Treat a malware alert as a problem to investigate, contain and verify. Removing a suspicious file is only one part of recovery. You also need to understand how it appeared and whether credentials, application data or other websites were affected.
IN THIS ARTICLE
01 Preserve useful evidence
Record the alert time, domain, affected file or URL and the detection details. Save relevant access and application logs in protected storage. Avoid downloading suspicious files onto an ordinary workstation or publishing the contents of private configuration files in a support ticket.
- Open the correct SiteLock service and confirm which scanning or cleanup features are active. Review whether the alert is current, already remediated or awaiting action.
- Limit exposure where necessary. A maintenance page or restricted administrative access may be appropriate while a store or login system is investigated.
- Use the cleanup process included in your plan or request the appropriate assistance. A scanning-only subscription does not automatically include emergency remediation.
- Compare application files with trusted installation packages or a verified clean backup. Remove unsupported extensions and update the affected software through its official source.
- Change exposed passwords, API keys and other credentials. Review administrator users, scheduled tasks and unexpected forwarding or access rules that could preserve unauthorised access.
- Run follow-up scans and test normal website functions. Restore data from a suitable recovery point if needed, preserving legitimate changes made since that backup.
02 Find and close the entry point
Common causes include vulnerable extensions, stolen credentials and unsafe uploads. Ask your developer or support team to review the relevant evidence. A restore can reintroduce the same vulnerable component, and a firewall cannot correct every application defect.
When is a cleaned website ready to return to normal operation?
Check login, forms, downloads, checkout and outgoing email before lifting restrictions. Confirm that backups and monitoring work. If a search engine or security service flagged the site, use its official review process after cleanup rather than assuming the warning disappears immediately.
Keep a record of the cause, affected scope and corrective actions. If customer information might have been exposed, involve the person responsible for your business's incident and notification process. Do not make assurances about data safety until the evidence supports them.