How to Remove Malware From a Hacked Website Safely

Signs Your Website Is Infected

Malware doesn’t always announce itself. Many compromised sites appear normal on the surface while silently harming visitors or stealing data. Recognizing early warning signs gives you the edge to act before blacklist warnings and search ranking drops compound the damage.

Red Flags Only You Might Notice

Website owners often detect infection through unexpected behavior before any security warning appears. Your site might load slowly, display new admin accounts you didn’t create, or show unfamiliar files in the file manager. Database anomalies, extra tables, modified timestamps on core files, or strange entries in your user list are also classic indicators. Niya Digital’s team has found that sites that delay action after discovering suspicious activity see re-infection within 48 hours as automated bots exploit the same entry point. Monitor your hosting dashboard, database backups, and file-access logs regularly; these early signals often arrive days before public blacklist warnings.

Sucuri SiteCheck is a free remote scanner that checks your site against major blacklists and scans for obvious malware signatures. Running it weekly gives you a baseline; unexpected changes warrant deeper investigation.

Browser & Search Engine Warnings

Once a security vendor (Google, Norton, McAfee, or others) detects your site as malicious, the consequences are immediate and visible to your visitors. Google Safe Browsing flags compromised sites and displays a large red warning screen in Chrome, Safari, Firefox, and Opera before users can even land on your pages. Search Console alerts you via email when Google detects a problem, but by then your traffic is already collapsing.

Browser warnings and search-engine delisting are the loudest signals, but they come late. By the time a public warning appears, the malware has typically been present for days or weeks. This is why proactive scanning and early detection matter so much; you can clean the site and request delisting before visitors and customers experience the warning themselves.

Immediate Containment: Your First 24 Hours

The moment you suspect malware, prioritize containment. Treat it like a medical emergency: stop the bleeding before you diagnose the exact condition. In the first 24 hours, your job is to prevent further damage, preserve evidence, and gather the information you’ll need for cleanup.

Take Your Site Offline & Create a Forensic Backup

Your instinct might be to start cleaning immediately, but resist that urge. First, isolate the problem. Contact your hosting provider and ask them to move your site to maintenance mode or a staging environment where it can’t infect visitors or spread to other sites on the same server. Document everything: take screenshots of anomalies, note the exact time you detected the problem, and preserve your hosting logs if your provider offers them.

Before touching anything, create a complete forensic backup of your entire site, all files, all database tables, and all logs. This backup is your insurance policy. Sucuri and other professional removal services use forensic snapshots to trace how the attack happened and to verify that cleanup is complete. Your hosting provider can usually create this backup for you; if not, use your CMS’s built-in export tool or an FTP client to download everything. Never delete or modify files before this snapshot exists.

Notify Your Stakeholders & Assess the Scope

If your site handles customer data (emails, payment information, personal details), contact your hosting provider’s security team and document the incident. Depending on your jurisdiction and the type of data at risk, you may have legal obligations to report the breach. Check your business insurance policy for cyber liability coverage; many policies include incident-response support and legal guidance.

Assess what data your site collects and what attackers might have accessed. If you store credit card information, the cleanup scope may be wider and more urgent. You may need customer notification, regulatory reporting, and password-reset protocols. Do this groundwork now, in the first 24 hours, so you don’t discover complications halfway through cleanup.

Comparing Removal Methods: Backup, Manual Cleanup, Rebuild

You have three primary paths to restore a malware-infected site, each with different trade-offs in speed, safety, and completeness. The right method depends on whether you have a clean backup, the infection’s complexity, and your technical comfort level.

Restore from a Clean Backup (Fastest, If Available)

If you have a backup from before the infection, restoration is the fastest path to recovery. Your hosting provider or CMS can usually restore a full backup in one to six hours. The process is straightforward: restore files, restore database, verify the site loads, change all passwords immediately, and run a scan to confirm the backup itself wasn’t infected.

The critical risk is restoring a backup that already contains malware. Backups created during or after the infection may include the malicious code. Before restoring, verify your backup’s creation date; it must predate the infection. If all your backups are recent and you’re unsure when the infection started, manual cleanup or a full rebuild may be safer. Verify the restored site against Sucuri SiteCheck and other scanners before taking it live.

Manual Malware Cleanup (Complete Control, High Effort)

If you don’t have a clean backup or suspect all backups are compromised, manual cleanup is the most thorough option. It requires forensic expertise: comparing your live codebase against clean versions of WordPress core and all plugins/themes, scanning the database line by line for injected scripts, identifying and removing backdoors, and closing the entry point the attacker used.

Manual cleanup involves downloading your site files, running a file-integrity scanner to flag modified, added, or suspicious files, examining those files for malicious code, and removing the malware while preserving your content and legitimate customizations. The database needs equal scrutiny, including scans for rogue admin users, malicious cron jobs, injected <script> tags in posts, and corrupted options tables. This approach demands deep technical knowledge of PHP, MySQL, WordPress architecture (or your CMS equivalent), and common malware patterns.

When & Why Professional Removal Services Matter

Removing malware may seem like a task you can handle yourself, but it often isn’t. Professional removal services exist because thorough cleanup requires forensic tools, persistent experience with thousands of real attack patterns, and the ability to verify that no re-infection vector remains. Understanding when to hire versus going it alone can save time and money.

Why DIY Cleanup Fails (And Costs More Later)

The most common mistake is cleaning the visible malware, the injected scripts, the defaced pages, without finding the backdoor. When attackers gain access, they typically install multiple persistence mechanisms: hidden PHP files in obscure directories, modified .htaccess rules that trigger re-infection, compromised database salts that reset admin credentials, and rogue cron jobs that restore deleted malware.

Automated malware scanners catch obvious signatures but miss sophisticated backdoors, especially those disguised as legitimate code or hidden in files that look innocent. Even after you’ve cleaned everything visible, re-infection can happen within 24–48 hours if a single backdoor remains. This cycle- clean, re-infect, clean again- is frustrating and costly.

Professional removal services use forensic-level tools to diff your entire codebase against clean upstream copies (downloading the exact version of WordPress core and each plugin you’re running, then comparing file by file). They manually review every flagged difference, examining suspicious code patterns and database entries. They also review your server logs and hosting-provider security alerts to understand how the attacker gained access; they must close the entry point, or the same attack will succeed again.

What Professional Cleanup Includes

A professional removal service (like Sucuri’s malware removal offering) typically covers: forensic backup and snapshot creation, complete file and database scan, identification and removal of all malware and backdoors, password and API key rotation, hardening recommendations, delisting requests to major blacklist vendors (Google Safe Browsing, Norton Safe Web, McAfee SiteAdvisor, Spamhaus), and a post-cleanup verification report.

Sucuri checks the top 10 blacklists and submits removal requests with forensic evidence, tracking each vendor’s response until it delists your site everywhere. This saves you weeks of back-and-forth communication and reduces the risk of a request rejection due to incomplete cleanup.

Red Flags That Demand Professional Help

Hire a professional if: your site stores customer or payment data, you cannot pinpoint the infection date or scope, you lack technical skills to understand PHP or database queries, your site has been re-infected after a previous cleanup attempt, or you want a guarantee (many professional services offer 30-day re-infection guarantees). Professional services aren’t a luxury; they’re insurance against incomplete cleanup and the re-infection cycle.

The Step-by-Step Malware Removal Process

Whether you choose professional cleanup or attempt it yourself, the underlying process is the same. This section outlines each phase so you understand what thorough removal involves and can evaluate whether you’re equipped to do it.

Phase 1: Forensic Investigation & Isolation

Start with a complete file and database scan. Upload your site files to a clean staging environment (a separate server your hosting provider can provide or a local test server). Use a malware scanner, Sucuri SiteCheck, VirusTotal, or a standalone tool like MalCare, to catalog every infected file.

For each flagged file, examine the code manually. Many malware infections include obfuscated PHP code, intentionally scrambled to hide its function. You may need to decode it (tools like PHP Decoder can help) to understand what it does. Document every malicious file, its location, and its suspected function.

Scan your database for injected scripts, commonly found in post content, options tables (WordPress settings), and user tables. Search for suspicious entries like extra admin accounts, modified timestamps, or encoded strings. Take detailed notes; these become your evidence for delisting requests later.

Phase 2: Controlled Remediation

Once you’ve documented every malicious element, start removing it. Remove malicious files systematically, reset all passwords, WordPress admin, database user, cPanel, FTP/SFTP, email accounts, and API keys. Regenerate WordPress security keys (salts) in wp-config.php, which forces all sessions to expire and invalidates stolen session cookies.

Update WordPress core, all plugins, and all themes to current versions. Delete any plugin or theme you don’t recognize or actively use. If a plugin is abandoned (no longer updated by its developer), remove it entirely and find a modern alternative. This meticulous cleanup prevents attackers from hiding code in outdated or unused components.

Phase 3: Verification & External Delisting

After cleanup, test your site thoroughly on a staging server before taking it live. Verify all pages load, forms submit, and checkout processes work (if applicable). Run Sucuri SiteCheck, VirusTotal, and other scanners again to confirm no malware remains.

Once verified clean, submit delisting requests to every blacklist vendor that flagged your site. Log into Google Search Console and request a review under Security Issues. Contact Norton Safe Web, McAfee SiteAdvisor, and others directly (each has a removal request form). Include your forensic cleanup report and evidence that the site is now clean. Most vendors respond within 24–72 hours if your cleanup is complete.

Getting Off Blacklists & Restoring Search Rankings

Blacklist removal is a separate task from malware cleanup. A site can be technically clean but still flagged by security vendors. Your site may appear on multiple blacklists simultaneously, and each vendor has its own removal process and timeline.

Understanding Blacklist Warnings

Google Safe Browsing maintains one of the most consequential blacklists. When Google flags your site, Chrome and other browsers display a warning, and Google Search Console alerts you. The impact is immediate; traffic can drop 80–95% because most visitors won’t click through a red warning screen.

Other major blacklists include Norton Safe Web, McAfee SiteAdvisor, Sucuri Malware Labs, Spamhaus, Bitdefender, Yandex, Opera, and ESET. A single malware-infected page can blacklist your entire domain across multiple vendors. Removing a site from one blacklist does not automatically remove it from others; each vendor maintains independent databases.

The silver lining: once you’re clean, delisting is automatic. Vendors recrawl your site within hours or days of your review request, and if they detect no malware, the warning disappears, and you’re removed from their blocklists.

The Delisting Process

After cleanup, create a Google Search Console account (if you don’t have one) and navigate to Security Issues. Request a review of your site. Google will recrawl it; if it finds no malware, it typically removes the warning within 24–48 hours.

For other vendors, visit their removal request pages directly. Most require you to submit your domain, describe the cleanup steps you took, and sometimes upload a report. Honest, detailed information speeds up review. Include before-and-after scan reports, forensic cleanup logs, and evidence of security improvements (updates, password rotations, hardening steps).

Sucuri automates this process for its customers, submitting requests to multiple vendors and tracking responses. If you handle delisting manually, expect 5–10 business days for major vendors to process your requests and remove the warnings. During this time, the blacklist warnings may still be visible to some users, but recrawls will clear them as reviews complete.

Hardening Your Site After Cleanup

Removing malware is only half the job. Without hardening, the same vulnerability that let attackers in the first time remains open. Attackers use automated bots to scan the web for entry points constantly, and re-infection can happen within 24–48 hours if you don’t harden your site.

Rotate Credentials & Update Everything

Change every password associated with your site immediately after cleanup: WordPress admin dashboard, database, hosting control panel (cPanel), FTP/SFTP, email accounts, and any third-party integrations (ManageWP, WP Engine, etc.). Use strong, unique passwords (16+ characters, mixed case, numbers, symbols). Enable two-factor authentication (2FA) or multi-factor authentication (MFA) for every account you can.

Update WordPress core, all plugins, and all themes to their latest versions. Outdated software is the most common entry point; security patches fix known vulnerabilities, and attackers automatically scan for unpatched versions. Set WordPress to auto-update core, themes, and plugins so you’re never running outdated code.

Remove any plugin or theme you don’t actively use. Inactive plugins still execute code and can be exploited. If its developer no longer updates a plugin, delete it and find a modern alternative maintained by an active developer.

Set Up Continuous Monitoring & Detection

After cleanup, implement ongoing monitoring to catch new infections before they spread. Sucuri and other managed security services provide continuous file monitoring, malware scanning, and automatic alerts when they detect suspicious activity.

Alternatively, install a security plugin like Wordfence or Sucuri’s WordPress plugin (available in free and paid versions) to monitor file changes, scan for malware daily, and block common attack patterns. Configure these plugins to scan your entire site daily or more frequently if possible; early detection prevents re-infection from spreading.

Enable your hosting provider’s security features if available: Web Application Firewall (WAF) rules, brute-force login protection, and DDoS mitigation. A WAF filters malicious HTTP requests before they reach your server, blocking SQL injection, cross-site scripting (XSS), and other attacks.

Lock Down File & Directory Permissions

Set correct file permissions to limit what malware can modify. WordPress directories should be 755 (readable/executable by all, writable by owner only) and files should be 644 (readable by all, writable by owner only). Your /wp-content/uploads/ directory is a common malware target; it should be 755 and should never contain PHP files.

Disable PHP execution in directories that shouldn’t execute code (uploads, backups, plugins directories). In your .htaccess file (or server config), add rules to prevent PHP execution in these locations:

<FilesMatch “\.php$”>

Order Deny, Allow

Deny from all

</FilesMatch>

Restrict access to sensitive files like wp-config.php and the WordPress admin directory (/wp-admin/). If possible, limit logins to known IP addresses, or require VPN access for remote admin login.

Preventing Re-infection & Ongoing Security

Re-infection is common because attackers don’t stop trying. Hardening is a one-time task, but ongoing security requires continuous attention. A single missed patch, one weak password, or one unmonitored plugin can undo all your cleanup work.

Establish a Patching & Maintenance Schedule

Create a regular maintenance schedule: update WordPress core and plugins every 1–4 weeks (depending on release frequency), update themes quarterly, and update the server OS/libraries monthly or as patches are released. Apply critical security patches immediately, even outside your normal schedule.

Test updates on a staging server before applying them to your live site. Occasionally, an update breaks compatibility with your theme or a plugin, and testing ahead of time prevents unexpected downtime and deployment errors.

Monitor Logs & Access Patterns

Review your hosting provider’s server logs and WordPress logs (if logging is enabled) monthly or quarterly for unusual patterns. Look for failed login attempts, unexpected file modifications, database access from unfamiliar IP addresses, and error messages indicating attacks. Many web hosting control panels (cPanel, Plesk) have built-in log viewers.

High volumes of failed login attempts indicate that attackers are trying to guess your admin password. This is why 2FA and strong passwords matter; they block these attacks effectively. If you see many failures from specific IP addresses, consider blocking those IPs at the firewall level using your hosting provider’s security tools.

Plan for Compliance & Incident Reporting

If your site collects payment card data, you’re subject to PCI DSS (Payment Card Industry Data Security Standard). PCI requires annual penetration testing, secure password management, encryption of sensitive data, and documented incident-response procedures. Malware infections trigger compliance obligations; you must report data breaches to card networks and often to customers.

If you handle personal data from EU residents, GDPR (General Data Protection Regulation) requires you to notify authorities of data breaches within 72 hours. For US residents, state laws like California’s CCPA and others have similar requirements. Consult your legal team about what applies to your business; non-compliance carries steep penalties.

Document your incident response: what malware you found, when you detected it, what data was at risk, cleanup steps taken, and how you prevented recurrence. This documentation is essential for cyber insurance claims, regulatory reporting, and future incident preparedness.

Choosing Continuous Monitoring vs One-Time Cleanup

After your first infection, you face a choice: hire a professional for one-time cleanup and handle security yourself afterward, or subscribe to a managed security service that handles continuous monitoring, cleanup, and hardening.

One-Time Cleanup & Self-Management

One-time professional cleanup handles the immediate infection. You get your site back online quickly, with forensic evidence of what went wrong. After that, you’re responsible for maintaining security yourself: regular updates, password rotations, log reviews, and optional security-plugin subscriptions.

This path works if you have the technical skills, time to monitor your site regularly, and discipline to keep software updated. It’s cost-effective upfront but requires ongoing attention. One missed patch or one lapsed password rotation can lead to re-infection.

Managed Security Services

Managed security services like Niya Digital’s Website Security Service (powered by Sucuri) handle continuous monitoring, cleanup, and hardening. You pay a monthly subscription for 24/7 monitoring, automatic cleanup if malware is detected, regular security updates, blacklist monitoring, and incident response support.

For businesses where downtime costs money, where customers depend on site reliability, or where regulatory compliance is required, managed services are insurance against the cost and complexity of handling security alone. The monthly cost is offset by reduced downtime, faster incident response, and lower liability risk.

Small blogs or low-traffic sites might be comfortable with one-time cleanup and manual security. E-commerce sites, membership platforms, and content sites with regular traffic should consider managed security; the cost is small compared to the revenue impact of downtime.

SEO Recovery: Reclaiming Your Search Rankings

After blacklist removal, your site is clean, but search rankings don’t bounce back instantly. You’ve been delisted, but search engines may also have downgraded your domain authority because of the security incident. Recovery requires proactive steps to regain trust.

Rebuild Search Engine Trust

Log in to Google Search Console and review the “Security Issues” section. Once Google reviews and clears your site, the warnings should disappear. Submit your sitemap again to signal to Google that your site is ready to be re-indexed.

Request a “Full Crawl” in Google Search Console to prioritize re-crawling your pages. This tells Google you’re serious about recovery and expedites the re-indexing process. Expect your rankings to begin recovering within 2–4 weeks, though full recovery (to pre-infection levels) may take 3–6 months depending on the severity of the incident.

Check Bing Webmaster Tools as well; Bing has its own indexing and security systems. Submit your site for re-review there too.

Improve On-Site SEO Foundations

Use the recovery period to improve your SEO fundamentals. Audit your content for quality and relevance; outdated or thin pages may never regain rankings. Update high-value pages with fresh information, improve internal linking, and ensure every page has descriptive meta titles and meta descriptions.

Ensure your site loads fast (page speed is a ranking factor). Compress images, enable browser caching, and consider a content delivery network (CDN) if you have global visitors. Test your site’s mobile responsiveness; mobile-first indexing means search engines crawl and rank your mobile version first.

Build backlinks from reputable sites (guest posts, press coverage, industry partnerships). Links signal authority to search engines and help rebuild domain authority faster. Avoid link-buying schemes or manipulative tactics; search engines penalize these, and you’re already recovering from a security incident.

Monitor Organic Traffic Recovery

Use Google Analytics to track organic search traffic recovery week by week. Set a baseline from before the infection (or 6 months prior if you don’t have historical data) and track how closely you’re approaching it. Most sites see 50% recovery within 4 weeks and 80% within 8 weeks if they follow these SEO recovery steps.

If recovery stalls after 4–6 weeks, re-scan your site for missed malware (attackers sometimes leave second-stage backdoors) or check for new security issues. Stalled recovery often indicates ongoing attacks or missed cleanup.

Frequently Asked Questions

How do I know if my website has malware?

Signs include: unexpected page layout changes, unfamiliar pages or content appearing on your site, browser/search engine security warnings, slow loading speeds, unexpected redirects, new admin accounts you didn’t create, or security alerts from your hosting provider. Sucuri SiteCheck and VirusTotal let you scan your site for free. If you see a red warning in Chrome or a “This site may be hacked” message in Google Search Console, your site is almost certainly compromised.

How long does malware removal take?

Backup restoration takes 1–6 hours. Manual cleanup takes 2–5 days depending on infection scope. Full rebuild takes 5–14 days. Professional removal services (like Sucuri) typically complete cleanup in 1–3 days with 24/7 support and guaranteed results. Speed depends on infection complexity and whether you have a clean backup.

Can I restore from a backup if I’m not sure it’s clean?

Restoring from a suspicious backup risks re-infecting your site with the same malware. If you can’t verify the backup was created before the infection, manual cleanup or a full rebuild is safer. Professional removal services can inspect your backup before recommending restoration, so you don’t accidentally re-introduce malware.

What does malware do to my SEO?

Malware can inject spam content into your pages, inject malicious redirects that send visitors to phishing sites, or trigger search-engine blacklisting. Once blacklisted, Google removes your site from search results and displays a warning. Even after cleanup and delisting, recovery takes weeks; your domain authority has been downgraded and must be rebuilt through quality content, links, and time.

How much does professional malware removal cost?

One-time cleanup typically costs $100–500 depending on complexity. Emergency or after-hours removal may cost more. Managed security services (continuous monitoring and automatic cleanup) range from $80–300/month. Compare that to the cost of downtime: an e-commerce site losing $1,000/day in sales can recover the cost of professional removal within hours.

How do I prevent re-infection?

Update WordPress core, plugins, and themes immediately and regularly. Use strong, unique passwords and enable 2FA. Remove unused plugins. Install a security monitoring plugin or subscribe to a managed security service. Set correct file permissions. Disable PHP execution in upload directories. Review logs monthly for suspicious activity. The single most common cause of re-infection is running outdated software.

Will my rankings come back after delisting?

Yes, but it takes time. Expect 50% recovery within 4 weeks and full recovery within 2–6 months. Recovery speed depends on how visible the security warning was (the longer it was live, the more damage) and how aggressively you rebuild on-site SEO. Update content, build backlinks, improve site speed, and request re-crawl in Google Search Console to accelerate recovery.

Do I need cyber insurance for malware?

If your site handles customer data or payment information, cyber insurance is highly recommended. Breach notification, legal defense, forensic investigation, and incident response all carry costs. Many policies cover malware cleanup and business interruption. Review your current business insurance and add cyber coverage if you don’t have it.

What’s the difference between malware cleanup and hardening?

Cleanup removes the infection and restores normal function. Hardening closes the entry point and installs defenses so the same attack can’t succeed again. Cleanup alone leaves you vulnerable to re-infection. Always combine cleanup with hardening: rotate passwords, apply updates, set file permissions, monitor activity, and use security tools.

Should I hire a professional or handle cleanup myself?

Hire a professional if: your site stores customer/payment data, you lack technical skills, your site has been re-infected before, or you want a guarantee and peace of mind. DIY cleanup is possible if you’re technically confident, have time to learn forensic scanning, and are comfortable managing ongoing security yourself.

How often should I scan my site for malware?

If you have a security subscription, continuous monitoring scans daily or more. If you’re self-managing, scan at least weekly with Sucuri SiteCheck, VirusTotal, or a security plugin. Immediately after cleanup, scan every 2–3 days for a month to catch any re-infection early.

What if my site gets re-infected after cleanup?

Re-infection usually means you missed a hardening step: an outdated plugin still contains a vulnerability, a password wasn’t rotated, a backdoor wasn’t fully removed, or a new entry point wasn’t closed. Contact your professional cleanup service (most offer 30-day guarantees) or hire help to identify and close the missed vector. Don’t keep re-cleaning the same site without finding the root cause; you’ll stay in an infection cycle.

Can I prevent malware entirely?

No service can guarantee 100% prevention; website security is layered. Continuous monitoring detects threats quickly so they’re stopped before spreading. Regular updates patch known vulnerabilities. Strong security practices reduce risk dramatically. But new zero-day vulnerabilities (exploits unknown to developers and security vendors) can still lead to compromise. Prevention reduces probability and impact, but doesn’t eliminate all risk.

Where can I report my site’s blacklisting?

Report the issue to your hosting provider immediately; they may help with cleanup. Log into Google Search Console to see Google’s security report. Contact Sucuri if their malware labs flag your site. For other vendors (Norton, McAfee, etc.), visit their support pages and submit removal requests. Professional cleanup services handle these reports for you.

Glossary

• Backdoor: A hidden entry point installed by an attacker on a compromised website, allowing them to regain access and re-infect the site even after the original malware is removed.
• Blacklist/Blocklist: A database maintained by security vendors (Google Safe Browsing, Norton, McAfee, Sucuri, etc.) and web browsers that identifies known malicious or compromised websites and displays warnings to users.
• Malware: Malicious software designed to infiltrate, damage, or compromise a website or the devices of its visitors; includes viruses, trojans, ransomware, webshells, and injected code.
• Web Application Firewall (WAF): A cloud-based security layer that filters malicious HTTP/HTTPS traffic (SQL injection, cross-site scripting, brute-force attacks) before it reaches your website server.
• Indicator of Compromise (IOC): A sign or artifact indicating malware presence, such as hidden spam, unauthorized admin accounts, phishing pages, backdoor files, or suspicious database entries.
• Incident Response: The structured process of detecting, containing, cleaning, and learning from a security breach; includes forensic investigation, malware removal, hardening, and prevention measures to avoid re-infection.
• Remediation: The complete process of identifying, removing, and preventing malware; spans cleanup, hardening, monitoring setup, and verification that threats are fully eliminated.
• Two-Factor Authentication (2FA): A security method requiring two independent proof points (something you know, like a password; something you have, like a phone; something you are, like a fingerprint) to log in, significantly reducing account takeover risk.