You may not know how or why, but you have reason to suspect that your website’s been infected with a virus, bug, or other form of malware.
What do you do now?
1. Confirm the Presence of Malware
If your website’s unusually slow to load, continually crashing, or otherwise acting strangely, you might suspect that it’s been infected with malware. But to avoid spending time and money fixing a problem that doesn’t exist, first make sure that malware has indeed infected your site.
- The best place to start is Google’s free Safe Browsing tool. Simply input your website’s URL into the “Check Site Status” field and Google will tell you whether any unsafe content exists on your site. The tool isn’t guaranteed to detect all forms of malware, but we’ve found it to be extremely effective in the past.
Click here to access Google’s Safe Browsing Tool.
- Whether Google has identified unsafe content on your site or not, it’s a good idea to take advantage of other free tools that run deeper searches for malware. Here are just two of the many available tools:
Sucuri: Will test not only for malware but also for spam content injected into your site, weaknesses in your firewall, and other security hazards.
Qualys: Requires you to fill out a form before use, but the tool gives you detailed feedback about the presence of malware, the status of your SSL certificate, and a range of other potential site vulnerabilities.
2. Remove the Malware
Once you’ve determined that there is in fact malware on your site, you have a few options for removing it.
- Remove the malware yourself. Depending on the nature of the malware and the severity of the attack, you may or may not be able to remove the malware on your own. If you choose to go this route, then you’ll need to find a trusted resource that describes the steps necessary for removing the specific type of malware that’s infected your site. You can search online for one of these sources if you feel comfortable with the idea of rooting out the malware yourself.
- Reach out to your web hosting company. Web hosting companies vary in what help they’re able to offer clients whose sites have been infected. Depending on the company, they may be able to restore your site to a previously backed up, malware-free version. Some hosting companies also provide malware removal services, but these will likely come at cost.
- Contact a site security company. There are many companies that specialize in removing malware from infected sites and systems. (Sucuri and Qualys, which provide the free diagnostic tools above, are just two examples.) These companies’ services tend to be costly, but they will get the job done without fail.
3. Prevent Future Attacks
Once your site is free of malware, you’ll want to protect against future attacks. There are a number of steps you can take on this front, including strengthening your passwords; installing a firewall; scanning your site regularly; and staying current with updates and patches.
- Strengthen your passwords. The majority of malware and other site security issues result from weak passwords. To be completely sure that you avoid another attack, change and strengthen all of your site-related passwords. The strongest passwords contain over 8 characters, a mixture of uppercase and lowercase letters, numbers and/or special characters, and no words found in the dictionary.
Here’s a list of the passwords you need to change:
-Administrative login passwords
Ideally, in addition to strengthening these passwords, you would also implement a 2 factor authentication method incase one of your passwords becomes compromised.
-Webhosting password
-Database passwords
-Primary FTP password
-Secondary FTP password - Install a firewall. Although there are many types of firewall products out there, they all aim aim to prevent malicious traffic from entering your site. By evaluating where traffic is coming from, how that traffic is behaving, and what information it’s requesting, firewalls can identify and block malware before it infects your site.
- Scan your site. Many kinds of malware are difficult to catch because they are single, disguised lines of script injected into your site’s code. Although it can be inconvenient, running site scanning software on a regular basis is an effective way to catch malware on your site before it’s done any damage.
- Check for updates and patches. Finally, if you’re running your website on a Content Management System (CMS) like Shopify, BigCommerce, Magento, or WordPress, then you’ll want to implement updates and patches on your site as soon as they’re released by the CMS. Staying current with these changes will ensure that your site isn’t exposed to any vulnerabilities that your CMS’s team has already identified and addressed.
Although it’s impossible to completely secure your site against every possible form of malware, the above steps will give you the best chance of preventing another attack.
