SiteGround Suspended My WordPress Site for Malware — Here's What to Do

You opened your browser, typed your domain, and instead of your site you got a SiteGround suspension notice. Or you saw a malware warning in your Client Area. Either way, web access to the site is restricted, and you need to clean it before SiteGround lifts the restriction.

This guide covers exactly what to do — in the right order — to get back online. If you need hands-on malware removal instead of DIY, or urgent wordpress emergency support while the site is offline, WPOPS can take over the cleanup and reinstatement.

Why SiteGround Suspended Your Account

SiteGround runs automated malware scanners across shared hosting accounts. When they detect malicious code, redirect scripts, spam files, or suspicious outbound email activity, they restrict web access to the affected site and post a notice in your Client Area.

The restriction happens at the web server level — your DNS still points to SiteGround's servers, but instead of loading your WordPress site, their servers block public access. Your files are still there. Your database is still there. Nothing has been deleted yet.

The most common reasons SiteGround flags a WordPress account for malware:

• Infected plugins or themes — outdated or nulled plugins are the leading cause. A single vulnerable plugin is enough for an attacker to inject malicious files across your entire hosting account, not just one site.

• Database injections — attackers inject spam links, redirect scripts, or phishing content directly into your WordPress database. Your site looks normal to you but redirects mobile visitors or visitors arriving from Google to spam pages.

• Spam email sending — compromised WordPress installs are used to send thousands of spam emails through your hosting account. SiteGround detects the outbound volume and suspends the account.

• Backdoors from a previous infection — if a site was hacked before and not fully cleaned, attackers leave hidden backdoor files that let them reinfect at will. If this suspension is not your first, this is almost certainly the cause.

What SiteGround Will and Won't Do

SiteGround's malware notice in the Client Area has a Review button. View Evidence lists the files its scanner flagged. For ongoing daily scanning, Site Scanner is a paid add-on (Client Area → Marketplace), and its Premium tier adds automated cleanup.

SiteGround won't clean it for free. The malware notice offers a paid Request Cleanup option, and Site Scanner Premium includes automated cleanup. They manage infrastructure, not WordPress applications. The cleanup is your responsibility — which is also why ongoing wordpress maintenance matters before a suspension hits.

Step 1 — Confirm You Still Have Site Tools and SFTP Access

Log into your SiteGround Client Area at my.siteground.com and open the malware notice for the affected site. Check whether you can still access Site Tools and SFTP.

Use More → Whitelist IP if you need to reach the site while you clean. If you're stuck getting access, contact SiteGround support from the Client Area.

Step 2 — Download a Complete Backup Before Touching Anything

Before making any changes, create or restore a backup in Site Tools → Security → Backups. This gives you a restore point if anything goes wrong during cleanup.

If SiteGround's backup tool is unavailable due to the restriction, connect via SFTP and download your entire public_html folder manually. It will be large but you need it.

Step 3 — Scan Every File and Database Table

Start from SiteGround's View Evidence list, then verify with Wordfence, MalCare, or a manual SFTP scan. For serious infections, a manual scan is more reliable than a plugin because the malware may have disabled or modified security plugins. For a broader cleanup walkthrough, see what to do when a WordPress site is hacked.

• Every PHP file in public_html for injected code, base64 encoded strings, and eval() commands

• Your wp-config.php for modified database credentials or injected scripts

• Your .htaccess file for redirect rules pointing to spam or phishing domains

• Your WordPress database for injected links, redirect scripts, or spam content in posts and options tables

• Your wp-content/uploads folder for PHP files (there should be none — PHP files in uploads are almost never legitimate; treat any you find as suspicious)

Step 4 — Remove All Malicious Files and Database Entries

Delete every malicious file found. Do not simply "clean" injected PHP files — replace them entirely with fresh copies from a clean WordPress installation or the plugin/theme's official repository.

For database injections, use phpMyAdmin to search the wp_posts and wp_options tables for injected content. Common strings to search for: eval(base64_decode, iframe src=, document.write(unescape, and any URL you do not recognise in redirect-related rows.

After removing malicious files, change all passwords — WordPress admin, database, FTP, and your SiteGround account. Also update your WordPress security keys in wp-config.php (generate new ones at api.wordpress.org/secret-key/1.1/salt/).

Step 5 — Update Everything

Before you request a rescan, update WordPress core, all plugins, and all themes to their latest versions. Remove any plugins or themes you are not using. Remove any nulled or pirated plugins entirely — these are the most common infection source and cannot be trusted even after cleaning.

If you cannot update a plugin because it has been abandoned by its developer, replace it with an actively maintained alternative.

Step 6 — Request a Rescan in the Client Area

Once you've removed the flagged files, go back to the malware notice in your Client Area and click Request Scan (under More). If the scan comes back clean, the restriction is lifted.

If you are stuck, contact SiteGround support from the Client Area with a clear summary: "I have removed the malicious files, updated all plugins and themes, and changed all credentials. Please review the account."

Once a rescan comes back clean, SiteGround lifts the restriction. How long that takes varies.

Step 7 — Harden the Site Before It Goes Back Online

Reinstatement is not the end. If you go back online without hardening the installation, you will be flagged again.

Minimum steps before going live:

• Install a WordPress firewall plugin (Wordfence or Cloudflare)

• Enable two-factor authentication on your WordPress admin account

• Limit login attempts

• Change the WordPress admin username if it is still "admin"

• Verify file permissions (folders at 755, files at 644, wp-config.php at 600)

• Set up automated daily backups stored off your hosting server

If Your Site Gets Reinfected

If SiteGround flags your site again after you've cleaned it, you did not fully remove the infection. The most common reason is a missed backdoor file in wp-content/uploads or an infected theme file that was cleaned rather than replaced.

The second most common reason is a vulnerability that was not patched — the same plugin or theme that allowed the initial infection is still on the site, still outdated, still exploitable.

A proper post-cleanup scan should include a file integrity check against known-clean versions of every plugin and theme, not just a scan for known malware signatures. Malware signatures change. File integrity does not lie.

How to Prevent This From Happening Again

Most WordPress malware infections exploit one of three things: an outdated plugin, a weak password, or the absence of a firewall. Fixing the current infection without addressing these three things makes a repeat far more likely.

What helps prevent WordPress malware:

Staged plugin updates — every update is applied to a staging copy of your site first and tested before going live. An outdated plugin is the most common attack vector. Keeping plugins current eliminates most of the risk.

Daily off-site backups — stored separately from your hosting account, so a suspended host cannot take your backup with it. If the worst happens, you restore to a clean point.

Continuous security monitoring — active scanning that catches infections before they trigger a hosting suspension.

These are included in every WPOPS care plan. Care plans start at $49/month, and every plan includes malware removal and a guaranteed response within 1 hour. A SiteGround suspension is a one-time emergency. A care plan is what helps prevent the next one.

Frequently Asked Questions

Why did SiteGround suspend my WordPress site?

SiteGround restricts web access when their scanners detect malware, malicious redirects, spam email activity, or other security violations. They post a notice in the Client Area and require you to clean the site (or buy cleanup) before they lift the restriction.

Will SiteGround help me remove the malware?

SiteGround won't clean it for free. View Evidence lists flagged files. The notice can offer a paid Request Cleanup, and Site Scanner Premium includes automated cleanup. You can also clean it yourself or hire a specialist.

How long does it take SiteGround to reinstate a suspended account?

Once a rescan comes back clean, SiteGround lifts the restriction. How long that takes varies. Use Request Scan under More on the malware notice after you've cleaned the flagged files.

Can I still access my files when SiteGround suspends my account?

Usually you can still reach Site Tools and SFTP from the Client Area. Use More → Whitelist IP if you need to open the site while cleaning. If access is locked, contact SiteGround support from the Client Area.

How do I make sure the malware is completely gone?

Run a full file scan AND a database scan. Many partial cleanups miss database injections or backdoor files in wp-content/uploads. After removing all malicious files, replace infected plugin and theme files with fresh copies from official repositories rather than cleaning the injected versions.

My site keeps getting reinfected after cleaning — why?

The most common cause is a missed backdoor file, usually in wp-content/uploads or in a theme file. The second most common cause is an unpatched vulnerability — the same plugin that allowed the initial infection is still outdated. A proper cleanup requires a file integrity check against known-clean versions, not just a malware signature scan.

Get help before the next suspension

If your SiteGround account is already restricted and you want a specialist to clean it, harden it, and handle reinstatement with you, start with a WPOPS care plan or contact us for emergency cleanup. Every plan includes malware removal and a guaranteed response within 1 hour. Prevention beats the next suspension every time.

By Manny — Founder, WPOPS