Signs your site is infected
- •Search results show someone else’s text instead of your pages — pharma, casino — or the site is flagged as dangerous,
- •Visitors get redirected elsewhere, especially on mobile,
- •Unknown files and admin accounts appear, timestamps on system files change,
- •Outbound traffic or load jumps sharply — the server is sending spam,
- •Your host emails you about malicious activity.
Where malicious code hides
| Location | What to look for |
|---|---|
| CMS core files | modified originals, stray .php files in system folders |
| Plugins and themes | nulled versions, foreign code, obfuscated inserts (eval, base64) |
| Database | scripts inside content and options, new or unexpected administrators |
| Uploads directory | executable .php files sitting among the images |
| Logs and cron | suspicious requests, malicious scheduled jobs |
How to check properly
- •Integrity comparison: diff core and plugin files against known-good versions — any difference is suspect,
- •Signature and heuristic scan: hunt for shell markers, encoded eval calls, backdoors,
- •Database check: new admins, injections in content and settings,
- •Log analysis: the entry point, attacking IPs, SQLi and RCE patterns,
- •Exposure check: readable .env and .git directories, backups left in the web root.
One frequent root cause deserves its own mention — pirated plugins. There is a separate write-up on why nulled plugins are dangerous and how to find them.
How ServerShield does it
Assembling all of this by hand is unrealistic for a business without a security team. ServerShield connects to the server over SSH in read-only mode and checks file integrity, malware, nulled plugins, rootkits, known CVEs and exposed secrets — on any CMS — then returns a report in plain language. You can run a scan from Pulse.
Frequently asked questions
Do online scanners find everything?
No. Public online scanners look at the site from outside and catch part of an infection — redirects, injections that show up in search results — but they cannot see malware sitting inside your files and database. A full check runs against the files and the database on the server itself.
Does my host’s antivirus not protect me?
Basic hosting antivirus catches known signatures but misses fresh backdoors, nulled plugins and modifications to the CMS core. That is why you need file-integrity checking and log analysis, not just a signature scan.
What should I do if the site is already hacked?
Do not wipe everything in a panic. Take a backup of the current state first for the investigation, find the entry point and every implant, clean them out, update the CMS and plugins, then rotate passwords and keys. Skip a step and the leftover backdoor gets you hacked again.