Unsupported applications and plugins are a common cause of compromise.
Applies to: Website security, malware and Imunify360
A clean malware scan does not prove an application is secure. Effective recovery combines containment, credential rotation, patching, file and database review, and monitoring for reinfection.
Before you start
- Sign in to the Customer Portal and open the affected hosting service.
- Take a current backup before changing website files, databases, DNS or application configuration.
Step-by-step
- Back up the site.
- Apply core, theme and extension updates.
- Remove abandoned components. Read the confirmation text because the action may remove data or interrupt service.
- Test the site after updating.
- Schedule regular reviews.
Confirm the result
- The affected site is patched, credentials are rotated and no unauthorised file, user, scheduled task or redirect remains.
- A fresh scan and follow-up monitoring show no immediate reinfection while the website continues to function normally.
Common problems
| Symptom | Likely cause | What to do |
|---|---|---|
| Malware reappears after files are cleaned. | A vulnerable application, stolen credential, malicious database entry or scheduled task remains. | Contain the site, patch all code, rotate every related credential and inspect users, cron, database and access logs before restoring traffic. |
| A legitimate file is quarantined. | The scanner detected a suspicious pattern or an obfuscated component that requires review. | Do not restore it blindly; compare it with a trusted vendor copy and submit the file path and detection name for false-positive review. |
When to contact Tudor Internet
Open a ticket through the Customer Portal when the checks above do not resolve the issue, when an action is unavailable for your service, or when continuing could risk data loss or service interruption. Include the following so the request can be investigated efficiently:
- The affected domain and SiteWorx account
- The exact error text and time
- The last change made
- Relevant log lines with passwords and personal data removed
Do not send passwords, private keys, full payment-card details, one-time authentication codes or unredacted identity documents in an ordinary support reply.
Related articles
- Review Imunify360 malware quarantine and false positives
- Protect forms and public sites from abuse
- Imunify360 website security
- What to do after a malware alert
- Secure hosting and application passwords
Last reviewed: 2026-07-18.
