Website malware scanner: free check for hacked sites
Scan a website for malware in a few seconds. This free website malware scanner loads the page as a visitor, as Googlebot and as a phone from Google search, then checks it for injected spam, hidden links, redirects and outdated WordPress plugins.
Three visitors, one page
We load the page as a desktop browser, as Googlebot and as a phone coming from Google, then compare them. Some hacks hide from the site owner this way.
Spam, scripts and frames
Hidden links, pharma, casino and Japanese spam, scrambled JavaScript, hidden iframes and redirects to other sites.
WordPress versions
WordPress, plugin and theme versions the page reveals, checked against the latest releases on WordPress.org.
What the website malware check looks for.
Six groups of checks on one public page. Some findings are clues rather than proof (a hidden menu or an ad script can look like injected code), so each one says in plain words what it means and when it is likely harmless.
- Redirects and cloaking
- We request the page three times: as a desktop browser, with Googlebot’s user agent, and as an iPhone with Google search as the referrer. If one of them lands on another website, or the Googlebot request gets spam that visitors do not, the scan flags it. Some hacks hide from the site owner this way.
- Injected spam
- Pharma, gambling (including Indonesian "slot gacor" casino spam), payday loans, fake designer goods and adult terms, plus the Japanese keyword hack: pages of Japanese shopping spam on a site that is not in Japanese.
- Hidden links and frames
- Links to other websites inside elements that visitors cannot see, and invisible iframes that load another site. Both are classic signs of injected code.
- Scripts
- Inline JavaScript that hides what it does (eval, packed or encoded code), redirect scripts, scripts loaded from a bare IP address or from domain extensions that malware campaigns use heavily, and a list of every outside script domain to check you recognise.
- WordPress
- The WordPress version the page reveals, compared with the latest release and with the latest security release on its own branch, plus plugin and theme versions read from their file links, compared with WordPress.org. Plugins that WordPress.org has closed are flagged too, with the reason it gives.
- HTTPS and headers
- Whether the page loads over HTTPS, whether it answers with an error, which security headers are missing and whether the server announces its software versions.
What an outside scan cannot see.
A scanner that only gets a web address, this one included, works from outside. These are the gaps, so you know what a clear result does and does not tell you.
- Server files and the database
- Backdoors, malicious admin accounts and scheduled jobs live on the server. An outside scan sees only what the page sends, so a clear result does not mean the site is clean.
- Cloaking by IP address
- Some hacks show spam only to requests that really come from Google. Our Googlebot visit catches the ones that look at the browser name. URL Inspection in Google Search Console shows the HTML Google got when it last crawled the page.
- Other pages
- We scan the one address you enter. Spam is often added as new pages deeper in the site, so scan any page that looks wrong as well.
- Google’s blocklist
- We do not query Google Safe Browsing from here. The result links to Google’s own site status page for your domain.
- Known vulnerabilities
- We compare versions with the latest release, not with a vulnerability database, and premium plugins sold outside WordPress.org cannot be compared.
Five signs of a hack you can check in minutes.
These cover what a scan of one page can miss.
- Search results
- Search Google for site:yourdomain.com with words such as viagra, casino or replica. Pages you never wrote, or titles in another language, are a strong sign spam was added.
- Search Console
- The Security issues report lists hacked content and malware that Google has found on the site. The Manual actions report shows whether a Google reviewer has taken action against the site.
- Your phone
- Open the site from a Google search on your phone, not from a bookmark. Redirect hacks often fire only for visitors who arrive from search.
- Admin users
- In WordPress, look under Users for administrator accounts nobody on your team created.
- Your host
- A suspension notice or a malware warning from the host usually comes after its own scan found something. A sudden spike in outgoing email can also mean a hack is sending spam, so ask the host for the logs.
If the scan finds signs of a hack.
One hacked website, fixed in 24 hours. Fixed, for one WordPress or PHP website on hosting you control. 350+ malware cleanups since 2019.
- Turnaround
- Malware removed, the site hardened and the clean site serving over HTTPS within 24 hours after we confirm in writing that access works (we confirm Mon–Fri, 04:00–16:00 UTC)
- If we miss it
- US$200 back if the clean site is not serving within the 24 hours, unless your host’s own suspension, already filed for review, is still pending
- Reinfection
- One free re-clean if the same site is reinfected within 30 days, while our hardening and the new passwords stay in place
What the fix includes, the refund rule and how bigger jobs are quoted are on the hacked website repair page. On an unsupported PHP version, the PHP upgrade moves it to a release that still gets security fixes.
Website malware scanner questions.
Is this website malware scanner free?
Yes. There is no sign-up and no limit beyond 10 scans per connection every 10 minutes, which stops the scanner being used to flood other sites.
Can an online scanner prove my website is clean?
No. An online scanner sees only what your pages send to visitors. Malware in files or the database can sit quietly until it is triggered, so no findings means none were visible from outside, not that the site is clean. A full check needs access to the server.
Why does the scan visit as Googlebot and as a phone?
Some hacks only show themselves to some visitors. Spam is served to Googlebot so it ranks, or redirects fire for phone users arriving from Google, while the site owner on a desktop sees a normal page. The scan sends one request with Googlebot’s user agent and one as an iPhone coming from Google, so it catches the hacks that go by those signals. Hacks that check for Google’s real IP addresses need URL Inspection in Search Console.
Does the scan change anything on my site or keep a record?
No. We request the page the way a browser does and read the HTML and headers. Nothing is sent to your site except those page requests, which name the scanner in their user agent. The result is kept in memory for 10 minutes so a repeat scan is quick, and is not written to a database.
Do I still need a WordPress security plugin?
They answer different questions. A security plugin can read the files on your server, which an outside scan cannot. An outside scan sees what visitors and Google get, which a plugin can miss when the hack only targets some visitors. On a site that is already hacked, the attacker can change the plugin’s files too, so a clean plugin report is not final either.
What does it cost to fix a hacked website?
One hacked WordPress or PHP website is US$590 fixed: malware removed from the files and database, the way in closed where the logs allow, and the site serving clean within 24 hours after we confirm access works. If we miss the 24 hours, US$200 comes back. Several sites, a server or an app start with a free review and a written quote.