Hosting provider says our site is clean, but a security scanner flags malware — who do we trust?

This is called a conditional redirect. The attackers serve a clean page to desktop visitors to evade detection, targeting only mobile users. To test it visit the site from your phone on cellular data via a search engine link; you'll see the malware trigger with your own eyes.

Don't expect application-level cleanup from shared hosting support. As long as the server doesn't crash, they won't touch file contents, and their terms explicitly state that website security is the user's responsibility. You need to get the site professionally cleaned ASAP.

Take a full backup of the site right away. Then install a reputable WordPress security plugin and run a deep database scan. Strip out any foreign script tags and terminate all active user sessions.

curl the site from your terminal while spoofing a mobile user-agent but youll clearly see that hidden redirect js being pushed to the browser your hosting company just didnt wanna bother.

Three-step emergency action plan to diagnose this: 1) Completely remove all unused old themes and plugins from the site, 2) Manually check the configuration file in the WordPress root directory for any foreign code blocks, 3) Log into the search engine indexing console and check whether any security warnings have been flagged.

We wasted three weeks on a similar case; we did nothing because the hosting provider said it was clean. In the end, the search engine blacklisted our site with a red warning screen and our organic traffic tanked by 85%. We had to pay an external expert 600 dollars to get it cleaned up.

We ran into the exact same contradiction on our office site last year. Late at night, the site was redirecting to fake pharmacy sites, but when hosting support opened the ticket in the morning, the site showed up clean. Turns out the malicious code was scheduled to trigger only at night. That's why external checkers give way more honest results.

It's rare to find an explanation this clear. When making a decision, first look at what data you have on hand.

If 2FA is on, a stolen password alone is useless. I'm also curious if anyone does it differently.

There's one point I'm curious about... Just because everyone does it doesn't mean it's right.

When we decide without measuring, we always end up in the same place. Good luck with that.

Following.

Noted, thanks.

I'd say don't rush. Don't hesitate to ask; those who don't ask always pay more.

Of course, it varies if your situation is different.

I disagree with you on this point. Most incidents start with a leaked password, not a vulnerability.

Correct me if I'm wrong.

Let me summarize the topic, since several different answers were given. Mistakes made on the website security checker side are usually reversible but expensive.

Your time to detect an issue directly determines its cost. Of course, it varies if your situation is different.

I'll try it.

I didn't know that. Most incidents start with a leaked password, not a vulnerability.

That's all, sorry if I went on too long.

Thanks for writing this, that's the right way. Don't hesitate to ask; those who don't ask always pay more.

Of course, it varies if your situation is different.

I disagree with you on this point. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

If I were you, I'd go this route.