee files are returned and funds further attacks.

Questions people ask

How do I know if my website has malware?

Signs include visitors being redirected elsewhere, unfamiliar pages appearing in Google results for your site, browser or search warnings, new admin users you did not create and sudden slowness. Check the Security Issues report in Google Search Console and ask your host to scan the files.

How do I remove malware from my website?

Restore from a clean backup taken before the infection if you have one, or have the files cleaned by someone experienced. Then update all software, remove unused plug-ins, delete unknown accounts and change every password. Finally, request a review in Search Console if Google flagged the site.

Can antivirus software protect my website?

Antivirus on your own computer protects that computer, not your website. Your site needs server-side protection: updates, strong logins with two-factor authentication, a web application firewall where useful, file-change monitoring and off-site backups. Many hosts offer malware scanning as part of their plans.