Skip to main content
Sign in

CloudLinux Knowledge Base

  1. CloudLinux
  2. Imunify Security Products
  3. Articles

How to Prevent Website Reinfection After Malware Cleanup?

Sameera Kallengal
  • Updated

Cleaning the Malware Is Only the First Step

We’ve removed the malicious files from your website and restored it to a clean state. However, malware removal alone does not guarantee that the website will remain secure. If the security weakness that allowed the attack is still present, attackers may be able to exploit it again, resulting in another infection.

Think of it like a burglary. Replacing the broken window is necessary, but if the faulty lock on the door is never repaired, someone can simply walk in again.

The goal is not only to clean your website. It is to prevent reinfection.

Why Websites Become Reinfected

Most repeat infections happen because the original vulnerability was never addressed. Seven causes account for the majority of them.

Outdated software
Core platform, plugins, extensions, modules, themes, third-party libraries, or PHP left unpatched.

Weak access control
Reused or weak passwords, compromised user accounts, excessive permissions, and access still held by former contractors.

Leftover attacker access
Hidden backdoor files, scheduled tasks that reinstall malware, and administrator accounts created by the attacker.

Too many accounts
Old logins that nobody uses or checks anymore.

The wrong backup
Someone restores a backup from before the cleanup, so the malware comes back with it.

Pirated plugins
Free copies of paid software usually contain malware on purpose.

Operational mistakes
Insecure server configurations, and abandoned applications left on the server.

Removing malware eliminates the infection, but it cannot permanently protect a website if these underlying issues remain.

Steps to Complete Now

These close the weakness that allowed the infection. Work through them as soon as possible after a cleanup.

Step 1 — Keep Your Software Up to Date

The most effective way to reduce the risk of reinfection is to keep all website software updated. This includes:

  • Content Management Systems such as WordPress, Joomla, Drupal, or Magento
  • Plugins, extensions, modules, and themes
  • Custom web applications and the third-party libraries they depend on

Developers regularly release updates that fix security vulnerabilities, improve stability, and address compatibility issues.

Once a security update is published, the vulnerability it fixes becomes public knowledge as well. Attackers then begin scanning the internet for websites that have not yet installed it.

Your website is rarely targeted by a person. Instead, automated bots continuously search for websites running software with known vulnerabilities. Installing updates promptly closes these known security gaps and significantly reduces the risk of another compromise.

Where to find updates

Platform Where to update
WordPress Dashboard → Updates
Joomla System → Update
Drupal Reports → Available updates
Magento Composer, plus published security patches
PrestaShop Dashboard → Updates, and the module manager
Custom applications composer update and npm update, tested on a staging copy first

Updating safely

Many website owners delay updates because an update once caused a problem. That concern is reasonable, and it can be managed:

  • Take a full backup before updating.
  • Update in small groups, checking the website after each one, so any issue can be traced immediately.
  • Test on a staging copy first where possible.
  • Clear any caching layers before concluding that something is broken.

Automate what you can

The most reliable maintenance is the kind that does not depend on someone remembering it. WordPress installs core security releases automatically by default, and automatic updates can also be enabled per plugin. Platforms that cannot update themselves, including Magento and custom applications, should have a scheduled monthly maintenance window with a named owner.

Note

Premium plugins and extensions receive updates only while their license is active. An expired license silently stops security updates, even though the software continues to work normally.

If your website was built by a developer, it likely depends on third-party packages that are not visible in any dashboard. Running composer audit or npm audit lists any with known published vulnerabilities.

Step 2 — Remove Software You No Longer Use

Every application installed on your server increases the number of potential entry points. Delete software you no longer need, including:

  • Plugins or extensions
  • Themes or templates
  • Test applications
  • Old development copies
  • Backup installations that remain publicly accessible

If software is no longer used, removing it is safer than simply disabling it. Disabled code remains on the server and remains reachable by an attacker.

Also replace any component whose developer has stopped maintaining it. An abandoned plugin will never receive another security fix, so the risk it carries cannot be resolved by updating.

Remove any nulled or pirated software

“Nulled” software refers to paid plugins, themes, or extensions redistributed for free with their license checks removed. These downloads are one of the most common sources of website malware. In many cases the malicious code is deliberately added before redistribution, because that is the purpose of the redistribution.

If a premium component came from anywhere other than its official developer or an authorized marketplace, it should be treated as compromised and removed. No other security measure compensates for intentionally installed malicious code.

Step 3 — Use Strong Authentication

Weak passwords remain one of the most common causes of compromised websites. Protect every account that has access to your website or server by:

  • Using strong, unique passwords of at least 16 characters
  • Avoiding password reuse across multiple services
  • Removing default or unused accounts
  • Granting users only the permissions they require

A password manager such as Bitwarden, 1Password, or KeePassXC makes unique passwords practical to use. You can check whether a password or email address has appeared in a known data breach at Have I Been Pwned.

Change every credential after a cleanup

Assume that any credential stored on the server may have been collected during the compromise. Change all of the following, not only the website login:

  • Administrator accounts for every application on the account
  • Hosting control panel login
  • FTP and SFTP accounts
  • SSH accounts
  • The database password — the application configuration file must be updated to match, or the website will go offline
  • API keys and integration tokens, such as payment, shipping, and CRM services
  • SMTP or mail-sending credentials, which are frequently abused to send spam from your domain

For custom applications, also rotate the application secret key, such as APP_KEY or the security salts in wp-config.php. These keys sign user session cookies, so a copied key can allow an attacker to remain logged in without any password.

Enable multi-factor authentication

Passwords can be stolen through phishing, malware, or data breaches. Multi-factor authentication requires a second verification step, so a stolen password alone is not enough to log in. Enable it wherever it is available: administrative accounts in every application, your hosting control panel, and the email account used for password resets. Without that last one, an attacker who controls your inbox can bypass every other protection.

For WordPress, the official Two-Factor plugin provides this at no cost. Most other platforms offer equivalent functionality natively or through a maintained extension.

It is also worth limiting automated login attempts. Login pages are targeted continuously by bots working through large password lists, and a login-attempt limiter or web application firewall blocks this long before it succeeds.

Step 4 — Secure Server Access

If you manage your own server, review how administrative access is protected. Where possible:

  • Use SSH keys instead of passwords.
  • Disable password-based SSH authentication if it is no longer required.
  • Restrict administrative access to trusted users.
  • Remove accounts that are no longer needed.

An SSH key is a pair of files: a public key stored on the server, and a private key that stays on your own computer. Because no guessable secret is ever transmitted, SSH keys are far more resistant to brute-force attacks.

Two practices are worth following: protect the private key with a passphrase, and issue a separate key to each person, so that removing someone’s access later is a single deletion rather than a password change everyone must be told about.

On managed hosting

Some of these changes are made by the provider rather than in your control panel. Contact support if you are unsure which apply to your account.

Step 5 — Keep the Server Updated

Your website depends on more than just the application itself. The operating system, PHP, web server, database server, and other installed services also require regular security updates. If these components remain unpatched, they may expose your website even if the application itself is fully updated.

PHP deserves particular attention. When a PHP version reaches end of life, it stops receiving security fixes permanently — so a website running an unsupported version is running permanently unpatched code, and typically performs more slowly as well. You can check which versions are still supported on the official PHP supported versions page.

Running unsupported software without security updates leaves known vulnerabilities unaddressed, significantly increasing the risk of compromise. Solutions such as Endless Lifecycle Support (ELS) can provide critical security patches for end-of-life operating systems, PHP versions, and applications, helping to mitigate known vulnerabilities until an upgrade is possible.

If your hosting provider manages the server, check that security updates are applied regularly. On managed hosting, responsibility is usually divided as follows:

Your hosting provider You
Operating system and server software Application core, plugins, themes, extensions
Network and infrastructure security Custom code and third-party libraries
Server-level security tooling User accounts and access control
Backup infrastructure Choice of PHP version

Reinfections frequently occur in the gap between these two halves, because application-level maintenance is often assumed to be covered by the hosting provider.

Step 6 — Check for Backdoors and Scheduled Tasks

After gaining access, attackers commonly leave a way to return, which means that fixing the original vulnerability is not always sufficient on its own.

The most frequently overlooked method is a scheduled task. A cron job can quietly re-download malicious files at regular intervals, so a website can appear clean immediately after a scan and be infected again a few hours later.

Important

If malware reappears very soon after a successful cleanup, a scheduled task is one of the first things to check.

Review the scheduled tasks in your hosting control panel, or run crontab -l over SSH. Any entry you cannot explain — particularly one that downloads a remote file or runs a file with an unusual name — should be reported to support rather than simply deleted, because it helps identify how access was regained.

Other common methods include administrator accounts created by the attacker, unexpected SSH keys added to the server, and modified configuration files.

It is also worth checking file permissions while you are here. Directories set to 777 are writable by any user on the server, and executable files such as .php in upload directories are a strong indicator of a problem. If you are unsure, our support team can review these for you.

Step 7 — Maintain Reliable Backups

Backups do not prevent attacks, but they make recovery much faster if something goes wrong. Your backup strategy should include both website files and databases.

Store backups separately from the server whenever possible, and periodically verify that they can be restored successfully. A backup that has never been restored is an assumption rather than a safeguard.

Important

Do not restore a backup created before the cleanup. That backup still contains the malicious code, and restoring it will immediately reinfect the website. This is one of the most common reasons a site becomes reinfected within hours of being cleaned.

Create a new backup now, while the website is confirmed clean, and treat it as your earliest safe restore point.

Step 8 — Monitor Your Website

Security is an ongoing process. Regularly review your website for signs of unusual activity, such as:

  • Unexpected administrator accounts
  • Unknown files or applications
  • Software update notifications
  • Security alerts from your hosting provider or security tools
  • Unusual website behavior or performance
  • Visitors being redirected to an unfamiliar website
  • Search results showing content you did not create

Detecting issues early often prevents them from becoming larger problems. These free tools help you find out quickly:

Tool Purpose
Google Search Console Notifies you if Google detects a security issue on your site
Google Safe Browsing Shows whether your domain is currently flagged as unsafe
VirusTotal Free external scan for visible malware and blocklist status

Continuous, server-level malware protection detects problems faster than periodic manual checks. Malware identified within minutes rarely becomes a search engine warning, a suspension, or a blocklisted domain, whereas the same malware identified two weeks later frequently becomes all three.

Step 9 — Confirm the Website Is Clean

Once you have completed the steps above, ensure that the website is scanned regularly using Imunify360 to verify that it remains free of malware.

A clean scan result after updating all software and changing all relevant credentials confirms that the root cause has been addressed and the website is no longer compromised.

In contrast, a clean scan result before completing these remediation steps only confirms that the malware has been removed. It does not guarantee that the underlying vulnerability has been fixed or that the website will not be compromised again.

Security Is Ongoing Maintenance

No website can remain secure without regular maintenance. Whether your website runs WordPress, Joomla, Drupal, Magento, a custom application, or another platform, the same principles apply:

  • Keep software updated.
  • Remove unused components.
  • Use strong authentication.
  • Limit administrative access.
  • Maintain reliable backups.
  • Monitor your website regularly.

These simple practices significantly reduce the likelihood of reinfection and help keep your website available, secure, and reliable. A simple routine is enough to stay on top of it:

Frequency Task
Immediately Apply any update described as a security release
Monthly Back up, then update software and verify the website afterward
Quarterly Remove unused components; review user accounts; check PHP version and license renewals
Annually Test a full restore from backup; review external access and integrations

Reinfection Prevention Checklist

After your website has been cleaned, we recommend completing the following steps.

Complete now

  • Install all available software updates.
  • Update plugins, extensions, modules, and themes.
  • Remove software you no longer use.
  • Remove any nulled or pirated software.
  • Update PHP and other server software where applicable.
  • Change passwords for administrator, hosting, FTP/SFTP, database, SSH, API, and mail accounts.
  • Rotate application secret and session keys where applicable.
  • Review user accounts and remove unnecessary administrative access.
  • Review scheduled tasks for entries you cannot explain.
  • Create a fresh backup now, and do not restore any backup created before the cleanup.
  • Ensure that the website is scanned regularly.

Keep in place

  • Enable multi-factor authentication where available, including on your password-reset email account.
  • Use SSH keys instead of passwords for server access whenever possible.
  • Enable automatic updates, or schedule a monthly maintenance window.
  • Verify that backups are working and can be restored.
  • Monitor the website and review security alerts.
  • Continue applying security updates as they become available.

Final Thoughts

Malware removal restores your website to a clean state, but preventing reinfection requires ongoing maintenance. By keeping your applications, server software, and access credentials secure and up to date, you greatly reduce the risk of future attacks and help ensure your website remains available for your customers.

Useful Links

Comments

0 comments

Please sign in to leave a comment.

Related articles