If you just discovered malware on your hosting panel, you’re probably panicking a little. That’s normal. An infected cPanel account can take down your website, get your domain blacklisted by Google, and even lock you out of your own files. But before you do anything drastic, take a breath. This is fixable, and thousands of site owners go through this every year.<\/p>\n\n\n\n
I’ve spent years working directly with hosting accounts, cleaning up infections, and helping site owners recover from exactly this situation. In this guide, I’ll walk you through what causes an infected cPanel account, how to spot the signs early, and the exact steps to clean it, secure it, and stop it from happening again<\/p>\n\n\n\n
When people say they have an infected cPanel account, they usually mean malicious code has been planted somewhere inside their hosting environment. This could be in a WordPress theme file, a plugin, a database table, or even hidden inside a cron job you never set up.<\/p>\n\n\n\n
Your cPanel account is basically the control room for your hosting. If a hacker gets into it, they can inject scripts, create backdoors, or use your server to send spam. That’s why an infected cPanel account is treated as a serious security event, not a minor glitch.<\/p>\n\n\n\n
You won’t always get a warning banner telling you something’s wrong. Sometimes the signs are subtle. Here’s what to watch for:<\/p>\n\n\n\n
If even one of these sounds familiar, there’s a good chance you’re dealing with an infected cPanel account right now.<\/p>\n\n\n\n
Understanding the “why” matters because it shapes how you fix the problem and prevent it from happening again. In my experience, most infections trace back to one of these causes:<\/p>\n\n\n\n
Outdated software.<\/strong> Old WordPress cores, themes, and plugins are the single biggest entry point for attackers.<\/p>\n\n\n\n Weak passwords.<\/strong> Reused or simple passwords for cPanel, FTP, or WordPress admin logins are an open invitation.<\/p>\n\n\n\n Nulled or pirated plugins.<\/strong> Free “premium” plugins downloaded from shady sites almost always come with hidden malware baked in.<\/p>\n\n\n\n Shared hosting cross-contamination.<\/strong> On shared servers, one infected cPanel account nearby can sometimes spread to others if permissions aren’t locked down properly.<\/p>\n\n\n\n Missing firewall protection.<\/strong> No ModSecurity rules or Web Application Firewall (WAF) means bots can probe your site freely, all day, every day.<\/p>\n\n\n\n This is the part you actually came for. Follow these steps in order don’t skip ahead, since each step protects the next one.<\/p>\n\n\n\n Before touching any files, change your cPanel password, FTP password, database password, and WordPress admin password. Use a long, random password manager\u2013generated string. If the hacker still has old credentials, cleaning files won’t matter since they’ll just get back in.<\/p>\n\n\n\n I know it sounds counterintuitive, but back up the infected files and database before deleting anything. This gives you a fallback copy in case you accidentally remove something important, and it lets a security expert inspect the infection later if needed.<\/p>\n\n\n\n Use a reputable scanner such as ImunifyAV, Sucuri SiteCheck, or the malware scanner built into your hosting panel if available. This step identifies which files carry malicious code so you’re not guessing.<\/p>\n\n\n\n For core CMS files like WordPress core, themes, and plugins, the safest move is to delete them completely and reinstall fresh copies from the official source. Never patch a hacked core file manually unless you’re experienced. For custom files, remove suspicious code manually or restore from a clean backup taken before the infection date.<\/p>\n\n\n\n Malware often hides inside the Check your WordPress admin users, cPanel FTP accounts, and cron jobs. Delete anything you don’t personally recognize. Hackers often leave a backdoor admin account so they can walk right back in later.<\/p>\n\n\n\n Update your CMS core, all themes, and all plugins to their latest versions right away. Outdated software is the number one reason accounts get reinfected within days of cleanup.<\/p>\n\n\n\n Once cleaned, ask your hosting provider to rescan the account and lift any suspension. Most providers, including Ely Space, offer this as part of standard support once the infection is confirmed removed.<\/p>\n\n\n\n Cleaning up is only half the job. Here’s how to actually stay protected long term:<\/p>\n\n\n\n Following Google’s own Search Central guidelines on hacked sites<\/a> alongside these steps gives you a strong, lasting defense against future attacks.<\/p>\n\n\n\n If you’ve followed every step above and your site is still redirecting, still flagged by Google, or you simply don’t feel confident poking around server files, it’s time to bring in a professional malware removal service. A deeply infected cPanel account with layered backdoors can be tricky to fully clear without experience, and one missed file can mean reinfection within hours.<\/p>\n\n\n\nStep-by-Step: How to Fix an Infected cPanel Account<\/h2>\n\n\n\n
Step 1: Change All Your Passwords Immediately<\/h3>\n\n\n\n
Step 2: Take a Backup of the Infected State<\/h3>\n\n\n\n
Step 3: Scan with a Malware Scanner<\/h3>\n\n\n\n
Step 4: Clean or Replace Infected Files<\/h3>\n\n\n\n
Step 5: Check Database Tables for Injected Code<\/h3>\n\n\n\n
wp_options<\/code> or wp_posts<\/code> tables, disguised as widget scripts or footer code. Search for strings like eval(<\/code>, base64_decode(<\/code>, or unfamiliar <script><\/code> tags and remove them carefully.<\/p>\n\n\n\nStep 6: Remove Unknown Admin Users and Cron Jobs<\/h3>\n\n\n\n
Step 7: Update Everything<\/h3>\n\n\n\n
Step 8: Request a Malware Rescan from Your Host<\/h3>\n\n\n\n
How to Prevent Future Infections<\/h2>\n\n\n\n
\n
When to Call in a Professional<\/h2>\n\n\n\n