Wordpress

Last updated: 21 December 2025

If you are reading this page, it means your website was detected performing malicious or abusive activity and has been temporarily disabled to protect our network and other customers.

We understand this can be stressful. This page explains why this happens, what your options are, and how we can help you get back online safely.

---

Why was my site disabled?

Your website was disabled because it showed signs of compromise, such as:

• malicious outbound connections
• brute-force or scanning activity
• malware files detected in the website files
• reports from our upstream providers or security partners

When this happens, we must act quickly to prevent:

• further damage to your website
• blacklisting of server IP addresses
• disruption to other customers

Disabling access is a temporary containment measure, not a punishment.

---

What does “disabled” mean?

In most cases:

• your website will not be publicly accessible
• email services are not affected
• your data has not been deleted

The site is simply prevented from loading until the issue is resolved.

---

Your options to get back online

You have three main options, depending on your situation.

---

Option 1 – WordPress Rescue Service (recommended)

If you would like us to handle everything for you, we offer a WordPress Rescue Service, which includes:

• full malware and backdoor cleanup
• removal of malicious files and processes
• WordPress core, plugin, and theme updates
• security hardening to reduce future risk
• verification before re-enabling the site

This is the fastest and safest way to get your site back online.

👉 Ideal if you are not technical or want peace of mind.

---

Option 2 – Reset and reinstall WordPress

If you prefer to start fresh:

• we can reset the website document root
• you reinstall WordPress from scratch
• you restore content manually or from a clean backup
• security plugins and updates must be applied before reactivation

👉 Suitable if the site is small or content can be easily recreated.

---

Option 3 – Clean the site yourself

If you choose to clean the site yourself:

• all malware and suspicious files must be removed
• WordPress core, plugins, and themes must be updated
• basic security measures must be in place
• the site will be reviewed before re-enabling

Please note: incomplete cleanups often result in re-infection.

---

What happens after cleanup?

Once cleanup or rebuilding is complete:

1. you notify our support team
2. we verify the site is no longer compromised
3. public access is restored

---

Preventing this from happening again

After recovery, we strongly recommend:

• keeping WordPress, plugins, and themes updated
• using strong passwords and two-factor authentication
• running a reputable WordPress security plugin
• removing unused plugins and themes

You can read our full Minimum WordPress Security Requirements article for details.

---

Need help deciding?

If you are unsure which option is best for you, open a support ticket and we will be happy to advise based on:

• site size
• content importance
• technical experience
• budget

---

Final note

Website compromises are unfortunately common and not a reflection on you.

What matters most is resolving the issue properly and preventing a repeat.

We’re here to help you get back online safely.

Last updated: 21 December 2025

To protect our network and our customers, all WordPress websites hosted with UK Cheapest must meet the minimum security requirements outlined below.

Websites that do not meet these requirements are at a significantly higher risk of being hacked and may be temporarily restricted if they pose a security or abuse risk.

---

Why this is required

WordPress is a popular platform and is frequently targeted by automated attacks.

Most compromises occur due to:

• outdated WordPress core
• vulnerable or abandoned plugins
• weak passwords
• lack of basic security protection

Once a site is compromised, it can be used to send spam, perform attacks, or host malicious content. These activities can result in service disruption or action by upstream providers.

---

Minimum security requirements (mandatory)

All WordPress installations must meet all of the following requirements.

1. Keep WordPress fully up to date

• WordPress core must be kept on the latest stable version
• All themes and plugins must be kept up to date
• Any themes or plugins that are not actively used must be deleted, not just disabled

---

2. Use strong login credentials

• Strong, unique passwords must be used for all WordPress admin accounts
• Do not reuse passwords from other websites or services
• Remove any unused admin or user accounts

---

3. Install a security plugin

A reputable WordPress security plugin must be installed and active.

Examples include (but are not limited to):

• Wordfence
• iThemes Security / Solid Security
• All In One WP Security

The security plugin should provide basic protection such as login rate limiting and malware scanning.

---

4. Protect the login page

At least one of the following must be enabled:

• login rate limiting
• CAPTCHA
• two-factor authentication (recommended)

This significantly reduces brute-force and credential-stuffing attacks.

---

5. XML-RPC protection

• XML-RPC must be disabled if it is not required, or
• protected via a security plugin

Unprotected XML-RPC is a common attack vector.

---

6. File and plugin hygiene

• No executable files or custom binaries should exist in the website document root
• Plugins and themes must only be installed from trusted sources
• Pirated, nulled, or unverified plugins/themes are not permitted

---

If your site is compromised

If a WordPress site is found to be compromised or generating malicious activity:

• the site may be temporarily restricted to prevent further abuse
• cleanup or rebuilding will be required before the site can be re-enabled

UK Cheapest offers a WordPress Rescue Service for customers who would like us to professionally clean and secure their site.

---

Important note

Meeting these minimum requirements significantly reduces risk, but no website can be guaranteed to be completely immune from attack. Ongoing maintenance and updates are essential for long-term security.

---

Need help?

If you would like assistance securing your WordPress site, or if you are unsure whether your site meets these requirements, please open a support ticket and our team will be happy to advise.