In short: If your host has suspended the website, that usually points to malicious code or abuse, but it can also be caution. Reactivation generally happens only once the cause is fixed. Affected? Get in touch right away. We clarify the situation remotely, clean up the account and coordinate the reactivation with your host.
Do not delete anything and do not rebuild anything right now. Not even at the host's request. Traces, logs and files must be preserved until everything is secured. Call us or write to us on WhatsApp, or use Report an emergency.
Was Your Website Suspended?
A suspension shows up in very different ways:
- the site is unreachable or shows a notice page from the host
- an email or ticket mentions "malware", "abuse", "phishing" or "spam"
- the hosting panel is locked, FTP and mail no longer work
- only individual functions are switched off, such as PHP execution or mail sending
- the website is running, but the host demands measures within a deadline
Read the notice carefully: it often contains file names, times or messages that are important for the analysis. If you were switched off as a precaution, you can usually tell because the host names no specific file. Even then, the check remains necessary, because a shutdown alone proves neither an infection nor its absence.
What to Do Right Now
- Secure the host's notice: Keep the email, ticket and a dated screenshot. What deadline was named?
- Do not clean up on your own. Anyone who deletes or re-uploads files can destroy traces and risks another suspension.
- Politely ask the host for the following: name the places where it found something, keep logs for the period, and preserve access read-only or via backup export. You will find a template for the request under How to ask your host about the patch status.
- Check mail sending: If spam came from the server, suspensions otherwise stay in place. Notes on the cause are in The server is sending spam.
- Note the access details: panel, FTP, SSH, database, CMS back end. Change passwords only after consultation.
- Clarify business consequences: Is the availability of the site or of email critical for your business? Then tell us right away.
- Tell us before you let deadlines pass or change hosts.
How Does PHP SOS Help?
- Assess the situation: We read the host's notice, clarify account, scope and systems, and discuss which functions are still reachable.
- Secure and contain: As far as the host grants access, we secure files, database and logs and cut off access that is no longer trustworthy.
- Check and clean up: We look for webshells, manipulated files, foreign accounts and mechanisms that reload malicious code. The process corresponds to Removing malware and webshells.
- Close the entry point and prove it: We clarify how the attacker got in and close the vulnerability. Then we prepare a traceable description that you can hand to the host for reactivation.
- Coordinate and harden: If you allow it, we talk to your host, accompany the reactivation and give recommendations for long-term operation.
How we handle the general incident is described on the page Website hacked: emergency help.
Who Is Responsible for Suspended Websites?
With shared hosting, the host controls the server and PHP, and you control your files and applications. That the host reacts to PHP2Shell does not mean that your site is clean. Conversely, it does not release your host from its own duties. The split is described in Shared hosting: what the host does and what you have to do. After a suspension it is worth asking which PHP version is actually running and whether the patch status is confirmed. We make no statements about how far a particular host has patched. The host has to confirm that itself in writing.
A switch can make sense, but only after the cleanup and not as an escape route, see Switching hosts after an incident. If Google has also flagged the site, Removing a Google warning describes the way afterward. That organizations take their sites offline as a precaution is a known pattern; what companies can learn from it is covered in Authorities take websites offline.
What Hosts Usually Want to See for Reactivation
Every host handles this differently, but the expectation is similar: you are to show that you have understood and eliminated the cause, and not just the symptom. Usual items are a short description of the findings, confirmation that malicious code was removed and credentials were changed, and a note on which software was updated. Some providers then check the account themselves, others require another ticket. We prepare these documents so that you can pass them on without technical knowledge. What commitments your host makes and how fast it responds is its own decision; we have no influence on that and say so openly.
What You Should Send Us
- the host's notice verbatim, with date and the deadline named
- name of the host, plan and, if known, the PHP version
- address of the website and other sites in the same account
- which functions are blocked (website, mail, panel, FTP)
- contact to the agency or developer, if there is one
Why PHP SOS
We work Made in Germany and, together with our partner network of cyber professionals, have specialized in IT security for over 25 years. You have one contact who accompanies your case and is available for questions with your host. We work remotely, with no travel, across Germany and Europe. Everything is documented; we make no promises about duration because it depends on the host and the findings. We work until the incident is closed and documented.
Affected? Call Us. We Help.
A suspension is annoying, but it is a clear reason to act. Get in touch now, by phone or WhatsApp, and we take over from the first message. Report an emergency now
Frequently asked questions
Why did my host suspend my website?
Common reasons are malicious code on the account, spam sending, unusually high load or attacks originating from your server. The host is thereby protecting its other customers. A note on the suspension is usually in the notice or in the customer area.
Does a suspension mean my website was really hacked?
Not in every case. Some providers have also taken websites offline as a precaution in connection with PHP2Shell. What is actually the case only a check can show. The suspension notice itself is a first, but not a complete, indication.
Can I simply ask the host to lift the suspension?
You can try, but it usually has little success if nothing has been cleaned up. Many hosts demand an explanation or proof of cleanup. If the suspension is lifted without fixing the cause, the next suspension is likely.
Should I switch to a different host?
Not in haste. A move takes the malicious code along if it moves with you, and destroys traces. First clean up and clarify the cause, then decide about the host.
How long does it take until my website is back online?
That depends on the extent of the infection, the state of the logs and the host's response, so we name no deadlines. After the first assessment we tell you what needs to be done and which steps depend on the host.