Suspected Compromised Web Hosting

Learn about the possible causes of a compromised web hosting account and what you can do after reporting a suspected compromise.

1. Possible Causes

2. Checking and Changing Login Credentials

3. Checking Local Systems

4. Blocked or Restricted Web Hosting

5. Frequently Asked Questions (FAQ)

1. Possible Causes

A compromised web hosting account may have the following causes and symptoms:

Abuse report
Unknown files or directories in the webspace
Unexpected redirects
Spam sent via the web hosting service
Blacklisting of a domain, IP address, or mail server
Unusually high load
Unusual traffic
Warnings from browsers, search engines or external security services
Altered CMS files, themes, plugins or configuration files

Describe as precisely as possible what you’ve noticed and how long the problem has been occurring. Also, check whether any restrictions or blocks are already in place on the web hosting service.

If a compromise is suspected, all relevant login credentials must be changed – especially in areas where symptoms are evident.

Change the following login credentials :

Customer Control Panel (CCP) Login
Web Hosting Control Panel (WCP) Login
FTP/SFTP Access
Database Access
Administrator accounts; e.g., WordPress, Joomla, or TYPO3
Email Accounts

3. Checking Local Systems

When a web hosting account is compromised, it’s usually not just a single file that’s affected. Keep in mind that deleting individual suspicious files is usually not enough.

Check the local systems used to access the web hosting account.

This is especially important if FTP clients, saved login credentials or older systems were used.

Run a full virus and malware scan on your own computer and check the following:

all devices used to access the web hosting
FTP clients and saved passwords

The login credentials should not be saved again until the local system has been checked.

Run a scan of your local system (for viruses and malware) before taking any further action. If the local system is compromised, newly set passwords can be intercepted again.

Additional recommended cleanup steps:

Restore a clean backup from a point in time before the incident. Then, update the CMS, plugins, themes and extensions.
Remove unnecessary plugins, themes and users.

If a clean backup is not available:

Restore content only selectively and after verifying it.
Reinstall plugins and themes only from trusted sources.
Change all login credentials.

4. Blocked or Restricted Web Hosting

Note that the cleanup can only be performed during a Maintenance Window if your web hosting account has been suspended or restricted – without a Maintenance Window, the suspension will not be lifted.

Specify a specific date and time as soon as possible in the Abuse form in the Customer Control Panel (CCP) – without a date and time, we cannot process your request.

General conditions for a Maintenance Window:

Duration: up to 120 minutes
Request: Can be submitted at any time
Processing: Monday – Friday, 10:00 a.m. – 6:00 p.m.
Lead time: at least 2 hours

Note that abuse-related processing is generally free of charge and simply requires a little patience.

If you need urgent activation, you can request it after 6:00 p.m. Note that a fee of €60 applies for this.

To request a Maintenance Window, log in to the Customer Control Panel (CCP) and click the magnifying glass icon next to the abuse report under the Abuse Notices menu item. Then, proceed to the Requesting a Maintenance Window step.

5. Frequently Asked Questions (FAQ)

No, as a general rule, you should assume that the entire affected web application has been compromised. Deleting individual files is usually not enough.

Web hosting can be compromised for various reasons. Common causes include outdated CMS versions, insecure plugins or themes, weak passwords, reused login credentials or compromised local devices.

We recommend regular updates, strong and unique passwords, secure plugins and themes, regular backups and checking local systems.

If web hosting has been restricted for security or abuse reasons, it cannot be reactivated without a Maintenance Window.

You may also be interested in:

Abuse Notices

Last update: 6 July 2026