What to Do After Malware Removal: A Hardening Checklist to Prevent Reinfection

Removing malware is only half the job. If you do not close the door the attacker came through, you will be cleaning the same site again next week. This checklist covers what to do after a cleanup to secure the site properly and keep it clean for good.

1. Change every password

Reset your cPanel, site admin, database and FTP passwords, plus any API keys — see creating strong passwords. Assume everything was exposed.

2. Confirm all backdoors are gone

Reinfection almost always means a surviving backdoor. Re-scan and re-check for webshells and backdoors before trusting the site.

3. Update everything

Patch your CMS, themes, plugins and any framework to current versions. Outdated software is the most common entry point — closing it is the highest-impact step.

4. Remove what you don't use

Delete unused plugins, themes, extensions and old files. Every extra piece of software is a potential vulnerability; a smaller footprint is a safer one. Remove any nulled (pirated) software entirely.

5. Turn on layered protection

Two-factor authentication — see enabling 2FA.
A web application firewall — see setting up a WAF and ModSecurity.
Login protection — see securing your login.
Correct file permissions — see file permissions.

6. Set up backups and monitoring

Take regular backups with an off-site copy, and scan on a schedule with Imunify360 so any recurrence is caught early.

7. Clear your search-engine flags

If you were blacklisted or warned, request a review once clean — see checking if your site is blacklisted.

Frequently asked questions

How do I know the site won't get reinfected?

You can never be certain, but removing every backdoor, patching the entry point, resetting all credentials, and adding layered protection makes reinfection very unlikely. Skipping any of these is what lets it return.

What's the single most important step?

Patching the vulnerability that let the attacker in. Cleaning without patching guarantees a repeat; patching closes the door for good.

How often should I scan afterwards?

Set up regular automated scans — weekly is reasonable for most sites, more often for stores. Early detection turns a potential disaster into a quick fix.