Your WordPress, Joomla, Drupal, Magento or PrestaShop site was infected, and now browsers and antivirus products warn visitors away. Getting delisted means proving to every vendor that the site is clean, and that only works if it really is.
This is the order we recommend.
Key takeaways
- Back up first, even an infected site, so you can investigate later.
- Clean files and the database; most CMS infections live in both.
- Fix the entry point: outdated extensions, weak passwords or a vulnerable server.
- Only request vendor reviews after an external scan confirms the site is clean.
Step 1: Contain and back up
Put the site in maintenance mode if possible, take a full backup of files and database, and note the date. Ask your host whether other sites on the same account are affected; shared accounts often reinfect each other.
Step 2: Clean the files
Replace core CMS files with fresh copies from the official source. Then check what remains:
- Reinstall plugins, extensions and themes from official sources; delete any you do not use.
- Search for PHP files in upload and media folders, which should only contain images and documents.
- Look for obfuscated code such as long base64 strings, eval() calls or unusual includes.
- Check .htaccess, index files and server configuration for injected redirects.
Step 3: Clean the database
Many infections inject scripts into posts, widgets, options or settings tables. Search the database for script tags pointing to unfamiliar domains and for admin users you did not create. Remove both.
Step 4: Close the entry point
Update the CMS and every extension, change all passwords (CMS admins, hosting, FTP/SFTP, database), rotate secret keys, enable two-factor authentication and consider a web application firewall. Our guide on stopping repeat blacklisting covers this in detail.
If the infection keeps returning, read WordPress malware keeps coming back. The same causes apply to other CMSs.
Step 5: Verify externally
Scan the site with Sucuri SiteCheck and VirusTotal, and visit it from a phone using mobile data. Some infections only show to first-time visitors or mobile users.
Step 6: Request delisting
Start with Google Search Console's review request, then submit to every other vendor still flagging you. Describe what you found, what you removed and what you changed to prevent reinfection. Our removal guide for security blacklists lists the main vendor processes.
Frequently asked questions
Can I just restore a backup?
Only if the backup predates the infection and you then fix the entry point. Otherwise you restore the same vulnerability.
Do security plugins remove all malware?
They help, but they often miss database injections and files outside the CMS. Combine them with manual checks.
How soon after cleaning can I request delisting?
As soon as external scans confirm the site is clean. Do not wait, but do not rush it either.
Should I tell vendors the site was hacked?
Yes. Being honest about the clean-up is much more effective than claiming a false positive.