If your host emails you that your site is infected and offers a paid cleanup in the same message, verify the claim before paying. Ask for the file paths and detection signatures, check those files yourself over SFTP, and run two independent external scanners. Most of these notices are real findings. A meaningful number are stale or wrong.
What does a "malicious content detected" email from your host mean?
It means an automated scanner on the hosting server flagged one or more files as matching a malware signature. It does not mean a human looked at your site. It does not mean the file is executing. And when the same email contains a link to buy a cleanup service, the scanner and the sales pitch came from the same system.
We see this pattern most often from budget and mid-tier shared hosts. The email is usually short, uses words like "malicious content" or "suspicious activity," gives a vague timeline ("your account may be suspended within 48 hours"), and ends with a $149 to $499 remediation offer. Some hosts suspend first and explain later, which is a separate problem we covered in why a host suspends an account before the bill is due.
The urgency is doing work here. A site owner who reads "may be suspended in 48 hours" at 11pm on a Friday is not going to run their own verification. They are going to click the button. That is the point of the email design.
None of this means the notice is wrong. Malware on WordPress is common and getting worse. According to Sucuri's 2024 Website Threat Research Report, SEO spam appeared in 63% of infected sites they cleaned, and backdoors in over 60%. Patchstack recorded 7,966 new WordPress vulnerabilities in 2024, a 34% increase over the prior year. Infections happen constantly.
What it means is that the party telling you about the infection is also the party selling the fix, and they measured the problem with a tool you cannot see.
How to verify a malware notice in 15 minutes
Reply to the host and ask for three specific items. Then check them yourself. You need SFTP access and about fifteen minutes.
Ask for the evidence. Send a reply asking for the full server path of each flagged file, the name of the detection signature that matched, and the timestamp of the scan. Any legitimate scanner produces all three. If support replies with "our system detected malicious content on your account" and nothing more, you have a sales email, not a scan report.
Download the flagged file and read it. Pull the actual file over SFTP. Open it in a text editor. You are looking for a few things: long base64 blocks passed to eval(), gzinflate(), or assert(); obfuscated variable names in a file that should be readable; a PHP file sitting in /wp-content/uploads/, which has no business containing executable code. If the flagged file is a minified JavaScript bundle from a caching plugin or a theme's compiled asset, you are probably looking at a false positive.
Run two independent external scanners. Sucuri SiteCheck and VirusTotal's URL scanner both work from outside your server and cost nothing. They check for browser-visible injections, blacklist status, and known bad payloads. If both come back clean and your host's report cites a single file inside a backup archive, the story is not adding up.
Check for the other symptoms. A real compromise rarely leaves one file. Log into WordPress and check Users for admin accounts you do not recognize. Check Tools > Site Health. Look at wp-config.php and .htaccess for appended code at the bottom. In your host panel, look at the mail log for outbound volume you did not generate. Check Google Search Console for security issues and for indexed pages you never created.
Compare core file checksums. Install WP-CLI or use a plugin, then run wp core verify-checksums. This compares every WordPress core file against the official release hashes. Modified core files are near-conclusive. Clean checksums plus a clean external scan plus no rogue admins means the host's finding is either contained, stale, or wrong.
If you cannot get into the site at all, the cause may not be malware. Our guide on checking DNS before assuming your WordPress site was hacked walks the triage order for that scenario.
Real infection or false positive: how to tell the difference
A real infection produces multiple corroborating signals. A false positive produces exactly one flagged file with no downstream evidence. Here is the split we use when a client forwards us one of these emails.
| Signal | Points to a real infection | Points to a false positive |
|---|---|---|
| Number of flagged files | Several, across different directories | One, isolated |
| File location | /wp-content/uploads/, core directories, theme root | Inside /backups/, /vendor/, a quarantine folder |
| Core checksums | Fail on one or more files | All pass |
| External scanner result | Sucuri or VirusTotal flags the live site | Both report clean |
| Admin users | Unknown account, recent creation date | Only accounts you created |
| Outbound mail | Spike in sends you did not trigger | Normal volume |
| File modification dates | Recent, clustered, outside your deploy window | Match your last plugin update |
| What the code does | Writes files, opens shells, injects links | Minified, encoded for legitimate reasons |
The most common false positives we encounter, in rough order of frequency:
Backup archives containing old malware. A .zip or .tar.gz from before a previous cleanup still contains the infected files. The scanner reads inside the archive and flags it. Nothing in there executes. Delete the archive and the finding disappears.
Minified or obfuscated legitimate code. Some caching and optimization plugins write encoded strings. Some commercial themes ship license-check code that pattern-matches to a malware signature. Some analytics snippets look ugly enough to trip heuristics.
Quarantined files that were already handled. You cleaned the site three weeks ago, the plugin moved the file to a quarantine directory, and the server-side scanner is now reporting the quarantine contents as a fresh infection.
Shared-IP blacklist inheritance. On shared hosting, a neighbor's compromise can get the server IP listed. Your site is clean and the report is about the address, not your files.
The reverse failure is worse and more common. Signature-based scanners miss what they have not seen. We wrote about why free WordPress malware scanners have blind spots and about how AI is mass-producing WordPress malware variants that signature matching cannot catch. A "clean" scan from your host's tool is not proof of a clean site either.
What does a host cleanup service actually cost?
Published remediation prices range from roughly $150 to $500 for a one-time cleanup at the major hosts, with some charging monthly for ongoing protection. The upsell attached to a detection email usually sits at the higher end, because urgency prices well.
| Option | Typical cost | What you get |
|---|---|---|
| Host's emergency cleanup upsell | $149-$499 one-time | Automated scan and file removal, often no root-cause work |
| Sucuri Platform | $199-$499/yr | Unlimited cleanups, WAF, monitoring |
| Wordfence Care/Response | $490-$1,950/yr | Response includes incident handling by their team |
| Independent specialist | $200-$800 per incident | Manual cleanup, usually a written report |
| TopSyde managed hosting | From $89/mo per site | Sentinel scanning, cleanup, hardening, no separate cleanup invoice |
The number that matters is not the cleanup fee. It is the reinfection rate. A cleanup that removes the visible payload and leaves the entry point open buys you two to six weeks. We have written about the reinfection cycle and why sites get hit again a week after cleanup. If you pay $299 four times in a year, you spent $1,196 to keep a hole open.
Ask any cleanup provider, including us, one question before you pay: will you tell me how it got in? A provider who cannot identify the entry vector, an outdated plugin, a stolen admin password, a vulnerable theme, a compromised FTP credential, has not finished the job. Downtime and reputation damage during a repeat infection cost more than the cleanup does. We put real figures on that in what a WordPress security breach costs.
What to do if the infection is real
Confirmed compromise changes the priority order. Speed matters, but so does evidence.
Take a full backup of the current infected state before you change anything, and label it clearly. You need it for forensics and you do not want to overwrite it. Then rotate every credential: WordPress admin passwords, database password, SFTP and SSH keys, hosting panel login, and any API keys stored in wp-config.php. Force logout of all sessions so stolen cookies stop working.
Do not restore a backup blindly. If the infection has been present for three weeks and your restore point is from last Tuesday, you are restoring the malware. Check the file modification dates on the flagged files first, then pick a restore point that predates them. Our step-by-step WordPress malware removal guide covers the full sequence, and the checklist for cleaning a hacked WordPress site handles the parts people skip, like database-level injections and scheduled cron backdoors.
Then close the entry point. Update everything. Remove plugins you are not using rather than deactivating them, because deactivated plugin files are still reachable over HTTP. Check whether the exploited component had a known CVE at the time of compromise. If it did, your patching cadence is the actual problem, not the malware.
Finally, request review in Google Search Console if you were flagged, and watch Search Console for two weeks. SEO spam injections often survive a file cleanup because the damage lives in your index, not your filesystem. We covered that recovery path in fixing SEO spam and hacked 301 redirects.
Why the detect-then-bill model exists
Shared hosting margins are thin. A host running tens of thousands of WordPress sites on commodity hardware needs revenue lines beyond the $4.99 introductory rate, and security services are the easiest attach. The scanner runs anyway for the host's own IP reputation. Turning its output into an email with a buy button costs nothing.
The incentive problem is that nobody at that host is rewarded for preventing the infection. Prevention produces no invoice. This is the same structural issue behind why hosting bills double at renewal: the pricing model assumes you will not audit it.
Managed hosting inverts that. When cleanup is included in the plan, the host loses money on every infection, so the host has a reason to block the attack before it lands. That is why virtual patching and WAF rules matter, and we explained the mechanics in how managed hosts handle WordPress zero-days.
On TopSyde plans, TopSyde Sentinel scans every site daily and looks at behavior rather than matching a signature list, which is what catches the AI-generated variants that signature databases have not indexed yet. When it finds something, cleanup is part of the plan, not a separate transaction. Our support team responds in under 2 hours during business hours, and monitoring runs 24/7. You can see what is covered on the pricing page, and every plan carries a 30-day money-back guarantee if the fit is wrong.
If you are sitting on a detection email right now: do the 15-minute verification first. If it is a false positive, you saved a few hundred dollars and learned something about your host. If it is real, you now have the file paths and timestamps that make a proper cleanup possible instead of a guess. Either way, you are making the decision instead of the email making it for you.
Frequently Asked Questions
Can my host suspend my site for malware without warning?
Yes. Most hosting terms of service allow immediate suspension for content that threatens server integrity or the provider's IP reputation, and outbound spam or phishing pages usually trigger it fastest. Read your provider's acceptable use policy so you know the threshold, and keep an off-server backup so a suspension does not also lock you out of your own files.
Is a free external scanner enough to confirm my site is clean?
No. Tools like Sucuri SiteCheck and VirusTotal only see what a browser sees, so they catch visible injections and blacklist status but miss server-side backdoors, database-level spam, and dormant payloads. Use them to corroborate, then verify core file checksums and review flagged files directly over SFTP.
Should I pay my host's cleanup fee if the infection is confirmed?
You can, but ask first whether the service identifies the entry point and includes a written report. A cleanup that removes the payload without closing the vulnerability tends to be followed by reinfection within weeks, which turns a one-time fee into a recurring one. Compare that total against a managed plan where cleanup is included.
How fast should I act after getting an infection notice?
Verify within a few hours, then act the same day if it is confirmed. Backdoors get used to install more backdoors, and Google can flag a site for malware quickly once the payload is serving to visitors. The verification pass is short enough that there is no reason to defer it.
Founder & Lead Developer
20+ years full-stack development, WordPress, AI tools & agents
Colton is the founder of TopSyde with 20+ years of full-stack development experience spanning WordPress, cloud infrastructure, and AI-powered tooling. He specializes in performance optimization, server architecture, and building AI agents for automated site management.
