Hostinger Suspended My WordPress Site for Malware — Here's How to Fix It

Hostinger suspended your WordPress account. Their automated scanner flagged malware on your site and pulled it offline. Hostinger then emails your account's contact address with the reason and what it needs from you. Your site is down, visitors see a suspension page, and you need to fix it now.

This guide covers the exact process — what Hostinger will and won't do, how to clean the infection, and how to request reinstatement. If you need hands-on malware removal instead of DIY, or urgent wordpress emergency support while the site is offline, WPOPS can take over the cleanup and reinstatement.

Why Hostinger Suspended Your WordPress Account

Hostinger runs an automated Malware Scanner on its Web and Cloud hosting plans. When the scanner detects malicious code, suspicious files, spam email activity, or security violations, it can suspend the affected plan. The same pattern shows up on SiteGround and other hosts — the host flags the account, and the cleanup is left to you.

Common reasons Hostinger suspends a WordPress account:

• Malware in plugin or theme files — outdated plugins are the most common attack vector. A single vulnerable plugin gives attackers access to inject malicious files across your entire hosting account.

• Malicious redirects — your site redirects visitors arriving from Google or mobile devices to spam, phishing, or adult content pages. Hostinger's crawlers detect this and flag the account.

• Spam email sending — a compromised WordPress install can send thousands of spam emails through Hostinger's mail servers. They detect the outbound volume and suspend the account to protect their mail reputation.

• Phishing pages — attackers create fake bank, PayPal, or login pages inside your WordPress files. Hostinger and Google both flag these quickly.

• Database injections — spam links or redirect scripts injected directly into your WordPress database. These are harder to detect visually but Hostinger's scanners find them.

What Hostinger Will and Won't Do

Hostinger emails you the suspension reason and the steps it needs. While a plan is suspended, Hostinger's docs say you can't manage the affected websites from the dashboard, so ask support how to get access for cleanup, or work from a backup. They reinstate the account once they confirm the malware has been removed.

Hostinger won't clean it for free. Its Malware Scanner in hPanel lists the infected files it finds, and Hostinger sells a paid one-time cleanup. The scanner checks files only, not the database. They are a hosting provider — they manage servers, not WordPress applications. That is why wordpress maintenance and security monitoring matter before a suspension — and why a proper cleanup is still on you after one.

Step 1 — Log Into hPanel and Confirm Access

Log in at hpanel.hostinger.com and open the Websites page. Look for the suspension warning and follow Hostinger's instructions there. Check whether File Manager and MySQL Databases are available for cleanup.

If you cannot manage the site from the dashboard, reply to Hostinger's suspension email, or use Contact Us in the suspension warning on the Websites page of hPanel, and ask how to get temporary access for cleanup.

Step 2 — Back Up Everything Before Touching Anything

Download a complete backup before making any changes. In hPanel go to Websites → Dashboard → Backups. Weekly backups come with Web and Cloud plans, and daily backups with Business and higher plans or as an add-on. If the dashboard is locked because of the suspension, ask support for a backup, or use your own off-site copy.

Do not skip this step. If you delete the wrong files during cleanup, you need a restore point.

Step 3 — Run a Full Malware Scan

Use Hostinger's Malware Scanner results as a starting list, then verify with Wordfence, MalCare, or a manual SFTP scan. For serious infections, manual review is more reliable — malware often disables or modifies security plugins to avoid detection. For a deeper cleanup walkthrough once the site is accessible again, see our guide on what to do when a WordPress site is hacked.

• Every PHP file in public_html for injected code, encoded strings, and malicious functions

• Your .htaccess file for redirect rules you did not add

• wp-content/uploads for any PHP files (there should be none — PHP files in uploads are almost never legitimate; treat any you find as suspicious)

• Your WordPress database for injected links, redirect scripts, or spam content

• wp-config.php for modified credentials or injected code

Step 4 — Remove All Malware and Replace Infected Files

Delete every malicious file found. For infected plugin and theme files, do not clean the injected code — replace the entire file with a fresh copy downloaded from the official WordPress repository or the plugin developer's site.

For database injections, use phpMyAdmin (available in hPanel when access is available) to search wp_posts, wp_options, and wp_users tables for injected content. Search for: eval(base64_decode, <iframe, document.write(unescape, and any external URLs you do not recognise in option values.

After removing everything:

• Change your WordPress admin password

• Change your Hostinger account password

• Change your database password in wp-config.php

• Regenerate WordPress security keys at api.wordpress.org/secret-key/1.1/salt/

Step 5 — Update All Plugins, Themes, and WordPress Core

Before you request reinstatement, update everything — WordPress core, all plugins, all themes. Remove any plugins or themes you are not actively using. Remove any nulled or pirated plugins entirely — these cannot be trusted even after cleaning and will be reinfected.

If a plugin has not been updated in over a year and has known vulnerabilities, replace it with an actively maintained alternative.

Step 6 — Request Reinstatement from Hostinger

Keep the message factual and direct. "I have removed all malicious files, updated WordPress core and all plugins, changed all credentials, and confirmed the site is clean. Please review the account for reinstatement."

Reinstatement time varies. Hostinger reviews your reply after you confirm the cleanup.

• Your Hostinger account email and domain name

• A summary of what was found and removed

• Confirmation that all software is updated

• A request for account review and reinstatement

Step 7 — Harden the Site Before Going Back Online

Getting reinstated is not the end. If the vulnerabilities that allowed the attack are still in place, you will be suspended again.

Before going live:

• Install a WordPress firewall (Wordfence free tier or Cloudflare)

• Enable two-factor authentication on your WordPress admin login

• Limit failed login attempts

• Verify file permissions: folders at 755, files at 644, wp-config.php at 600

• Set up daily backups stored off your Hostinger account

• Consider upgrading to a hosting plan with an isolated environment if you are on shared hosting

Common Mistakes That Lead to Reinfection

Not scanning the database — file scans miss database injections. Both need to be checked.

Cleaning infected files instead of replacing them — modified plugin files need to be replaced entirely with official versions, not edited to remove injected code.

Leaving unused plugins installed — deactivated plugins are still exploitable if they contain vulnerabilities. Delete them entirely.

Not changing all passwords — attackers who had access to your WordPress admin or FTP credentials can simply log back in after you clean. Change everything.

Missing backdoor files in uploads — attackers often leave PHP backdoor files in wp-content/uploads where many cleanup tools do not scan. Check this folder manually.

How to Prevent This From Happening Again

Most WordPress malware infections exploit an outdated plugin, a weak or reused password, and the absence of a firewall. A one-time cleanup addresses the current infection. It does not fix the underlying exposure.

What actually helps prevent reinfection:

Staged plugin updates — updates tested on a staging copy before going live reduce the most common attack vector. An attacker cannot exploit a vulnerability in a plugin that has been patched.

Daily off-site backups — stored separately from Hostinger, so a suspended account cannot take your backup offline with it. Restore to a clean point in minutes if the worst happens.

Continuous security monitoring — active scanning that catches suspicious activity before it triggers a hosting suspension.

These are included in every WPOPS care plan, from $49/month, along with malware removal and a guaranteed response within 1 hour on every plan. Freelance malware cleanups on marketplaces like Fiverr vary widely in price and usually come with no ongoing protection. The same infection recurring three times costs more than a year of a care plan.

Frequently Asked Questions

Why did Hostinger suspend my WordPress site?

Hostinger suspends WordPress accounts when their automated scanners detect malware, malicious redirects, spam email activity, or phishing pages. They email the account contact with the reason and next steps. Cleanup is your responsibility unless you buy their paid cleanup or hire a specialist.

Will Hostinger help me remove the malware?

Hostinger won't clean it for free. The Malware Scanner in hPanel can list flagged files, and Hostinger offers a paid one-time cleanup. The scanner checks files, not the database — so a full cleanup still needs file plus database review.

How do I contact Hostinger about reinstatement?

Reply to Hostinger's suspension email, or use Contact Us in the suspension warning on the Websites page of hPanel. Include your account details, a summary of what was removed, and a request for reinstatement.

How long does Hostinger take to reinstate a suspended account?

Reinstatement time varies. Hostinger reviews your reply after you confirm the cleanup. Clear evidence that files and credentials were cleaned and software was updated helps the review.

My Hostinger site keeps getting reinfected — why?

The most common cause is a missed backdoor file, usually in wp-content/uploads, or an unpatched plugin vulnerability that is still being exploited. A proper cleanup requires replacing infected files with fresh copies from official sources and checking the database for injections, not just removing flagged files.

How do I prevent my Hostinger WordPress site from getting hacked again?

Keep all plugins, themes, and WordPress core updated — ideally tested on staging before going live. Install a firewall plugin. Set up daily off-site backups. Remove unused plugins entirely rather than just deactivating them. These steps close the most common ways WordPress sites get infected.

By Manny — Founder, WPOPS