If your host has suspended your WordPress website, the immediate business concern is understandable: customers may be unable to contact you, book or buy. The most useful first step is to establish why the restriction is there and what the host requires before access can safely resume.

An “Access denied” message alone does not identify the cause. Avoid assuming either that you have definitely been hacked or that changing a setting will solve it. Ask for the actual notice and the supporting findings.

Ask your host these questions first

Why was the site restricted, and when?
Does the restriction affect the whole account, the website or particular files?
Is there a malware report or list of affected paths?
Can relevant logs and backups be retained while the issue is investigated?
What access is available to the person handling recovery?
What evidence and checks are required before the restriction is lifted?

Keep the answers together with the time you first noticed the problem. WordPress’s hacked-site guidance recommends involving the host and recording the symptoms. This also helps distinguish a compromise from a service problem.

Why unlocking a file may not fix the problem

Some hosts quarantine suspected malicious files by changing their permissions. IONOS documents that it removes read access from affected files and may reset permissions to 200 if malicious code remains. Its initial notification may also be incomplete while scanning continues. See IONOS’s explanation of locked files after malware detection.

In that situation, repeatedly changing permissions treats the restriction rather than the infected content. Follow the provider’s recovery process and investigate the flagged files. Permission values are hosting-specific; copying a number from another website is not a reliable clean-up method.

What happened with Tori Bond Celebrant

I investigated an “Access denied” problem on toribondcelebrant.co.uk and confirmed malicious code, including a backdoor with file-management capabilities. Additional malicious files were present in the downloaded archive.

We traced the repeated permission changes to IONOS’s quarantine behaviour. Missing WordPress files were another issue, and we worked through restoring clean files. Dashboard access was regained. The homepage then needed a separate check: the original page still existed but was in draft.

These were distinct problems within one recovery. Restored access and a visible homepage did not prove the site was fully clean. Further software replacements, scan completion and account-security work still needed confirmation, and we did not establish the original entry point. Read the Tori Bond Celebrant case study.

Preserve the information needed for recovery

Ask the person handling the work to retain an appropriate copy of the affected files and database before destructive changes. Wordfence’s recovery guidance highlights the value of a backup before clean-up. Label an affected archive clearly and keep it separate from a backup approved for restoration.

From the business side, identify the functions that matter most. Is the immediate priority a working enquiry route, an online shop or access for staff? Agree how customers will receive essential information while recovery is underway. That gives the technical work a sensible order without asking the host to expose an unsafe site.

Agree what “back online” should mean

I would separate the handover into three parts: the host’s requirements, the website’s important customer journeys and the remaining security actions. Each should have an owner. A working front page is a useful check, but it is not the whole job.

If Google has also raised a security issue, its Security issues report guidance says to fix and test all reported issues before requesting a review. Hosting access and Google’s review are different processes, so neither should be presented as an instant guarantee of the other.

Get practical help with a suspended WordPress site

I provide WordPress hack recovery and malware removal support for Sussex businesses. We agree the initial scope and budget, and I confirm availability before work begins. Ongoing maintenance is optional.

Send a recovery enquiry with your website address, hosting notice and symptoms. Please do not email passwords.