Website malware is code or content placed on a site to carry out unwanted activity. It can include a backdoor, a malicious redirect, a phishing page, spam links or code that abuses the server’s resources. Recognizing a symptom is the beginning of an investigation, not a complete diagnosis.
Record the actual behavior
Note the URL, time, device and steps that triggered the problem. Some behavior appears only on mobile devices, after a delay or when arriving from a search result. A normal homepage visit does not rule out a problem elsewhere.
- Unexpected redirects or pop-ups.
- Pages, links or administrator accounts nobody recognizes.
- Changed application files or executable files appearing in media directories.
- Security warnings, unusual resource usage or repeated reinfection after cleanup.
These observations need interpretation. An unfamiliar file can also belong to legitimate software, so preserve it and compare against trusted release files before deciding what it is.
Contain and preserve
Use an authorized, narrowly scoped action to limit harmful behavior while retaining investigation access. Keep private copies of affected files, relevant logs and the settings needed to understand the incident. Do not place recovery archives in the public website directory.
Deleting a suspicious file immediately can erase useful evidence and leave the entry point untouched. Similarly, a broad database restore can overwrite legitimate new orders or content.
Recover the application and its access
Work from trusted application packages and known-good data, remove confirmed persistence and fix the vulnerability or access problem that enabled it. Review accounts and integrations. Where access may have been exposed, arrange the appropriate credential changes through secure channels as part of the recovery plan.
Verify the original symptom
Repeat the affected page, device and navigation conditions. Check login, forms, static assets and any business-critical workflow. Review current integrity and scanner results as supporting evidence; neither a clean scan nor one repaired file guarantees complete recovery.
After recovery, use the WordPress security and maintenance checklist to improve updates, backups, account access and upload protection. Keep a record of the cause and fix so the same gap is not reopened later.