How to react to abnormal activity detected on your web hosting

Knowledge Base

KB0072795

How to react to abnormal activity detected on your web hosting


Icons/System/eye-open Created with Sketch. 42 Views 02.10.2025 Web / Web Hosting

Objective

This guide explains the possible reasons why you might be notified about abnormal activity detected on your web hosting, the temporary consequences (security blocks), and how to restore functionality once the issue is resolved.

Discover how to react to unusual activity on your OVHcloud web hosting.

Requirements

OVHcloud Control Panel Access

  • Direct link: Web hosting
  • Navigation path: Web Cloud > Hosting plans > Select your web hosting plan

Instructions

To protect your website and visitors, we automatically activate security measures whenever unusual activity is detected on your web hosting. The cause is not always an attack; it could also be a poor website configuration, a third-party script, or a faulty extension, for example.

Why is this message displayed?

We have detected unusual activity that could harm your service:

  • Case 1 – Detected malware: Likely presence of malicious files
  • Case 2 – Unusual volume of emails sent via PHP (scripts/applications)
  • Case 3 – Unusual volume of outgoing requests (external connections)

For security reasons and depending on the situation, certain features may be temporarily blocked:

  • Website access (Case 1)
  • Email sending via PHP (Case 1 and Case 2)
  • Outgoing requests (TCP OUT) (Case 1 and Case 3)

What are the consequences for my website?

  • Depending on the detected unusual activity, your website may no longer be online and accessible to visitors.
  • Emails sent via PHP (forms, notifications, etc.) and/or outgoing connections (external APIs, webhooks, HTTP updates, etc.) may be temporarily disabled, depending on the case.

Steps to resolve the situation

Case 1 — Detected malware

Your hosting likely contains malicious files. To understand and address these anomalies, follow our guide:
Use Case - Recommendations After Your Website is Hacked

Once the cleanup is complete, refer to the section "Lift Security Measures" below.

Case 2 — Unusual volume of emails sent via PHP

Your website has sent a number of emails via PHP exceeding the normal threshold. This action could be legitimate (campaign, newsletter module) or undesired (abusive use of a form, misconfigured script, compromised extension). To understand and resolve these anomalies, consult our guide:
Track and Manage Automated Emails from Your Web Hosting

Once the situation is normalized, proceed to the section "Lift security measures".

This measure does not apply to sending messages from an email account (via webmail or a mail client). It only applies to emails sent via a script (the PHP mail() function or SMTP sending triggered by an application on your web hosting).

Case 3 — Unusual volume of outgoing requests (TCP OUT)

Your website is making numerous external connections (APIs, updates, HTTP calls, etc.). This could indicate a malfunction. To understand and resolve these anomalies, consult our guide:
Use Case - Recommendations After Your Website is Hacked

Once the cleanup is complete, refer to the section "Lift security measures" below.

Lift security measures

Perform this step only after applying the recommendations above (diagnosis, corrections/updates, security hardening). If abnormal activity is detected again during a subsequent scan, security measures will be automatically reactivated. You will receive a new notification, and the blocks will remain in place until the situation is permanently resolved.

  1. Log in to your OVHcloud Control Panel, go to Web Cloud, then click on your web hosting.
  2. An alert window appears: Abnormal Activity on Your Hosting. If you click the Later button, an alert banner Abnormal Activity Detected appears at the top of the page. Click Learn More to reopen the alert window.
  3. Check the box: I confirm I have performed all necessary actions to resolve the issue.
  4. Click Lift Security Measures.
  5. A confirmation banner appears at the top of the page: Your hosting is being analyzed to lift the security measures. Track progress by clicking the link View Ongoing Tasks or directly from the Ongoing Tasks tab.

Ensure your service is eligible for automatic unblocking (certain statuses do not allow immediate lifting of measures).

Go further

How to secure a website

For specialized services (SEO, development, etc.), contact OVHcloud partners.

If you would like assistance using and configuring your OVHcloud solutions, please refer to our support offers.

Join our community of users.

Related articles