What is Malware?

Malware is malicious code placed on a website, usually through an outdated plugin, a weak password or a vulnerable script.

Malware is any software written to do harm. On a website it usually takes the form of extra code that an attacker has slipped into your files or database. It might be a few lines added to a theme file, a hidden PHP script in your uploads folder, or a fake admin user in your database.

A typical example: a WordPress site runs a contact form plugin that hasn't been updated in two years. An attacker uses a known flaw in that plugin to upload a file, and from then on they can run code on your site whenever they like.

How websites get infected with malware

Most infections come from a handful of causes:

Outdated software: old versions of WordPress, plugins, themes or other CMS code with publicly known vulnerabilities.
Weak or reused passwords: attackers guess or reuse leaked passwords for admin, FTP or hosting accounts.
Nulled themes and plugins: pirated premium software often ships with a backdoor already inside.
Infected computers: malware on your own laptop can steal saved logins.

Common types of website malware

Backdoors let an attacker get back in even after you change your passwords.
SEO spam injects hidden links or pages selling pills or counterfeit goods, often visible only to search engines.
Malicious redirects send some visitors, often mobile users from Google, to scam sites.
Phishing pages imitate banks or email providers to collect logins.
Spam mailers use your server to send junk email, which damages your email deliverability.
Cryptominers use your server's CPU to mine cryptocurrency.

Why malware matters for your website

An infected site can be flagged by Google with a warning screen, removed from search results, blocked by browsers and blacklisted by email providers. Your visitors' data may be at risk, and on shared servers the host may suspend an account that's attacking others. Cleaning up is slower and costlier than prevention.

How to check for and prevent malware

Signs of infection include unfamiliar files or admin users, sudden redirects, spam in Google results for your domain, and warnings from your host or browser. To protect yourself:

Keep your CMS, plugins and themes updated, and delete ones you don't use.
Use strong, unique passwords and two-factor authentication.
Use a host that scans files and runs a firewall. On AblePage that's Imunify360 on every plan.
Keep regular backups so you can restore a clean copy.
Only install software from trusted sources.

Malware questions

How do I know if my website has malware?

Common signs are redirects to strange sites, spam pages showing in Google for your domain, unknown admin users or files, and browser or Google warnings. A server-side malware scanner will find most infected files.

Can malware on my website infect my visitors?

Yes, it can. Some website malware tries to push harmful downloads or phishing pages to visitors, which is why browsers block sites that are known to be infected.

Will restoring a backup remove malware?

Often, if the backup is from before the infection. You still need to fix the hole the attacker used, such as an outdated plugin or weak password, or they'll simply get back in.

Was this definition helpful?

Share this definition