Hosting account suspended: find the cause and get your website back

Find the cause

On hosting run with cPanel, a suspension replaces the site with a page stating that the account is suspended ("This Account has been suspended"). It also blocks the control panel login, FTP access and outgoing email from the account; incoming email depends on the server configuration. The files themselves stay in place.

The cause is usually spelled out in a message from the host: search the email inbox tied to the account, spam folder included, for "suspension", "abuse", "malware" or "invoice", then check the client area and its tickets.

If the message gives no cause, ask for it in writing, along with the clause of the terms of service involved: a suspension is lifted faster when everyone is talking about the same problem.

First, save a copy of the site

The host’s terms of service set the period after which a suspended account’s data may be deleted. Before anything else, put a copy somewhere safe:

• The files: over SFTP if access is still open, otherwise by asking the host for an archive.
• The database: through phpMyAdmin’s export or wp db export, or in the same archive request.
• The email, if mailboxes are hosted on the same account: a copy of each mailbox over IMAP from an email client.
• The planned deletion date, asked for in writing.

Keep that copy exactly as it is, even if the site is infected: it is what you clean from and compare against.

Cause 1: a hacked site

On a shared server, a site that spreads malware, hosts fake login pages or sends spam puts the other accounts and the reputation of the server’s IP addresses at risk. The host suspends the account, and reopens it once the problem is dealt with.

1. Ask for the list of detected files, and whether the host can reopen file access while you clean up.
2. Delete the flagged files, then look for whatever dropped them: PHP files in wp-content/uploads, unknown folders at the root, email-sending scripts, added administrator accounts.
3. Change the hosting, FTP, database and administrator passwords, and replace the security keys in wp-config.php.
4. Update WordPress, the theme and the plugins, and delete any that are no longer used.
5. Write to the host describing what was found, removed and fixed, quoting the suspension reference.

Moving to another host with the same files takes the infection along, and with it the risk of another suspension. Cleaning happens before the site goes back online, wherever that is.

Cause 2: resource usage over the limits

Shared hosting caps what each account consumes. On servers running CloudLinux, the limits cover CPU, physical memory, disk input and output, the number of processes and entry processes, meaning simultaneous connections to dynamic scripts such as PHP. The number of files is counted in inodes: every file and every folder uses one.

When the entry process limit is reached, visitors get a 508 "Resource Limit Is Reached" error. Repeated overruns can lead to suspension. Your hosting panel shows usage over time: spot the peak hours, then read the access logs for those hours.

The most common causes

• Bots hammering wp-login.php or xmlrpc.php with login attempts.
• Heavy plugins: statistics, logging, image generators, backups.
• Backups stored on the account, inside wp-content, filling disk space and inodes.
• WordPress scheduled tasks, triggered on every visit.

du -sh wp-content/* | sort -h
find . -type f | wc -l

<Files "xmlrpc.php">
Require all denied
</Files>

This block refuses every request to xmlrpc.php. First check that no tool relies on it: Jetpack, for instance, goes through XML-RPC. If the site then shows a 500 error, your host does not allow this directive in .htaccess: remove the block and ask them for the equivalent.

define( 'DISABLE_WP_CRON', true );

Scheduled tasks then need to be called by the server’s scheduler: in your hosting panel, create a cron job that calls https://www.your-site.com/wp-cron.php at a regular interval, every 15 minutes for example.

Cause 3: an unpaid invoice

Pay the invoice from the client area, and check that the saved card has not expired. Reactivation follows payment, automatically or on request depending on the host; if it takes a while, open a ticket quoting the payment reference.

The domain name is often renewed separately from the hosting. An expired domain also takes the site offline, but the page shown is then the registrar’s, not the host’s: two invoices, two checks.

Cause 4: a complaint or a breach of the terms

• Copyright: an image or a text used without a licence. Remove the content, or send proof of the licence, quoting the complaint reference.
• Abuse report: a fake login page or malware spotted on your site. That is a hack, handled as cause 1.
• Spam complaints: emails sent from the account to recipients who did not expect them, newsletters included. Check who sends from the account, and how the addresses were collected.

Reply in writing, within the stated deadline, describing what was done: that is the document the host files to lift the suspension.

Before the site goes back online

1. The cause is identified and fixed, and the host has confirmed in writing what it expects.
2. Passwords are changed and the site’s components are up to date.
3. An automatic backup exists, stored outside the hosting account.
4. Someone receives the host’s alerts: the account’s email address is read.