{"id":5749,"date":"2026-11-03T10:00:00","date_gmt":"2026-11-03T07:00:00","guid":{"rendered":"https:\/\/webterra.com.ua\/?p=5749"},"modified":"2026-11-03T10:00:00","modified_gmt":"2026-11-03T07:00:00","slug":"website-has-malware-what-to-do","status":"publish","type":"post","link":"https:\/\/webterra.com.ua\/en\/website-has-malware-what-to-do\/","title":{"rendered":"Your website has malware: what to do"},"content":{"rendered":"\r\n<p class=\"wp-block-paragraph\">Owners rarely learn about an infection from an antivirus or their host. Usually it&#8217;s a customer: &#8220;I opened your website on my phone and it sent me to a casino.&#8221; Or from Google, which suddenly shows a red warning screen instead of the home page. The first reaction is panic and an urge to delete or restore something right now. Those first hours are when most mistakes happen \u2014 the ones that stretch the cleanup over weeks and let the infection return days later.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">We clean up hacked websites regularly \u2014 mostly WordPress, but the principles are the same for any CMS. In this article we&#8217;ll go through how to recognise an infection, what an owner should do in the first hours, what a proper cleanup looks like, how to win back Google&#8217;s trust and, most importantly, how to close the hole so it doesn&#8217;t happen again.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">Where a website &#8220;virus&#8221; comes from<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">&#8220;Virus&#8221; is a loose word here. Usually we&#8217;re talking about malicious code that an attacker has planted in the site&#8217;s files or database. It can redirect visitors to other sites, show spam to search engine crawlers, send out email, steal data from payment forms, or simply keep a back door to the server open for later. Sites are rarely targeted personally: automated scanners check thousands of addresses daily for known vulnerabilities.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">In our projects, the most common entry points are:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li><strong>Outdated plugins and themes.<\/strong> The developer released a fix long ago, but the site hasn&#8217;t been updated for months. For bots, that&#8217;s an open door.<\/li>\r\n\r\n\r\n<li><strong>Nulled premium themes and plugins.<\/strong> People download them from shady sites to avoid paying for a licence. Very often a back door is already built into the archive.<\/li>\r\n\r\n\r\n<li><strong>Weak or reused passwords<\/strong> for the admin panel, hosting or FTP. A password that has already leaked from another service is the first one attackers try.<\/li>\r\n\r\n\r\n<li><strong>An infected computer on the team.<\/strong> Malware steals saved FTP or hosting panel passwords, and the attacker simply logs in like a legitimate user.<\/li>\r\n\r\n\r\n<li><strong>Forgotten copies of the site.<\/strong> Folders like <code>\/old\/<\/code> or <code>\/test\/<\/code>, staging subdomains running an old CMS version nobody updates.<\/li>\r\n\r\n\r\n<li><strong>Neighbours on shared hosting.<\/strong> On cheap shared hosting with poorly configured permissions, an infection can spread from one site to another within the same account.<\/li>\r\n\r\n<\/ul>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Depending on what the attacker wants, an infection usually falls into one of a few types, and the type determines how it shows itself:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li><strong>Redirects<\/strong> \u2014 visitors are sent to casinos, fake prize draws or dubious shops.<\/li>\r\n\r\n\r\n<li><strong>SEO spam<\/strong> \u2014 thousands of pages or hidden links are generated on your site to promote other sites using your domain&#8217;s reputation.<\/li>\r\n\r\n\r\n<li><strong>Phishing<\/strong> \u2014 fake login pages for banks or email services are placed deep inside your site.<\/li>\r\n\r\n\r\n<li><strong>Mass mailing<\/strong> \u2014 your server is used to send spam, and your own email reputation takes the hit.<\/li>\r\n\r\n\r\n<li><strong>Skimmers<\/strong> \u2014 a script on the checkout page captures customers&#8217; card details.<\/li>\r\n\r\n<\/ul>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Knowing the source isn&#8217;t about blame. Without it, cleaning a site is like tidying a room with the window wide open: a week later everything comes back the same way.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">Signs your website is infected<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Modern malware tries to stay invisible to the owner, often showing itself only to visitors from search, on phones, or on a first visit. An administrator on the office computer may see nothing for weeks, so look at your site through different visitors&#8217; eyes.<\/p>\r\n\r\n\r\n\r\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>What you notice<\/th><th>What it may mean<\/th><th>Where to check<\/th><\/tr><\/thead><tbody><tr><td>Visitors are sometimes redirected to other sites<\/td><td>A conditional redirect: only for mobile, only from search, or only on the first visit<\/td><td>A smartphone on mobile data, a click from Google, a private window<\/td><\/tr><tr><td>A red warning screen in the browser<\/td><td>The site is on Google Safe Browsing lists<\/td><td>Search Console, &#8220;Security issues&#8221; report<\/td><\/tr><tr><td>&#8220;This site may be hacked&#8221; label in search results<\/td><td>Google found spam pages or altered content<\/td><td>A <code>site:yourdomain<\/code> search, Search Console<\/td><\/tr><tr><td>Thousands of pages about pills, casinos or replicas in the index<\/td><td>A spam injection: the pages are generated by a script<\/td><td>&#8220;Pages&#8221; report in Search Console, a <code>site:<\/code> search<\/td><\/tr><tr><td>Your host suspended the account or complains about spam<\/td><td>The site is sending spam or attacking other servers<\/td><td>Emails from your host, mail logs, server load<\/td><\/tr><tr><td>New administrators nobody created<\/td><td>The attacker has a foothold in the admin panel<\/td><td>The CMS user list<\/td><\/tr><\/tbody><\/table><\/figure>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Other warning signs: unfamiliar PHP files in the uploads folder, a sharp rise in server load without a rise in traffic, company emails that suddenly start landing in spam, strange scripts on the checkout page, a sudden drop in organic traffic. Make a point of checking the site on a smartphone: the mobile version is what Google judges you by, and it&#8217;s where hidden redirects most often live. We covered why the mobile version matters so much in <a href=\"https:\/\/webterra.com.ua\/en\/succeeding-with-mobile-first-indexing\/\">&#8220;Succeeding with mobile-first indexing&#8221;<\/a>.<\/p>\r\n\r\n\r\n\r\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"640\" src=\"https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-img1-1024x640.webp\" alt=\"Signs of a website infection: a search result label, spam pages, a red browser warning, a mobile redirect, a new administrator and a server load spike\" class=\"wp-image-5745\" srcset=\"https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-img1-1024x640.webp 1024w, https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-img1-300x188.webp 300w, https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-img1-768x480.webp 768w, https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-img1-1536x960.webp 1536w, https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-img1.webp 1600w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">An infection shows up in different places: in search results, in the browser, only on phones, in the user list or in server load.<\/figcaption><\/figure>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">One sign alone proves nothing: a redirect may be an ad script, high load may be a bot attack. But if two or three items match, act immediately.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">The first hours: what the owner should do<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">The goal of the first hours is not to fix the site. It&#8217;s to stop the damage and avoid making things worse. Here&#8217;s the order we recommend:<\/p>\r\n\r\n\r\n\r\n<ol class=\"wp-block-list\">\r\n<li><strong>Record what you see.<\/strong> Screenshots, URLs, times, where you came from and on which device. This helps locate the malicious code and work out when the infection started.<\/li>\r\n\r\n\r\n<li><strong>Don&#8217;t delete things at random or restore a backup blindly.<\/strong> Hasty deletion destroys the traces that lead to the entry point. And a backup can be just as infected as the live site.<\/li>\r\n\r\n\r\n<li><strong>Make a full copy of the current state<\/strong> \u2014 files and database. Yes, the infected one. It&#8217;s needed for analysis and must never be used to restore the site.<\/li>\r\n\r\n\r\n<li><strong>Change passwords from a clean device:<\/strong> hosting panel, FTP\/SFTP, database, CMS administrators, and the email account the domain is registered to. If you have any doubt about your work computer, use another one.<\/li>\r\n\r\n\r\n<li><strong>Limit the damage.<\/strong> If the site is sending people to scam pages or stealing payment data, it&#8217;s better to take it offline behind a maintenance page than to keep it open.<\/li>\r\n\r\n\r\n<li><strong>Tell your host.<\/strong> A good host keeps access logs, can tell you what happened and can check other sites in the same account.<\/li>\r\n\r\n\r\n<li><strong>For an online shop, notify your payment provider<\/strong> if there&#8217;s any chance the checkout page was affected. This isn&#8217;t a formality: it protects your customers and you.<\/li>\r\n\r\n<\/ol>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">If a developer or agency will do the cleanup, hand over everything at once: hosting and database access, recent changes to the site, who has admin access, your screenshots and the date you first noticed the problem.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Don&#8217;t install five &#8220;antivirus plugins&#8221; at once, move the infected site to another host &#8220;to start fresh&#8221;, or wait for it to go away. It won&#8217;t: malicious code usually digs in deeper.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">How a website is cleaned: step by step<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">A proper cleanup isn&#8217;t one scanner run but a sequence of steps, each closing part of the problem.<\/p>\r\n\r\n\r\n\r\n<h3 class=\"wp-block-heading\">Step 1. Diagnosis<\/h3>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">First we compare the site&#8217;s files with the originals: the CMS core, plugins and themes can be checked against official releases of the same versions. Anything that differs or shouldn&#8217;t be there is a suspect. Then we look for recently modified files, PHP scripts in folders where they don&#8217;t belong (the uploads folder, for example), and typical signs of obfuscated code \u2014 long encoded strings, calls like <code>eval(base64_decode(...))<\/code>, includes of files with odd names.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Then we check the database. In WordPress, malicious code often sits in the options table, in post and widget content, in scheduled tasks, and behind hidden users with administrator rights. We review <code>.htaccess<\/code>, configuration files and cron jobs on the server. And we always read the access logs to find which file or form the attacker came in through.<\/p>\r\n\r\n\r\n\r\n<h3 class=\"wp-block-heading\">Step 2. Cleanup<\/h3>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li>We replace the CMS core, plugins and themes with clean copies from official sources instead of &#8220;cutting out&#8221; suspicious lines.<\/li>\r\n\r\n\r\n<li>Unlicensed themes and plugins are removed completely and replaced with legitimate versions or alternatives.<\/li>\r\n\r\n\r\n<li>Abandoned plugins are removed.<\/li>\r\n\r\n\r\n<li>We hunt down and remove back doors \u2014 there almost always are some, even if only one symptom was visible.<\/li>\r\n\r\n\r\n<li>We clean the database: malicious scripts in content, junk records, unknown users.<\/li>\r\n\r\n\r\n<li>Generated spam pages and files are deleted.<\/li>\r\n\r\n<\/ul>\r\n\r\n\r\n\r\n<h3 class=\"wp-block-heading\">Step 3. Closing the vulnerability<\/h3>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Once we know how the attacker got in, we close that exact path. We update everything outdated, including the PHP version. We fix file and folder permissions and block PHP execution in the uploads directory. Forgotten copies of the site and old staging subdomains are removed.<\/p>\r\n\r\n\r\n\r\n<h3 class=\"wp-block-heading\">Step 4. Rotating every key<\/h3>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">You&#8217;ve already changed the passwords, but that isn&#8217;t enough. We regenerate the CMS secret keys (in WordPress, the salts in <code>wp-config.php<\/code>) to log out every old session, and reissue API keys for payment systems, email services and the CRM. If the attacker saw the configuration, they saw those keys too.<\/p>\r\n\r\n\r\n\r\n<h3 class=\"wp-block-heading\">Step 5. Re-checking<\/h3>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">We scan the site again, test it from different devices and traffic sources, and monitor file changes for the following weeks. If anything reappears, something was missed and we return to diagnosis.<\/p>\r\n\r\n\r\n\r\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"640\" src=\"https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-img2-1024x640.webp\" alt=\"Five steps from an infected to a clean website: diagnosis, cleanup, closing the vulnerability, rotating keys and monitoring\" class=\"wp-image-5746\" srcset=\"https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-img2-1024x640.webp 1024w, https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-img2-300x188.webp 300w, https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-img2-768x480.webp 768w, https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-img2-1536x960.webp 1536w, https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-img2.webp 1600w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">A cleanup is five consecutive steps, and if the malicious code comes back, the process starts again from diagnosis.<\/figcaption><\/figure>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Sometimes the question is: clean it or restore from a backup? Here&#8217;s how the options compare:<\/p>\r\n\r\n\r\n\r\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Option<\/th><th>When it fits<\/th><th>Risks<\/th><\/tr><\/thead><tbody><tr><td>Restore from backup<\/td><td>You know exactly when the infection started and have a clean copy older than that date<\/td><td>Loss of recent orders and content; without closing the vulnerability the site gets hacked again<\/td><\/tr><tr><td>Manual cleanup<\/td><td>The site is live, the changes are recent, there&#8217;s no backup or it&#8217;s doubtful<\/td><td>Requires experience: one missed back door means reinfection<\/td><\/tr><tr><td>Move to a clean install<\/td><td>The infection runs deep, the site is old, there are many plugins and half of them are abandoned<\/td><td>Takes longer; all migrated content has to be checked<\/td><\/tr><\/tbody><\/table><\/figure>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">After the cleanup: Google, email and rankings<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">A clean site doesn&#8217;t mean search engines know it yet. Skip this stage and traffic may not come back.<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li><strong>Search Console.<\/strong> If there&#8217;s a message in the &#8220;Security issues&#8221; report, after the cleanup we submit a review request with a short description of what was done. The red browser warning is removed once Google confirms the site is clean.<\/li>\r\n\r\n\r\n<li><strong>Spam pages.<\/strong> Generated URLs should return a 404 or 410 status. Don&#8217;t redirect them to the home page: to Google that looks like a substitution. To speed things up, you can temporarily hide them with the URL removal tool.<\/li>\r\n\r\n\r\n<li><strong>Technical hygiene.<\/strong> We check the sitemap, <code>robots.txt<\/code>, canonical and hreflang tags \u2014 attackers sometimes change those as well. We described what should be in order on a healthy site in <a href=\"https:\/\/webterra.com.ua\/en\/on-page-seo-basics\/\">&#8220;On-page SEO basics&#8221;<\/a>.<\/li>\r\n\r\n\r\n<li><strong>Email.<\/strong> If the site was sending spam, we check whether the server IP and the domain ended up on blocklists, and set up SPF, DKIM and DMARC.<\/li>\r\n\r\n\r\n<li><strong>Analytics.<\/strong> We compare traffic and conversions before and after to see the real losses.<\/li>\r\n\r\n<\/ul>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">One uncomfortable but important point: if customer data may have been affected \u2014 account passwords, form submissions, payment details \u2014 tell customers honestly and advise them to change passwords. A calm explanation preserves trust far better than silence that comes out later.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">After a short infection that was caught early, rankings usually recover on their own. But if spam sat in the index for months, the site may lose some queries for a long time, and that calls for systematic <a href=\"https:\/\/webterra.com.ua\/en\/seo-services\/\">SEO work<\/a>: restoring structure, content and the link profile.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">How to stop it happening again<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Most reinfections we see aren&#8217;t new attacks \u2014 they&#8217;re the same old hole that was never closed. Here&#8217;s the minimum protection we set up after a cleanup:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li><strong>Regular updates<\/strong> of the core, plugins and themes \u2014 tested on a copy of the site, not &#8220;update everything at once on Friday evening&#8221;.<\/li>\r\n\r\n\r\n<li><strong>As few plugins as possible.<\/strong> Every unnecessary plugin is both a vulnerability and extra load. Removing them speeds the site up too; we handle that as part of our <a href=\"https:\/\/webterra.com.ua\/en\/website-speed-optimization\/\">website speed optimization<\/a> service.<\/li>\r\n\r\n\r\n<li><strong>Licensed themes and plugins only<\/strong>, from official sources.<\/li>\r\n\r\n\r\n<li><strong>Two-factor authentication<\/strong> for every administrator and for the hosting panel.<\/li>\r\n\r\n\r\n<li><strong>Unique passwords in a password manager<\/strong>, a separate account for every person and minimal permissions: a copywriter doesn&#8217;t need an administrator role.<\/li>\r\n\r\n\r\n<li><strong>SFTP instead of FTP<\/strong>, and file editing from the admin panel disabled (in WordPress, <code>DISALLOW_FILE_EDIT<\/code>).<\/li>\r\n\r\n\r\n<li><strong>A WAF<\/strong> \u2014 a web application firewall at the hosting, CDN or plugin level that blocks common attacks before they reach the site.<\/li>\r\n\r\n\r\n<li><strong>Off-server backups<\/strong> with several weeks of history, and regular checks that you can actually restore from them.<\/li>\r\n\r\n\r\n<li><strong>Monitoring<\/strong>: file change detection, uptime checks, and Search Console notifications going to an inbox someone actually reads.<\/li>\r\n\r\n<\/ul>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Technical measures only work when someone watches them. Agree who owns the site&#8217;s security and set a rhythm: weekly, review monitoring and Search Console alerts; monthly, run updates on a staging copy, then live; quarterly, test a backup restore and review who has access. When someone leaves or a contractor&#8217;s work ends, remove their access that day.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">For online shops we add one more item: watching the checkout page. Card-stealing scripts are injected right there and don&#8217;t affect how the shop works, so they go unnoticed for a long time. The safest setup is one where payment happens on the payment provider&#8217;s side and security is built in from the <a href=\"https:\/\/webterra.com.ua\/en\/build-online-store\/\">ecommerce development<\/a> stage.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">A typical case from our practice<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">A small service company&#8217;s website on WordPress. A customer messages the owner on WhatsApp: on a phone, the site redirects to a &#8220;you&#8217;ve won&#8221; page. On desktop all looks fine, so it&#8217;s blamed on adware. A week later a &#8220;may be hacked&#8221; label appears in search, and enquiries drop.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">During diagnosis we find a slider plugin that hadn&#8217;t been updated in several years, a back door uploaded through it into the images folder, a hidden administrator, and a script in the database that fires only for mobile visitors coming from search. A previous contractor had already &#8220;restored from backup&#8221;, but the back door was in the backup too, so the infection came back. We replace the core and plugins with clean copies, remove the slider, clean the database, rotate every password and key, enable 2FA and file monitoring, and request a review in Search Console. The warning is lifted and enquiries gradually return to normal.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">The hack wasn&#8217;t sophisticated; it was typical. The first time round, someone treated the symptom, not the cause, and left the old plugin, the back door and the unknown administrator in place.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">Mistakes that drag out the cleanup<\/h2>\r\n\r\n\r\n\r\n<ol class=\"wp-block-list\">\r\n<li><strong>Restoring a backup and calling it solved.<\/strong> Without closing the vulnerability, it only buys time.<\/li>\r\n\r\n\r\n<li><strong>Deleting the visible malicious file and stopping there.<\/strong> Back doors are usually spread across several places.<\/li>\r\n\r\n\r\n<li><strong>Changing only the admin password.<\/strong> Hosting, FTP, the database, email and API keys stay in the attacker&#8217;s hands.<\/li>\r\n\r\n\r\n<li><strong>Checking the site only from the office computer.<\/strong> Conditional redirects are not shown to the owner.<\/li>\r\n\r\n\r\n<li><strong>Not submitting a review request to Google.<\/strong> The site is clean, but the warning stays up for weeks.<\/li>\r\n\r\n\r\n<li><strong>Going back to old habits:<\/strong> a nulled theme, one shared password for the whole team, updates &#8220;some other time&#8221;.<\/li>\r\n\r\n<\/ol>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">Quick checklist<\/h2>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li>Record the symptoms and make a copy of the infected state.<\/li>\r\n\r\n\r\n<li>Change every password from a clean device and tell your host.<\/li>\r\n\r\n\r\n<li>Find the entry point, replace the core and plugins with clean copies, clean the database.<\/li>\r\n\r\n\r\n<li>Remove back doors, unknown users and forgotten copies of the site.<\/li>\r\n\r\n\r\n<li>Update everything and reissue CMS and API keys.<\/li>\r\n\r\n\r\n<li>Submit a review request in Search Console and get spam pages out of the index.<\/li>\r\n\r\n\r\n<li>Set up updates, 2FA, a WAF, off-server backups and monitoring.<\/li>\r\n\r\n<\/ul>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">FAQ<\/h2>\r\n\r\n\r\n\r\n<h3 class=\"wp-block-heading\">Can I just restore the site from a backup?<\/h3>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">Yes, if you&#8217;re sure the copy is clean and you close the vulnerability right away. But attackers often sit inside a site for weeks or months before showing themselves, so recent backups may already contain the back door. We diagnose first, then decide.<\/p>\r\n\r\n\r\n\r\n<h3 class=\"wp-block-heading\">How long does a cleanup take?<\/h3>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">A small site with a single type of infection can usually be cleaned in a day or two. A deeply infected online shop with outdated plugins may need several days of work plus monitoring afterwards. Removing the Google warning takes some extra time after the review request.<\/p>\r\n\r\n\r\n\r\n<h3 class=\"wp-block-heading\">Will a security plugin help?<\/h3>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">As part of your protection, yes: scanning and a WAF are useful. But a plugin runs inside an already compromised system and can miss back doors or malicious code in the database. Cleanup is manual work; the plugin is for monitoring afterwards.<\/p>\r\n\r\n\r\n\r\n<h3 class=\"wp-block-heading\">Will an infection hurt my Google rankings?<\/h3>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">If it&#8217;s caught quickly, the impact is usually short-lived. A long-running infection with spam in the index and a red warning hits traffic much harder and takes longer to recover from. Reaction speed matters most.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">Summary<\/h2>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">An infected website is unpleasant, but it&#8217;s not a disaster if you act in order: record the symptoms, limit the damage, change access, find the entry point, clean everything and tell Google. The most expensive part is rarely the attack itself \u2014 it&#8217;s trying to fix everything in five minutes and putting off updates until &#8220;later&#8221;.<\/p>\r\n\r\n\r\n\r\n<p class=\"wp-block-paragraph\">If you see even one of the signs described here, or you&#8217;d like us to check your site and set up protection before anything happens, <a href=\"https:\/\/webterra.com.ua\/en\/contacts\/\">get in touch<\/a>. We&#8217;ll diagnose the site, clean it, close the vulnerability and help you win back your rankings.<\/p>\r\n","protected":false},"excerpt":{"rendered":"<p>Owners rarely learn about an infection from an antivirus or their host. Usually it&#8217;s a customer: &#8220;I opened your website on my phone and it sent me to a casino.&#8221; Or from Google, which suddenly shows a red warning screen instead of the home page. The first reaction is panic and an urge to delete [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":5744,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33],"tags":[],"class_list":["post-5749","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Your website has malware: what to do | WebTerra<\/title>\n<meta name=\"description\" content=\"Website infected with malware? Learn the signs of a hack, what to do in the first hours, how to clean the site, remove Google warnings and stop reinfection.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/webterra.com.ua\/en\/website-has-malware-what-to-do\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Your website has malware: what to do | WebTerra\" \/>\n<meta property=\"og:description\" content=\"Website infected with malware? Learn the signs of a hack, what to do in the first hours, how to clean the site, remove Google warnings and stop reinfection.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/webterra.com.ua\/en\/website-has-malware-what-to-do\/\" \/>\n<meta property=\"og:site_name\" content=\"webterra.com.ua\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-03T07:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-cover.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"1000\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"WebTerra\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"WebTerra\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"15 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/website-has-malware-what-to-do\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/website-has-malware-what-to-do\\\/\"},\"author\":{\"name\":\"WebTerra\",\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/#\\\/schema\\\/person\\\/07fa662dea8b8e0589c31ef1ed582b50\"},\"headline\":\"Your website has malware: what to do\",\"datePublished\":\"2026-11-03T07:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/website-has-malware-what-to-do\\\/\"},\"wordCount\":2966,\"publisher\":{\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/website-has-malware-what-to-do\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/webterra.com.ua\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/website-has-malware-what-to-do-cover.webp\",\"articleSection\":[\"Blog\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/website-has-malware-what-to-do\\\/\",\"url\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/website-has-malware-what-to-do\\\/\",\"name\":\"Your website has malware: what to do | WebTerra\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/website-has-malware-what-to-do\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/website-has-malware-what-to-do\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/webterra.com.ua\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/website-has-malware-what-to-do-cover.webp\",\"datePublished\":\"2026-11-03T07:00:00+00:00\",\"description\":\"Website infected with malware? Learn the signs of a hack, what to do in the first hours, how to clean the site, remove Google warnings and stop reinfection.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/website-has-malware-what-to-do\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/webterra.com.ua\\\/en\\\/website-has-malware-what-to-do\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/website-has-malware-what-to-do\\\/#primaryimage\",\"url\":\"https:\\\/\\\/webterra.com.ua\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/website-has-malware-what-to-do-cover.webp\",\"contentUrl\":\"https:\\\/\\\/webterra.com.ua\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/website-has-malware-what-to-do-cover.webp\",\"width\":1600,\"height\":1000,\"caption\":\"\u0412\u043b\u0430\u0441\u043d\u0438\u043a \u0431\u0456\u0437\u043d\u0435\u0441\u0443 \u0432\u0432\u0435\u0447\u0435\u0440\u0456 \u0437\u0430 \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u043e\u043c, \u043f\u043e\u0440\u0443\u0447 \u043f\u0430\u043d\u0435\u043b\u0456 \u0456\u0437 \u043f\u043e\u043f\u0435\u0440\u0435\u0434\u0436\u0435\u043d\u043d\u044f\u043c \u043f\u0440\u043e \u0448\u043a\u0456\u0434\u043b\u0438\u0432\u0438\u0439 \u043a\u043e\u0434 \u0456 \u0449\u0438\u0442\u043e\u043c \u0437\u0430\u0445\u0438\u0441\u0442\u0443\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/website-has-malware-what-to-do\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u0413\u043e\u043b\u043e\u0432\u043d\u0430\",\"item\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Your website has malware: what to do\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/\",\"name\":\"webterra.com.ua\",\"description\":\"\u0412\u0435\u0431-\u0441\u0442\u0443\u0434\u0456\u044f \u043f\u043e\u0432\u043d\u043e\u0433\u043e \u0446\u0438\u043a\u043b\u0443. \u0420\u043e\u0437\u0440\u043e\u0431\u043a\u0430, \u043f\u0440\u043e\u0441\u0443\u0432\u0430\u043d\u043d\u044f \u0442\u0430 \u043f\u0456\u0434\u0442\u0440\u0438\u043c\u043a\u0430 \u0441\u0430\u0439\u0442\u0456\u0432 \u0456\u0437 2010 \u0440\u043e\u043a\u0443.\",\"publisher\":{\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/#organization\",\"name\":\"webterra.com.ua\",\"url\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/webterra.com.ua\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/logo-mark.png\",\"contentUrl\":\"https:\\\/\\\/webterra.com.ua\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/logo-mark.png\",\"width\":400,\"height\":506,\"caption\":\"webterra.com.ua\"},\"image\":{\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/webterra.com.ua\\\/en\\\/#\\\/schema\\\/person\\\/07fa662dea8b8e0589c31ef1ed582b50\",\"name\":\"WebTerra\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/db4d263e590b080b087b4ed684f34427dbcc7c21ce75ab14e27f1b14c18bdc0a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/db4d263e590b080b087b4ed684f34427dbcc7c21ce75ab14e27f1b14c18bdc0a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/db4d263e590b080b087b4ed684f34427dbcc7c21ce75ab14e27f1b14c18bdc0a?s=96&d=mm&r=g\",\"caption\":\"WebTerra\"},\"sameAs\":[\"https:\\\/\\\/webterra.com.ua\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Your website has malware: what to do | WebTerra","description":"Website infected with malware? Learn the signs of a hack, what to do in the first hours, how to clean the site, remove Google warnings and stop reinfection.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/webterra.com.ua\/en\/website-has-malware-what-to-do\/","og_locale":"en_US","og_type":"article","og_title":"Your website has malware: what to do | WebTerra","og_description":"Website infected with malware? Learn the signs of a hack, what to do in the first hours, how to clean the site, remove Google warnings and stop reinfection.","og_url":"https:\/\/webterra.com.ua\/en\/website-has-malware-what-to-do\/","og_site_name":"webterra.com.ua","article_published_time":"2026-11-03T07:00:00+00:00","og_image":[{"width":1600,"height":1000,"url":"https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-cover.webp","type":"image\/webp"}],"author":"WebTerra","twitter_card":"summary_large_image","twitter_misc":{"Written by":"WebTerra","Est. reading time":"15 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/webterra.com.ua\/en\/website-has-malware-what-to-do\/#article","isPartOf":{"@id":"https:\/\/webterra.com.ua\/en\/website-has-malware-what-to-do\/"},"author":{"name":"WebTerra","@id":"https:\/\/webterra.com.ua\/en\/#\/schema\/person\/07fa662dea8b8e0589c31ef1ed582b50"},"headline":"Your website has malware: what to do","datePublished":"2026-11-03T07:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/webterra.com.ua\/en\/website-has-malware-what-to-do\/"},"wordCount":2966,"publisher":{"@id":"https:\/\/webterra.com.ua\/en\/#organization"},"image":{"@id":"https:\/\/webterra.com.ua\/en\/website-has-malware-what-to-do\/#primaryimage"},"thumbnailUrl":"https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-cover.webp","articleSection":["Blog"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/webterra.com.ua\/en\/website-has-malware-what-to-do\/","url":"https:\/\/webterra.com.ua\/en\/website-has-malware-what-to-do\/","name":"Your website has malware: what to do | WebTerra","isPartOf":{"@id":"https:\/\/webterra.com.ua\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/webterra.com.ua\/en\/website-has-malware-what-to-do\/#primaryimage"},"image":{"@id":"https:\/\/webterra.com.ua\/en\/website-has-malware-what-to-do\/#primaryimage"},"thumbnailUrl":"https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-cover.webp","datePublished":"2026-11-03T07:00:00+00:00","description":"Website infected with malware? Learn the signs of a hack, what to do in the first hours, how to clean the site, remove Google warnings and stop reinfection.","breadcrumb":{"@id":"https:\/\/webterra.com.ua\/en\/website-has-malware-what-to-do\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/webterra.com.ua\/en\/website-has-malware-what-to-do\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/webterra.com.ua\/en\/website-has-malware-what-to-do\/#primaryimage","url":"https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-cover.webp","contentUrl":"https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/10\/website-has-malware-what-to-do-cover.webp","width":1600,"height":1000,"caption":"\u0412\u043b\u0430\u0441\u043d\u0438\u043a \u0431\u0456\u0437\u043d\u0435\u0441\u0443 \u0432\u0432\u0435\u0447\u0435\u0440\u0456 \u0437\u0430 \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u043e\u043c, \u043f\u043e\u0440\u0443\u0447 \u043f\u0430\u043d\u0435\u043b\u0456 \u0456\u0437 \u043f\u043e\u043f\u0435\u0440\u0435\u0434\u0436\u0435\u043d\u043d\u044f\u043c \u043f\u0440\u043e \u0448\u043a\u0456\u0434\u043b\u0438\u0432\u0438\u0439 \u043a\u043e\u0434 \u0456 \u0449\u0438\u0442\u043e\u043c \u0437\u0430\u0445\u0438\u0441\u0442\u0443"},{"@type":"BreadcrumbList","@id":"https:\/\/webterra.com.ua\/en\/website-has-malware-what-to-do\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u0413\u043e\u043b\u043e\u0432\u043d\u0430","item":"https:\/\/webterra.com.ua\/en\/"},{"@type":"ListItem","position":2,"name":"Your website has malware: what to do"}]},{"@type":"WebSite","@id":"https:\/\/webterra.com.ua\/en\/#website","url":"https:\/\/webterra.com.ua\/en\/","name":"webterra.com.ua","description":"\u0412\u0435\u0431-\u0441\u0442\u0443\u0434\u0456\u044f \u043f\u043e\u0432\u043d\u043e\u0433\u043e \u0446\u0438\u043a\u043b\u0443. \u0420\u043e\u0437\u0440\u043e\u0431\u043a\u0430, \u043f\u0440\u043e\u0441\u0443\u0432\u0430\u043d\u043d\u044f \u0442\u0430 \u043f\u0456\u0434\u0442\u0440\u0438\u043c\u043a\u0430 \u0441\u0430\u0439\u0442\u0456\u0432 \u0456\u0437 2010 \u0440\u043e\u043a\u0443.","publisher":{"@id":"https:\/\/webterra.com.ua\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/webterra.com.ua\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/webterra.com.ua\/en\/#organization","name":"webterra.com.ua","url":"https:\/\/webterra.com.ua\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/webterra.com.ua\/en\/#\/schema\/logo\/image\/","url":"https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/09\/logo-mark.png","contentUrl":"https:\/\/webterra.com.ua\/wp-content\/uploads\/2026\/09\/logo-mark.png","width":400,"height":506,"caption":"webterra.com.ua"},"image":{"@id":"https:\/\/webterra.com.ua\/en\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/webterra.com.ua\/en\/#\/schema\/person\/07fa662dea8b8e0589c31ef1ed582b50","name":"WebTerra","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/db4d263e590b080b087b4ed684f34427dbcc7c21ce75ab14e27f1b14c18bdc0a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/db4d263e590b080b087b4ed684f34427dbcc7c21ce75ab14e27f1b14c18bdc0a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/db4d263e590b080b087b4ed684f34427dbcc7c21ce75ab14e27f1b14c18bdc0a?s=96&d=mm&r=g","caption":"WebTerra"},"sameAs":["https:\/\/webterra.com.ua"]}]}},"_links":{"self":[{"href":"https:\/\/webterra.com.ua\/en\/wp-json\/wp\/v2\/posts\/5749","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/webterra.com.ua\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webterra.com.ua\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webterra.com.ua\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webterra.com.ua\/en\/wp-json\/wp\/v2\/comments?post=5749"}],"version-history":[{"count":1,"href":"https:\/\/webterra.com.ua\/en\/wp-json\/wp\/v2\/posts\/5749\/revisions"}],"predecessor-version":[{"id":6163,"href":"https:\/\/webterra.com.ua\/en\/wp-json\/wp\/v2\/posts\/5749\/revisions\/6163"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webterra.com.ua\/en\/wp-json\/wp\/v2\/media\/5744"}],"wp:attachment":[{"href":"https:\/\/webterra.com.ua\/en\/wp-json\/wp\/v2\/media?parent=5749"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webterra.com.ua\/en\/wp-json\/wp\/v2\/categories?post=5749"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webterra.com.ua\/en\/wp-json\/wp\/v2\/tags?post=5749"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}