Website Security
How to Detect a PHP Malware Attack on Your Website
- Published
- 3 min read
A PHP malware attack usually shows itself through unexpected redirects, unfamiliar files, sudden slowdowns, spam pages in Google or browser security warnings. If you notice any of these, scan your files, review recent changes and check your logs before the damage spreads.
What Is a PHP Malware Attack?
PHP malware is malicious code planted on your server. It usually gets in through an outdated plugin, a weak password or a vulnerable theme. Once inside, it can redirect visitors, steal data, send spam or leave a hidden backdoor for the attacker to return.
PHP runs a huge number of websites, including WordPress, so attackers know it well.
8 Warning Signs to Watch For
Sign: Strange redirects
What You Will See: Visitors land on scam, casino or pharmacy pages, often only from Google or on mobile
Sign: Unknown files
What You Will See: New PHP files in your uploads, root or theme folders
Sign: Sudden slowdown
What You Will See: Hidden scripts eating server resources
Sign: Spam in search results
What You Will See: Foreign language or pharmacy pages listed under your domain
Sign: Security warnings
What You Will See: "Deceptive site ahead" or "This site may be hacked"
Sign: New admin users
What You Will See: Accounts you never created
Sign: Hosting alerts
What You Will See: Suspended account or unusual outgoing email
Sign: Edited core files
What You Will See: Changed dates on files you did not touch
How to Check Your Site Step by Step
1. Run a Trusted Scan
Use a reputable malware scanner or your host's built in scanner. Treat a clean result as a good sign, not a guarantee.
2. Check Recently Changed Files
Over SSH, list PHP files changed in the last 7 days:
find . -type f -name "*.php" -mtime -7
Anything you did not change deserves a closer look.
3. Search for Suspicious Code
grep -rEl "eval\(|base64_decode\(|gzinflate\(|shell_exec\(" --include=*.php .
Some plugins use these functions for good reasons, so review each hit in context. Long, unreadable strings are the real red flag.
4. Look for PHP in Upload Folders
Uploads should hold images and documents, not code.
find wp-content/uploads -name "*.php"
Change the path if you are not on WordPress. Any result here is suspicious.
5. Review Config Files, Users and Scheduled Tasks
Open .htaccess, index.php and your config files and look for rewrites or lines you do not recognise. Then check for unknown admin users and unfamiliar cron jobs.
6. Check Google Tools and Server Logs
Open the Security Issues report in Google Search Console and run your domain through Google Safe Browsing. Search site:yourdomain.com to spot spam pages. In your server logs, watch for repeated POST requests to odd file names.
What to Do If You Find Malware
of 06 actions
Save a copy of the infected site for investigation, then enable maintenance mode.
How to Prevent a Repeat Attack
Maintain
01Update Core
Keep your CMS, plugins, themes and PHP version updated.
Remove Unused Access
Remove unused plugins, themes and user accounts.
Restrict
02Strong Auth
Use strong, unique passwords and two factor authentication.
Lock Uploads
Block PHP execution in your uploads folder.
Recover
03Off-site Backups
Run daily backups stored off the server.
Firewall and Monitoring
Add a web application firewall and file change monitoring.
FAQs
Frequently Asked Questions
The earliest signs are unexpected redirects, unknown PHP files, a sudden slowdown and spam pages showing in Google. Browser warnings and admin accounts you did not create are also strong signals that your site has been compromised.
Yes. Scanners rely on known patterns, so obfuscated or freshly written code can slip through. A clean scan is a good sign, not proof. Pair it with a manual check of recent file changes, upload folders and server logs.
It can. Infected sites often get flagged by Google, filled with spam pages or removed from results. Rankings usually recover after the site is cleaned and Google reviews it, but the timeline varies.
Simple infections can often be cleaned manually. The risk is a hidden backdoor that lets the attacker return. If the infection keeps coming back or you cannot find the entry point, bring in a professional.
