There is a widespread and fairly wrong idea: that malware is a computer problem, not a website problem. That if your laptop has antivirus, you are covered. The reality is that websites get infected constantly, and in most cases the owner finds out late, once Google has already put up the red "this site may harm your computer" warning or once the host has suspended the account for sending spam.
That is why it matters that your hosting includes malware scanning. Let us look at exactly what it does, what it cannot do, and how to use it properly.
How a website gets infected
It is almost never a targeted attack against you. That is the first thing to understand, because it completely changes how you protect yourself.
What is out there are automated programs sweeping the internet, testing millions of sites a day for a known weakness. They do not care whether you are a neighbourhood bakery or a bank. They look for an old plugin version, a theme downloaded from a pirate site, a weak password or a badly set file permission. When they find one, they get in and drop their code.
The most common entry points, by real-world frequency:
- Outdated plugins and themes. Number one by a wide margin. A vulnerability gets published, and within hours there are bots hunting for sites that have not updated yet.
- Nulled themes and plugins. Paid versions downloaded free from shady sites. They always come with a gift inside.
- Weak or reused passwords. Brute force attacks against the admin panel.
- The owner's own infected computer. A credential stealer takes the FTP passwords saved in the program you use to upload files.
What the server-side malware scan does
The antivirus running on the hosting side inspects the files in your account looking for known patterns of malicious code: backdoors, hidden redirects, injected advertising links, spam mailers.
It works at two moments. It runs scheduled scans across the whole account, and it also inspects files as they are uploaded or modified, which is when you have the best chance of catching something the moment it lands.
When it finds something, it reports it with the exact file path and the type of threat detected. Depending on configuration, it can also quarantine the file, meaning it takes it out of circulation without deleting it, so the site stops doing damage while you decide what to do.
That listing with concrete paths is the most valuable part. Without it, hunting for malicious code in a WordPress install with twenty plugins means looking for a needle in a haystack of thirty thousand files.
What it cannot do, and you should know it
This is where most explanations fall short, and it is precisely the part that saves you from a false sense of security.
It does not close the hole they came in through. This is the single most important line in this article. The antivirus cleans the symptom; the cause is still there. If you were infected through an old plugin and you only delete the infected files without updating that plugin, you will be reinfected within days. I have watched this repeat three times on the same site.
It does not catch one hundred percent. No antivirus does, including the one on your computer. Well-obfuscated malicious code can slip past, especially if it is new.
It does not inspect the database with the same depth. A large share of modern WordPress infections live in the database rather than the files: links injected into posts, admin users created on the sly, redirects planted in the site options.
It does not fix your password. If the entry point was a stolen credential, the problem is solved by changing passwords, not by scanning files.
The combination that actually saves you: antivirus plus backups
Here is the central point. Malware scanning on its own tells you that you have a problem. Backups solve it.
The procedure when an infection shows up, in order:
1. Take the site out of circulation while you work, if you can. An infected, publicly visible site accumulates search engine penalties every hour it stays up.
2. Read the antivirus report and note which files appear and what date they carry. That date tells you when they got in, which is the piece of information you need for the next step.
3. Restore a backup from before that date. It is infinitely faster and more reliable than cleaning file by file. You will never be certain you found every backdoor by hand; a full restore does give you that certainty.
4. Only now, close the hole. Update the core, every plugin and the theme. Delete the ones you do not use, which are free attack surface. Change every password: control panel, site administrator, database and FTP.
5. Scan again to confirm it came out clean, and review the list of administrator users in case one you never created is still sitting there.
Without backups, that five-step process turns into days of manual cleanup with an uncertain outcome. With backups, it is one afternoon. That is why the two tools are evaluated together rather than separately.
The other layers that come included
The antivirus is one piece of a larger set, and it is worth understanding what each part does.
Denial of service protection filters the floods of artificial traffic designed to knock the server over. It is an infrastructure defence, invisible while it works.
Security certificates encrypt the connection between visitor and site. They do not prevent an infection, but they prevent someone intercepting passwords along the way.
Automatic backups are the net under the trapeze.
None of the four replaces the others. A site with a certificate but no backups is just as exposed as one with backups but no updates.
What you still have to do yourself
No host can protect you from yourself. The list is short and boring, and it prevents ninety percent of incidents.
Update the core, the plugins and the theme, and do it often. Delete everything you installed to try out and never used. Never install pirated software. Use long, unique passwords for each service, with a password manager if that helps. Periodically review the list of users holding administrator rights. And check every so often that the backups are genuinely running and that you know how to restore them: a backup you have never tested is not a backup, it is an assumption.
Hosting that includes malware scanning, attack protection and automatic backups covers the part you cannot do from home. The rest is discipline, and no provider sells that.