What is website malware and how does it affect your site?

Website malware does not announce itself. It is designed to operate invisibly, using your site to steal data, redirect visitors, or carry out attacks against other systems while the site appears to function completely normally. By the time a site owner notices something is wrong, the malware has often already done its damage. What makes it so persistent, and what it actually looks like from the inside, is what this article covers.

Malware, short for malicious software, is code placed on a website without the owner's knowledge that serves the attacker's interests. It can arrive through a vulnerability in outdated software, a stolen admin password, or a compromised third-party script. Once it is there, it runs alongside legitimate content without triggering any obvious warning. For context on what makes websites vulnerable in the first place, see the article on why website security is important.

What is website malware?

Website malware is not one specific type of threat. It is a category that includes many different kinds of malicious code, each designed to do something different once on the site. Understanding the types helps explain why malware is so difficult to detect and why it often causes damage long before anyone notices it is there.

Common types of website malware

• Redirect malware changes where your visitors go, sending them to phishing pages, fraudulent sites, or pages that generate ad revenue for the attacker
• Skimming malware captures payment card details entered on checkout pages and transmits them to the attacker in real time, without the visitor or site owner knowing
• Backdoor malware installs a persistent hidden entry point that lets the attacker return even after the original vulnerability has been patched
• Ransomware encrypts the site's files and demands payment to restore access
• Cryptomining malware uses your visitors' device resources to mine cryptocurrency for the attacker while they browse your site
• Spam malware uses the site's server to send unsolicited emails, which can result in your domain being blacklisted

How does malware get onto a website?

Outdated software

• When a vulnerability is discovered in a website platform, plugin, or theme, the details are published publicly at the same time a patch is released
• Automated scanners immediately begin probing for sites still running the old version. The window between a patch being released and a site applying it is when the risk is highest
• Every day a site runs outdated software with a known vulnerability, it is a documented target

Compromised admin credentials

• Automated tools test thousands of username and password combinations against login pages until one works. Weak or reused passwords make this straightforward
• Credentials stolen through phishing or data breaches on other services give attackers direct access to the admin panel, where they can install malware without exploiting any technical vulnerability

Vulnerable third-party code

• Plugins, themes, and integrations extend what a site can do, and also expand the number of potential entry points
• A vulnerability in any third-party component can be exploited regardless of how secure the core platform is
• Inactive plugins and themes that are not kept updated remain vulnerable even when they are not in use on the site

Compromised external scripts

• Sites that load scripts from external providers (analytics tools, advertising networks, chat widgets) are exposed if those providers are compromised
• Malicious code delivered through a trusted external script reaches every site using that service, not just one

What does malware do to your site?

Redirects your visitors

• Redirect malware sends visitors to pages you have no connection to, often without any visual sign that a redirect happened
• These destinations may attempt to install malicious software on the visitor's device, collect login credentials, or run a scam
• The redirect is often conditional, targeting only visitors arriving from search results or only mobile users, to avoid being detected by the site owner who accesses the site directly

Damages your search visibility

• Search engines that detect malware on a site add a warning label to its listing in results. Click-through rates drop to near zero when that warning appears
• In more serious cases, the site is removed from results entirely until it is cleaned and a review request is approved
• Browser warnings block visitors before they reach the page at all, removing traffic from anyone who encounters them

Exposes your visitors' data

• Skimming malware captures sensitive information as visitors enter it. Payment details, passwords, and contact information are transmitted to the attacker while the form submission completes normally
• Neither the visitor nor the site owner is aware it is happening
• Exposure of visitor data carries legal consequences in regions with data protection regulations, and the reputational damage can outlast any technical fix

Holds your site hostage

• Ransomware encrypts the site's files and locks the owner out entirely. Regaining access requires either paying the ransom or restoring from a clean backup
• Site owners with recent backups stored separately from the server can restore without paying. Those without an offline backup have very few options

How do you know if your site has malware?

Signs the site owner can observe

• Files appearing in the site directory that no one on your team added
• Changes to core files or configuration files that no one made
• New admin accounts appearing in the dashboard
• The site loading noticeably slower without any content or code changes
• Being locked out of the admin panel

Signs reported from outside the site

• Visitors reporting that their browser is warning them not to visit your site
• A warning label appearing next to your site listing in search results
• Visitors reporting being redirected to unfamiliar pages after clicking links on your site
• Email bouncebacks or blacklist reports related to your domain

Why you might not notice anything

• Many types of malware are specifically designed to be invisible to site owners while targeting visitors
• Redirect malware often activates only for visitors arriving from search engines, leaving the site appearing normal when you visit it directly
• Running regular security scans is the only reliable way to catch infections that are deliberately designed not to be seen

How do you remove malware from a website?

Restore from a clean backup

• Restoring to a backup taken before the malware was introduced replaces every infected file with a verified clean version of the site
• After restoring, the vulnerability that allowed the attack must be identified and closed before the site goes back online. Otherwise the same infection recurs
• For guidance on setting up backups before an incident occurs, see the article on how to back up your website

Manual removal when no backup is available

• Infected files must be identified using a security scanner and cleaned or replaced with clean versions from the original source
• Backdoors left by the attacker must be found and removed. Leaving any part of the infection in place means the attacker retains access
• Manual removal is slower and less reliable than restoring from backup, particularly when backdoors have been installed

After the site is clean

• Change all credentials associated with the site, including admin accounts, hosting panel, FTP, and database
• Update all software to close any vulnerabilities that were exploited
• Submit a malware review request to search engines so that any warnings in results can be removed
• Monitor the site closely for several weeks to confirm the malware has not been reintroduced

For a complete guide on preventing malware from getting onto your site in the first place, see the article on how to protect your website from hackers. For what SSL certificates protect and what they do not protect against, see the article on what an SSL certificate is and how it works.

How WEMASY handles malware protection

WEMASY's hosting infrastructure includes firewall protection and traffic filtering at the network level, which blocks a significant share of automated attacks before they reach individual sites. Software updates are managed at the platform level, so sites on WEMASY are not exposed to vulnerabilities in outdated platform code.

Backups are included on all plans and managed automatically, with restore options available through the dashboard. In the event of an incident, restoring to a clean state requires no technical knowledge and no separate backup service.

See what is included at the WEMASY website builder, or review plan options on the pricing page.

Frequently asked questions