Learning Hub · Intermediate · 30 minutes
How to Scan a Site for Malware
Everything you need to confirm a suspicion or verify a clean bill, with the right tools — the steps, the gotcha, and the tip the support desk gives everyone.
The short answer
Goal: confirm a suspicion or verify a clean bill, with the right tools. Time needed: 30 minutes. Difficulty: intermediate.
Below: the exact steps, the classic pitfall, and a pro tip from the support desk. Where our platform automates a step, the guide says so rather than making you do robot work.
Written by the HostingAlly team · Last revised 27 July 2026
Intermediate
Skill level
5
Steps to done
Free
Support included
Tested
On our platform
You don't need to be technical for this — the walkthrough is written for first-timers, tested against our own platform, and honest about which parts are genuinely fiddly versus merely unfamiliar.
One promise before starting: nothing in this guide is irreversible. Where a step could bite, we say so and give the undo.
The shape of the job
Start to finish, you'll read the external symptoms, run the server-level scan, cross-check with application scanners, consult the external verdicts and interpret honestly.
Each stage is a few minutes of focused clicking — the elapsed time mostly depends on how familiar the control panel already feels. The detailed steps are listed further down this page; skim the whole route once before starting.
Read this before you start clicking
Deleting the one found file and declaring victory — malware plants backdoors in multiples precisely so the obvious infection's removal leaves the quiet ones running; cleanup is a process, not a deletion.
Forewarned is genuinely forearmed here — this exact mistake accounts for most of the frustration this topic produces, and it's entirely avoidable once named.
One habit that makes this easier forever
Scan from multiple vantage points when suspicious — server scanner, application checker and external URL scan each see a different layer, and compromises hide from single perspectives.
Small habits like this are the real difference between people who find hosting easy and people who find it stressful — the tools are identical; the workflow isn't.
How HostingAlly makes this easier
Several steps in this guide exist because hosting historically made you do them — on our plans, SSL issues itself, backups run daily without being asked, and one-click installers replace manual setup entirely. What remains is the genuinely-yours part of the task.
And when a step misbehaves anyway, support answers around the clock — with the actual fix, not a knowledge-base link and a shrug. Half our best guides started as patterns in the tickets.
The platform this guide assumes
Tutorials age badly when they're written against imaginary hosting. These are written against ours — the same panel, installer and defaults you'll actually see.
Business email on your own domain is included, not sold back as an add-on.
- Step-by-step, tested as written
- The gotcha flagged before you hit it
- Automation covers the boring steps
- 24/7 support if you get stuck
Why HostingAlly
Every plan includes this, whatever you pay
Automation where it belongs
SSL, backups and installs run themselves here — the guide covers only what's genuinely yours to do.
5 steps, no filler
Each stage is a few minutes of focused clicking, with the fiddly parts marked as fiddly.
The gotcha, named early
The classic mistake for this exact task is flagged before step one — so 30 minutes stays 30 minutes.
Help on standby
Stuck at step three at midnight? Support answers around the clock, mid-guide included.
Written from real tickets
Our guides come from the support desk — the gotchas are the ones people actually hit.
The undo is always named
Where a step could bite, the guide says so and gives the reversal.
Getting Started
How to get going
- 1
Read the external symptoms
Search results showing spam titles, browser warnings, redirect complaints from visitors — outside symptoms often announce what inside scans confirm.
- 2
Run the server-level scan
On protected plans, Imunify360's scanner inspects files below the application — panel-level scanning sees what compromised WordPress code could hide from its own plugins.
- 3
Cross-check with application scanners
A WordPress security plugin's integrity check compares core files against official checksums — modified core files are the smoking gun of compromise.
- 4
Consult the external verdicts
Search Console's security section and URL-scanning services show what the outside world has flagged — blocklist status is part of the diagnosis.
- 5
Interpret honestly
One infected file usually means more — malware installs redundantly; a positive result triggers the full cleanup process, not a single-file deletion.
Included
What's covered on our plans
- 99.9% uptime commitment, monitored around the clock
- Per-site PHP version selection
- WordPress Toolkit with automatic updates
- Free domain for the first year on annual plans
- Webmail plus IMAP, POP and SMTP access
- No setup fees, ever
- Upgrades apply in place — no migrations between plans
- Staging environments for risk-free changes
- Free website migration handled by our team
- Free WebP image optimisation built in
FAQ
Your questions, answered
The scanner found nothing but the site acts infected — now what?
Trust the symptoms — check for injected database content (spam links in posts), .htaccess redirects, rogue admin users and recently-modified files. Scanners catch known patterns; hands-on inspection catches the custom ones. Support can help look.
How often should scans run?
Server-level protection scans continuously on covered plans — the manual full-scan ritual is for incidents and quarterly hygiene. Frequency matters less than acting completely on any positive.
Can I host more than one website on a plan?
On the Pro tier and above, yes — multiple sites with their own domains, email and SSL under one account. If the extra sites belong to clients rather than you, reseller hosting gives each one proper isolation instead.
What does your 24/7 support actually cover?
Real people at every hour, and a scope that includes the practical questions — email setup, DNS, WordPress issues, restores — not just 'the server is up, ticket closed'. Pre-sales questions are welcome too; ask us something difficult and judge the reply.
Do you support staging sites?
Yes — plans with staging let you clone the live site, test changes safely, and push to production when ready. It's the difference between 'I hope this update works' and knowing it does.
Where are your servers located?
Our hosting infrastructure runs from European datacentres with London at the core, behind server-level caching that keeps cached pages fast worldwide. For most sites, platform quality — NVMe storage, LiteSpeed, sensible server density — matters far more than the datacentre's postcode.
How long does it take to get started?
Minutes — hosting activates on payment, the domain (free for year one on annual plans) connects immediately, and one-click installers put WordPress or 400+ other apps live the same sitting. If you have an existing site, our team migrates it free, usually within 24 hours.
Planning to switch hosts? Grab the checklist here.
The steps that keep a site migration dull rather than dramatic: what to back up first, how to shift email across without losing a single message, when to touch DNS, and the two mistakes behind nearly every hour of downtime we come across.
Put an ally behind your website.
Every plan includes the essentials others sell as extras — and support that actually answers.
View VPS Hosting plans