Overview
If a website may be compromised, speed and containment matter. Avoid random cleanup attempts that can erase evidence or make recovery harder.
When this helps
Use this article when visitors report strange redirects, browsers show warnings, admin users appear unexpectedly, or security scans flag malware.
Recommended steps
- Record screenshots and exact URLs showing the issue.
- Do not delete files until a backup and scan plan are clear.
- Change passwords for admin, hosting, SFTP, and related accounts.
- Ask XMLA to scan files, database content, users, and plugins.
- Patch the cause before declaring the cleanup complete.
Information XMLA may need
- Affected URLs
- Warning message or screenshot
- Recent admin users or plugin changes
- Hosting access
- Backup availability
Next step
Contact XMLA immediately for emergency repair if the site redirects, downloads files, or displays browser security warnings.