In short: If Google, your browser, your host or a customer warns about your website, foreign code is very likely running on your server. If you are affected, get in touch now. We clarify remotely what is being delivered, preserve the evidence, remove the malicious code, close the access and accompany you until the site is released again.
Do not delete anything and do not rebuild anything right now. If needed, put the site into maintenance mode so that visitors are protected, and leave files and logs unchanged. Report an emergency and we take over from the first message.
Are You Affected? How a Website Spreading Malware Shows Itself
A website that spreads malware or spam rarely stands out through a visible defect. Usually others report it first. Typical clues:
- The browser displays a red warning page in front of your domain, such as "Deceptive site ahead" or a message about harmful software.
- The Google Search Console shows a security message, or your site appears in search results with the note "This site may harm your computer".
- Visitors report pop-ups, unexpected redirects or downloads that occur only on mobile devices or only after a click from search.
- Your search results show pages that you never created, for example ads for medication or gambling in a foreign language.
- Your host writes about abuse, spam sending or unusual outgoing connections.
- Email from your company lands in the recipient's spam, or an unusual number of delivery failures come back.
- Your antivirus scanner reports nothing, yet the complaints do not stop.
Several of these points together strongly suggest a compromise. A single clue can also have a harmless cause. You should have it checked anyway, because every day with a warning page costs visitors, enquiries and trust.
What to Do Right Now
- Protect visitors: Switch the website to maintenance mode or have the host block it temporarily if malicious code is being actively delivered.
- Delete nothing: Remove no files, restore no backup, do no reinstallation over the old state before the evidence has been secured.
- Keep the logs: Ask your host not to overwrite access and error logs.
- Collect the messages: Take screenshots of the warnings and note the date, time and affected addresses.
- Name the access details: Who has access via CMS, FTP, SSH or hosting panel? Change passwords only after consultation and only from a clean device.
- Inform internally: Management, the data protection officer and, if you have a policy, the insurer should know.
- Do not file the Google request yet: A review only helps after the cleanup.
How Does PHP SOS Help?
- Assess the situation: We clarify which warnings exist, since when, and which systems and data may be affected.
- Secure and close: We secure files, database and logs before anything is changed. Then we block suspicious access and stop the delivery of the malicious code.
- Check and clean up: We compare the files with a clean state, look for webshells, backdoors and entries in the database, and remove them. More on this under Having malware and webshells removed.
- Harden and report: We close the entry point, check the PHP version and document the incident. We accompany you in lifting blocks and warnings.
We work remotely, with no travel, across Germany and Europe.
Why the Warning Often Comes Back
Anyone who removes only visible traces treats the symptom. Attackers usually set up several points of access: a hidden PHP file in an upload folder, a manipulated plugin, an additional admin account or a scheduled cron job that reloads deleted files. If you only tidy up the page that the browser shows, the same malicious code is back a few days later.
On top of that, many pieces of malware disguise their behavior. They deliver malicious code only to visitors who arrive via a search engine, or only to mobile devices. The owner opens the site directly and sees nothing. How such redirects arise is described in the post Website redirects to foreign sites, and why scanners reach their limits here is covered under Limits of malware scanners.
Google Warning and Spam in the Search Index
If Google has flagged your site as dangerous, lifting the flag runs through the Search Console. There you request a review as soon as the server is demonstrably clean. Which steps make sense is explained in the guide Removing a Google warning. If attackers have also created spam pages in your name, removing them from the index is part of the job; you will find notes in SEO spam in the Google index.
If your server sends spam, a form, a script or a mail account has usually been abused. Then a look at Server sends spam is worthwhile, because the reputation of your domain and IP address suffers with every further email.
How webshells show themselves can be read under Recognizing webshells. Since PHP2Shell, one more question has been added: an update closes the vulnerability but does not remove malware that is already there. That applies equally according to the BSI (German Federal Office for Information Security) situation reports and trade press.
What You Should Send Us
- the messages verbatim or as a screenshot, with date
- the affected addresses and, if known, ways of access (hosting panel, SSH, CMS)
- names of the agency, developers and host who know the system
- notes on what was last changed: updates, new plugins, new staff with access
- details of backups and their age
- a person with decision authority who is reachable
Incomplete information is no obstacle. We ask about whatever is missing.
Why PHP SOS
We are a service provider Made in Germany and, together with our partner network of cyber professionals, have specialized in IT security for over 25 years. You have one fixed contact; we work remotely and document every step so that you have evidence in hand toward host, insurer and customers. We promise nothing that nobody can keep, and we say openly what is proven, probable or unknown. We do not provide legal advice; questions on liability and reporting duties belong with the data protection officer and a lawyer.
Affected? Call Us. We Help.
If your website warns visitors, delivers malicious code or sends spam, every day it stays online like that counts. Get in touch now: call us or write to us on WhatsApp. We take over from the first message and stay with you until the incident is closed and documented. Report an emergency now
Frequently asked questions
Why does the browser show a warning about my website?
Browsers draw on lists of known dangerous sites. If your domain is listed there, the browser blocks access with a red warning page. Usually foreign code on the server is behind it, redirecting visitors or reloading malware.
Is it enough to report the warning to Google as resolved?
No. A review request to Google only helps if the malicious code was completely removed beforehand and the entry point closed. Otherwise the warning reappears shortly afterward, and a rejected request costs time.
My antivirus scanner finds nothing, yet the warning stays. Why?
Scanners mainly detect known patterns. Malicious code that is delivered only to certain visitors, search engines or devices often goes undetected. Then the only help is comparing the files with a clean state and analyzing the logs.
Why is my company's email suddenly landing in spam folders?
If your server or account was abused to send spam, the reputation of your domain and your IP address drops. Recipient servers then classify your email as suspicious. Only after the cleanup can the reputation be rebuilt.
Can I simply take my website offline?
Yes, and when malicious code is being actively delivered, that often makes sense to protect visitors. Do not delete anything while doing so. Logs and files show how the attacker got in.