The Site Is Down, and the Host Did It
Your website shows a plain “account suspended” page, or an error that was not there yesterday. Then you find the email from your hosting company. It says malware was detected, the account has been suspended or some files have been quarantined, and you need to clean the site before it can be switched back on. There may be a list of file paths, a ticket number and a deadline.
This is stressful because two problems have landed at once: a hacked site and a business that is offline. The host is not your enemy here. It suspended the account to stop your site harming visitors or other customers on the same servers. But it usually will not clean the site for you, and getting back online means proving to them that the problem is gone. The general approach is on our hacked website help page. This page is about working through a hosting suspension: what the host has actually done, how we clean a site we may not be able to reach normally, and how we get the account reinstated.
What “Suspended” or “Quarantined” Can Mean
Hosts use these words in different ways, and the first job is to work out exactly which situation you are in. Read the email carefully, or send it to us and we will read it with you.
- Full account suspension. The whole hosting account is disabled. Visitors see a suspension page, and you may not be able to log in to the control panel, FTP or email.
- Website disabled, panel still open. The site stops serving, but you can still reach the control panel and files to clean them.
- Files quarantined. The host’s scanner has moved, renamed or removed access to specific files it believes are malicious. Parts of the site may break as a result, sometimes in ways that look unrelated, such as a white screen or a missing stylesheet.
- Outgoing mail or scripts blocked. If the account was sending spam, the host may limit email or stop PHP from running for a while. If that is your situation, our page on fixing a website sending spam emails is closer to what you need.
Many shared and reseller hosts run automatic scanners on their servers. ImunifyAV, Imunify360 and Linux Malware Detect are common examples. These tools are useful, but they work from signatures and patterns. They will catch many known threats and miss some custom ones, and they occasionally flag a harmless file. A quarantine list is a starting point, not a full map of the infection.
Why the Host’s List Is Not the Whole Story
Owners often do the reasonable-seeming thing: delete every file on the host’s list and ask for the account to be turned back on. Sometimes that works for a few days. Then the scanner finds new files and the account is suspended again, and the second time the host may be less patient.
The list only shows what the scanner recognised. It does not show the backdoor that let the attacker in, the code injected into the database, or the malicious line added to a normal-looking theme file that the scanner had no signature for. A separate post looks fairly at where a host’s responsibility ends and which jobs normally fall to the site owner.
How We Handle a Suspended Account
Read the notice and agree a way in
If the control panel is locked, we help you ask the host for temporary access so the site can be cleaned. Hosts often allow this: SFTP only, or access limited to certain IP addresses, while the site stays offline to the public. We tell you what to ask for in plain terms, or we write the request for you to send. Every host has its own policy, so we cannot promise what yours will agree to, but a clear request from someone who plainly intends to fix the problem tends to get a better reply than a vague one.
Take a full copy before anything else
We download the files and export the database as they stand, quarantined items included where the host allows. This protects your content if anything goes wrong and preserves the evidence of what happened.
Clean the whole site, not only the flagged files
We work through the host’s list first, then go further: core files compared with the official WordPress release, plugins and themes compared with clean copies, the uploads folder checked for scripts, and the database checked for injected code and unknown users. Files that were quarantined by mistake are restored from clean sources so the site works again when it comes back. The cleanup itself is the same thorough job as our WordPress malware removal service, done under tighter conditions.
Check every site on the account
Shared hosting accounts often hold more than one website: an old version of the site, a test copy, a second business, a forgotten blog. If any of them is infected, it can reinfect the others, and the host will see the account as dirty either way. We look at every site on the account, not just the one you care about. Our post on how one infected site spreads to its neighbours explains the mechanics.
Close the entry point and change credentials
We update or replace the vulnerable software and change the hosting, FTP, database and WordPress passwords. If we cannot find a clear entry point, we tell you so, and we suggest extra steps to reduce the chance of a repeat.
Ask the host to reinstate the account
We write a clear reply to the host’s ticket: what was found, what was removed beyond their list, what was updated, and what credentials were changed. Hosts generally want to see that the whole account has been dealt with, not just the files they named. Once the account is back on, we check that the site loads properly, that forms and checkout work if you run a store, and that the host’s scanner is quiet.
Things to Avoid While the Account Is Suspended
- Do not move the site to a new host to escape the suspension. The malware moves with it, and you will have the same problem in a new place, with a host that has no history of you.
- Do not argue with the abuse team. Even if you think the flag is wrong, a calm reply asking which files triggered it gets further than a complaint.
- Do not cancel the hosting account. Cancelling can delete your files and mailboxes. Keep it, even while it is suspended.
- Do not restore an old backup straight over the account. It may bring back the same hole. Read when a backup is safe to use after an attack before you try.
- Do keep the ticket number. Every message to the host should reference it, so the same team picks it up.
If Your Email Was on the Same Account
Many small businesses host their email with the same provider as the website. When the account is suspended, email may stop too, which is often the part that hurts most. Ask the host whether mail can be restored separately while the site stays offline; some hosts can do that, some cannot. If your email is regularly caught up in website problems, it may be worth moving mail to a separate provider once things settle. That is a decision for later, not during the emergency.
After the Site Is Back Online
A suspension sometimes comes with other damage. If Google saw the infected site before the host acted, you may also have a security warning in search results; our Google blacklist removal work covers requesting a review. And if the host’s notice mentioned phishing pages specifically, the reply to the host overlaps with our phishing page removal service.
Getting Help With a Hosting Suspension
Suspended accounts move ahead of routine work. Use WhatsApp for speed: put the word HACKED at the start of your message and forward the host’s email or a screenshot of it. You can reach us by phone or form as well.
Once we have read the notice, you get a candid view of the damage and when we can begin, and the account is copied in full before any cleanup. We keep you updated on WhatsApp through the cleanup and the conversation with your host. Clients outside India can pay by PayPal or Wise.