# Having Malware and Webshells Removed From Your Website

> Have malware removed from your website: we find webshells and backdoors, clean up from trusted sources and permanently close the entry point.

Source: https://phpsos.de/en/leistungen/malware-entfernung/  
As of: 25/10/2026  
Provider: PHP SOS, PHP emergency help and server security. Immediate help via WhatsApp: https://wa.me/491736494914?text=Hello%20PHP%20SOS%2C%20we%20need%20help%20with%20our%20PHP%20server.%20Company%3A%20%E2%80%A6%20Website%3A%20%E2%80%A6

**In short:** If you want malware removed from your website, deleting individual files is rarely enough. We first preserve the findings, locate webshells, backdoors and hidden tasks, rebuild from trusted sources and close the entry point. Only then is the cleanup reliable.

## How to recognise malware on your website

Malicious code on websites often shows up only indirectly. Typical signs are redirects to foreign sites, spam content visible only to search engines or mobile devices, a Google warning in the search result, complaints from customers, or a block by the hosting provider because of spam sending. On the server, you see unknown PHP files, new admin accounts, modified `.htaccess` files or unexplained cron jobs.

After PHP2Shell, another worry comes on top: through CVE-2026-109618 and CVE-2026-109619, attackers can execute code without logging in. There are no published, confirmed indicators of compromise; detection relies on behavioral analysis. How webshells typically look and where they are located is described in [Detecting and removing webshells](https://phpsos.de/en/ratgeber/webshell-erkennen/).

## Removing malware from a website: why thorough matters more than fast

Attackers rarely drop just one file. Several backdoors in different places are usual: in upload folders, in plugins or themes, in must-use plugins, in the database, in cron jobs or in additional user accounts. If only the most conspicuous file is deleted, the malicious code comes back.

At the same time, the infected state is evidence. Anyone who cleans up too hastily loses the ability to determine whether customer data is affected. That is why we make a backup before every change. It costs little time and keeps all options open for you, including a later notification to the supervisory authority or your insurer.

> **Important:**
> A PHP update or a CMS update does not remove malware that is already on the server. And a cleaned website will be infected again as long as the entry point is open.

## Where malicious code typically hides

We check the following places in every cleanup, because in practice they are affected again and again:

| Location | Typical finding |
|---|---|
| Upload folders | PHP files with harmless-looking names or disguised as images |
| Plugins, themes, modules | additional files or modified original files |
| Configuration | injected lines in `.htaccess`, `.user.ini` or entry files |
| Database | foreign admin accounts, scripts in content or options |
| System | cron jobs, additional SSH keys, processes with no apparent purpose |
| Caches and temporary folders | copies of malicious code that reappear after deletion |

The connection matters: a single finding rarely explains the whole incident. Only the overall picture shows how the attacker proceeded and whether they took credentials with them.

## How does PHP SOS help?

1. **Preserve:** We make a copy of files, database and logs in the infected state. It is kept for later analysis.
2. **Search:** We compare program files with the vendor's originals, check upload folders for executable code, and search the database, cron jobs, user accounts and server configuration. For WordPress environments we proceed as described in [Finding backdoors in WordPress](https://phpsos.de/en/ratgeber/backdoor-wordpress-finden/).
3. **Clean up:** We reinstall the core, extensions and themes from trusted sources instead of patching suspicious files one by one. We examine your own content and uploads separately and carry over only what is harmless.
4. **Close the cause:** We patch PHP and the application, remove foreign accounts and replace all credentials and keys that the attacker may have seen.
5. **Follow-up check:** After the cleanup we watch the website for renewed changes and support you in having a Google warning reviewed through Search Console. More at [Removing a Google warning](https://phpsos.de/en/ratgeber/google-warnung-entfernen/).

For admins, a harmless first look at recently modified PHP files:

```bash
# PHP files in the web directory that were changed in the last 10 days
find /var/www -type f -name "*.php" -mtime -10 -printf "%TY-%Tm-%Td %TH:%TM %p\n" | sort
```

The result is an indication, not proof: attackers can alter timestamps.

## What you get and what we need

You receive a report with the malicious components found and where they were located, the cleanup measures, the list of replaced credentials and the probable entry point. We clearly separate what is proven, what is probable and what is unknown.

We need from you:

- **access** to the server or hosting panel, the CMS backend and the database
- **a contact person** who can approve password changes and shutdowns
- **information** about the agency, developer or hosting provider and about custom changes to the system
- **existing backups** with their dates, so that we can assess which state might be clean
- **access to Google Search Console**, if a warning is displayed

## What we do not promise

We do not promise that every backdoor on every system will be found with certainty if logs are missing or the infection dates back a long time. When the situation is unclear, we recommend rebuilding on a fresh server to which only verified content is transferred. That takes more effort but is often the more reliable route. Nor do we predict when Google or other services will remove a warning; those providers decide that.

If it must be established in a court-admissible way what exactly happened and which data is affected, we bring in [IT forensics](https://phpsos.de/en/leistungen/it-forensik/) with specialised partners. In an acute attack that is still ongoing, the work begins with the [emergency help for a hacked website](https://phpsos.de/en/leistungen/website-gehackt-notfallhilfe/).


## Frequently asked questions

**Is a malware scanner plugin enough to clean up my website?**  
A scanner finds known patterns, but not every backdoor. Webshells are often obfuscated, hidden in images, caches or the database, or anchored as a cron job. A scanner is a tool, not a complete cleanup.

**Can I simply restore an old backup?**  
Only if it is certain that the backup was made before the break-in and the entry point is closed afterwards. Otherwise the website is clean for a short time and gets infected again the same way.

**Why does the malware keep coming back after I delete it?**  
Usually there is a second backdoor, a cron job, a manipulated admin account, or the vulnerability is still open. Only when all persistence mechanisms have been found and the cause removed does the cleanup last.

**Does a PHP update remove existing malware?**  
No. A patch closes the vulnerability but does not remove malware that has already been planted. These are two separate work steps.

## Sources

- [OWASP Cheat Sheet Series](https://cheatsheetseries.owasp.org/)
- [Google Search Console Help](https://support.google.com/webmasters/)
- [php.net: Security announcements](https://www.php.net/)