Malware scanning is the check that reads a website's files and database for code that should not be there: injected scripts, backdoors, spam pages and core files that changed. The scanner compares files with known bad patterns and flags odd behaviour. Finding the code is separate from deleting it and restoring a clean backup.
What the scan looks at
On a website, the scan reads the files the server executes and the rows in the database. It looks for injected scripts, new admin users, spam pages, and core files that no longer match a clean copy. A scan of your laptop is a different job. This page is about the site.
How a file gets flagged
- A signature matches a known bad snippet.
- The file behaves oddly: it phones home, or it appeared in a folder that should only hold images.
- A core file differs from the copy that shipped with that version of the software.
A match is a lead. It still needs a person, or a cleanup tool, to decide the file is foreign.
Where website malware hides
Themes and plugins that were nulled or left un-updated, the uploads folder, and the database, where a script is stored and printed into every page. A homepage that looks normal can still load a hidden script from one of those places.
A scan is not the cleanup
- Quarantine or remove the foreign file.
- Restore a backup from before the change if the core is damaged.
- Change the passwords and the database password.
- Update the software that let the file in.
research/site_components/pricing_real.json, read 30 October 2026, lists Website Security Consultancy at ₹4,200 a year, noted there as an audit plus malware cleanup. Anything outside that row is quoted before you pay. The parent service is website security. A related guide is DDoS protection. The next check is how to check a website for vulnerabilities.
Frequently Asked Questions
What is malware scanning?
It is a check of a website's files and database for injected scripts, backdoors, spam pages and core files that changed.
Does a scan remove the malware?
The scan finds candidates. Removal, a clean backup and a password change are the next job.
Where does website malware hide?
In themes, plugins, the uploads folder and the database. The homepage can look normal while it loads a hidden script.
What does the published security fee cover?
research/site_components/pricing_real.json, read 30 October 2026, lists Website Security Consultancy at ₹4,200 a year, noted there as an audit plus malware cleanup. It is not a promise that every hosting plan includes an unlimited scan.