How to Remove Malware from a Custom PHP Website

A custom PHP website has no vendor to issue a patch — you are the developer, so the cleanup and the fix are both in your hands. Find the injected code and backdoors, identify the vulnerability in your own code, fix it, and secure access. With a methodical approach it is very manageable.

Step 1: Secure access and back up

Change your cPanel, database and FTP passwords, and rotate any API keys or credentials your code uses. Take a full backup before changing anything.

Step 2: Locate the malicious code

Scan the account — see scanning with Imunify360 — and review recently modified files, unfamiliar files in upload directories, and anything obfuscated or out of place. Search specifically for webshells and backdoors, which attackers leave to regain access.

Step 3: Clean and verify

Remove the malicious files, and if you keep your code in version control, compare against it to find and revert injected changes precisely. Without version control, review your files carefully and restore clean copies from a backup. Check the database for injected content.

Step 4: Fix the vulnerability

This is the crucial step for custom code. Common flaws include unvalidated file uploads, SQL injection from unsanitised input, and exposed credentials. Find and fix the specific weakness, or the site will be re-exploited no matter how well you clean it.

Step 5: Harden

Validate all input, keep credentials out of the web root, ensure upload folders cannot execute PHP, and follow the hardening checklist.

Frequently asked questions

How do I find the vulnerability in my own code?

Trace how the attacker got in: check upload handlers, any code that builds SQL from user input, and anywhere external input is trusted. The error log and access logs around the infection time often point to the entry route.

Why does version control help so much?

It lets you diff live files against known-good code, instantly revealing injected changes, and lets you redeploy a clean version with confidence.

It keeps getting reinfected.

The underlying code flaw is still open, or a backdoor remains. Fix the specific vulnerability and remove every backdoor — cleaning symptoms without fixing the cause never holds.