My host has suspended my site for suspicious activity

Why the suspension is almost never arbitrary

A shared host runs hundreds, sometimes thousands, of sites on the same physical servers. Abnormal activity on one account, whether mass spam sending, a script consuming disproportionate resources, or outgoing requests to a third-party service, directly threatens the stability of other sites on the same machine and the reputation of the host's IP range with anti-spam services.

That's why the shutdown is almost always automatic and immediate, triggered by an internal monitoring system before a human has looked at the case in detail. The host isn't trying to punish the merchant: it's isolating an account that objectively shows the same signals as a compromised site being used as a relay. On WordPress, this relay usually takes the form of an injected PHP script sending emails through the native mail() or wp_mail() function, or running background tasks via wp-cron.php at an abnormally high frequency.

The entry point that allowed this takeover follows the most common pattern on WordPress and WooCommerce: a plugin or theme that hasn't been updated for a long time, or, more rarely, a flaw in an extension that's actually recent but critical. That's the documented case of CVE-2023-28121 in the WooCommerce Payments plugin, an authentication flaw with a CVSS score of 9.8 affecting versions 4.8.0 to 5.6.1, which allowed an unauthenticated attacker to impersonate any user, including an administrator. The plugin was installed on more than 600,000 sites. The fix, version 5.6.2, was released on 23 March 2023, and Automattic force-installed it on affected sites given the severity of the flaw. Large-scale attacks only began on 14 July 2023, almost four months later, peaking at 1.3 million attempts against 157,000 sites on 16 July 2023 as recorded by Wordfence. Admin access obtained this way gives an attacker everything needed to install the script behind the suspension.