Website Malware & Security Checker

What a website malware checker can see

This checker looks at a site the way an outside scanner, a search engine or a visitor's browser does. It downloads the page from our servers, follows every redirect, and reads the HTML and the response headers that come back. Then it compares what it finds against the patterns that infected sites share: code that decodes itself before it runs, frames that visitors cannot see, forms that quietly send passwords elsewhere, spam keywords that have nothing to do with the site, and scripts pulled in from places no legitimate site would use.

It also looks at the things that make an infection more likely or more damaging. An expired certificate, a missing Content-Security-Policy, a server that announces its exact version, or a .env file that anyone can download are not malware, but they are how malware gets in and how it gets found. Each result explains what was found, why it matters and what to change, so you can act on it without being a security specialist.

Because the scan reads what the server sends, it is safe to run on any public site, including one you suspect is already compromised: nothing is executed and nothing is installed. For the same reason, run it on a few different pages, not only the home page. Infections are often limited to one template, one plugin or one directory.

What it cannot see, and what to do about that

A remote scan reads the page as delivered. It does not log in to the server, so it cannot see a backdoor sitting in a file the page never references, a modified core file whose output looks normal, or a cron job that reinstalls the infection every night. It also does not run JavaScript, so a payload that only assembles itself in the browser is seen in its encoded form, which is exactly what the obfuscation checks are for.

Treat a clean result as "nothing visible from outside", not as proof that a site is clean. If visitors report redirects you cannot reproduce, Google flags the site, or pages appear in search results that you never wrote, follow up with a server-side scan: compare the installed files with the originals (WordPress users can run wp core verify-checksums), look for files changed in the last few days, and search the code for base64_decode and eval. A suspicious result here tells you where to start looking.

After a clean-up, run the check again and then keep an eye on the site. A compromised site usually goes down, slows down or starts redirecting before anyone notices the cause, so pair this scan with uptime monitoring and SSL monitoring, and use the HTTPS Redirect Checker and Redirect Checker when a redirect looks wrong.

How the risk level is worked out

Every finding has a weight. A sign of infection (injected code, a blacklisting, a skimmer form) weighs most, a serious exposure (a readable secrets file, an invalid certificate, a site served over plain HTTP) comes next, and a hardening gap (a missing header, a leaked version number) weighs least. The risk level follows: Low means nothing more than optional hardening was found, Medium means several hardening gaps, High means a problem that leaves the site open to attack, and Critical means there is evidence that the site is already compromised or blacklisted.

The list at the top of the report holds only the findings that need action, worst first. Every check, including the ones that passed, is repeated in its section further down so you can see what was covered. The table of external scripts lists every third-party domain the page runs code from; a domain you do not recognise is the quickest lead there is.

How to use the Website Malware & Security Checker

1. Enter the domain or page address you want to check. You can leave out https://.
2. Press Scan website. The page is fetched from our servers, the way a search engine crawler would fetch it.
3. Read the findings from top to bottom: problems first, then warnings. Each one says what to change.

Common problems and how to fix them