Hostinger WordPress Malware Scan: How to Detect & Remove Infections
Hostinger's built-in malware scanner is accessible from hPanel → Security → Malware Scanner. It scans WordPress files and database for known malware signatures, backdoors, and suspicious code injections. Run scans weekly or after any security incident. For cleanup, Hostinger support assists with removal, or use Wordfence's malware cleaner for automated fix.
Using Hostinger's Built-In Malware Scanner
Run hPanel → Security → Malware Scanner to detect infected files. The server-level scanner works even when WordPress admin is inaccessible and identifies backdoors, shells, and injections.
Hostinger provides a server-level malware scanner accessible from hPanel:
- Log in to hPanel → Security → Malware Scanner
- Click Run Scan for your WordPress site
- The scanner checks all files against known malware signatures
- Results show: infected files, file paths, malware type, and severity
- For each infected file, you can view, quarantine, or delete it directly from hPanel
The scanner runs at the server level — it can detect malware even if your WordPress admin is inaccessible (which happens with severe infections). It checks PHP files for known backdoors, shell scripts, encoded malware, and spam injections.
Signs Your WordPress Site Is Infected
Common signs of WordPress malware on Hostinger:
- Redirects: Site redirects to spam or phishing pages (especially on mobile)
- Google warning: 'This site may be hacked' or 'Deceptive site ahead' in search results
- Spam pages: Unknown pages or posts appearing (Japanese keyword spam is very common)
- Slow performance: Sudden unexplained slowness from cryptomining scripts
- Account suspension: Hostinger suspends your account for malware activity
- Modified files: Core WordPress files show unexpected modifications in File Manager
- Unknown admin users: New admin accounts you didn't create
Step-by-Step Malware Cleanup on Hostinger
If Hostinger's scanner finds malware, follow this cleanup process:
- Don't panic. Take a backup of the infected site first (yes, even infected — for forensics and in case cleanup goes wrong)
- Change all passwords: WordPress admin, FTP, hPanel, database passwords. Do this immediately.
- Review infected files: Check if malware is in a plugin, theme, or WordPress core file
- If in a plugin/theme: Delete and reinstall from the official WordPress repository. Do NOT simply update — the infected file may persist.
- If in core files: Reinstall WordPress core: via WP-CLI (
wp core download --force) or hPanel → WordPress → Reinstall - Check database: Search for
<script>tags in wp_posts and wp_options tables via phpMyAdmin - Remove unknown users: WordPress admin → Users → delete any admin accounts you didn't create
- Scan again: Run Hostinger malware scanner + Wordfence scan to verify cleanup
Supplementing with Wordfence Malware Scanner
Hostinger's scanner catches server-level malware. Wordfence catches WordPress-specific threats at the application level. Use both:
- Install Wordfence Security (free) from Plugins → Add New
- Go to Wordfence → Scan → Start Scan
- Wordfence compares your files against the official WordPress repository, checking for modifications, injections, and backdoors
- For critical files, Wordfence lets you view the diff (what changed) and repair with one click
Wordfence's scan is more detailed than Hostinger's for WordPress-specific threats, while Hostinger's scan catches server-level malware that Wordfence might miss. Run both for comprehensive coverage.
Preventing Future Infections
After cleanup, harden your WordPress installation:
- Enable auto-updates for all plugins and themes (hPanel → WordPress → Auto Updates)
- Remove deactivated plugins — they're still exploitable even when inactive
- Install Wordfence with firewall enabled in Protection mode
- Use strong passwords + 2FA for all admin accounts
- Download plugins only from WordPress.org or verified commercial sources (never from 'nulled' theme sites)
- Run Hostinger malware scanner weekly — set a calendar reminder
- Keep daily backups enabled so you always have a clean restore point
Frequently Asked Questions
Does Hostinger scan for malware automatically?
Hostinger runs periodic server-level security scans. You can also trigger manual scans anytime from hPanel → Security → Malware Scanner. For proactive protection, install Wordfence which provides continuous monitoring and real-time threat detection.
Will Hostinger remove malware from my WordPress site?
Hostinger's scanner detects malware and Hostinger support can assist with cleanup guidance. Automated removal is limited — for guaranteed professional cleanup, consider Wordfence Care ($490/yr includes unlimited cleanups) or Sucuri ($199/yr with unlimited cleanups).
How did my WordPress site get hacked on Hostinger?
The most common causes: an outdated plugin with a known vulnerability (74% of hacks), a weak admin password, a nulled/pirated theme or plugin containing a backdoor, or compromised FTP/hPanel credentials. It's almost never a Hostinger server vulnerability.
Can I restore a clean backup instead of cleaning malware?
Yes — if you have a backup from before the infection, restoring it is often faster than manual cleanup. However, you must also change all passwords and update all plugins to prevent reinfection. The original vulnerability must be patched, or the attacker will return.
How often should I run malware scans on Hostinger WordPress?
Run Hostinger's malware scanner weekly and Wordfence scans daily (Wordfence can be configured to scan automatically). After any security incident (failed logins, suspicious activity), run an immediate scan. Monthly is the absolute minimum for any active site.
Secure Your WordPress on Hostinger
Built-in malware scanner, WAF, and daily backups. WordPress hosting from $2.99/mo.
Try Hostinger WordPressHenry Fontaine
Chief of Staff & COO, RocketLabs
AI-native operator building the future of search visibility. Part of the team behind 3 tech exits and 400+ programmatic SEO deployments.