Free tool
Website Malware Scanner
Check any website for malware, injected scripts, spam links, malicious redirects and blocklisting, the way visitors and Google see it.
Free · no sign-up · 10 pages and their scripts · read-only, nothing is changed on your site · reports kept for 30 days
What we check
The Signs of a Hacked Website
Most hacks are built to stay hidden from the site owner. The scanner looks at the site from several angles — as a visitor, as a phone user from Google and as Googlebot — to catch what you would not see yourself.
Malware & injected code
Known infections such as the NDSW injector, crypto miners, card skimmers, fake browser updates and scripts hidden in encoded or obfuscated code.
Spam & SEO hacks
Hidden pharma, casino and “slot gacor” links, the Japanese keyword hack, and spam shown only to Googlebot (cloaking).
Malicious redirects
Redirects that only hit mobile visitors from Google, redirects after the page runs, pop-ups and meta refreshes to other sites.
Blocklists
Your domain and every outside script, iframe and redirect target checked against the Spamhaus DBL and SURBL blocklists.
Outdated software
WordPress core against the latest release, Drupal 7, old jQuery with known XSS holes and unsupported PHP versions.
Security hardening
SSL certificate validity and expiry, security headers, server version leaks and PHP errors shown to visitors.
FAQ
Website Malware Scanner Questions
What does this website malware scanner check?
It loads your site the way visitors and search engines do and looks for signs of a hack: known malware and injected scripts, obfuscated JavaScript, crypto miners, card skimmers, hidden spam links (pharma, casino, gambling), the Japanese keyword hack, hidden iframes, defacements, redirects that only hit visitors coming from Google or on mobile, and redirects that happen once the page runs. It also checks your domain and every outside script against the Spamhaus DBL and SURBL blocklists, flags outdated WordPress and jQuery versions, and reviews security headers and your SSL certificate.
Can a remote scan find every infection?
No remote scanner can. We see what your server sends to the public: the pages, the scripts they load and how the site behaves. Backdoors, web shells and malware hidden in server files, the database or admin-only pages do not show up until they affect the public site. A clean result is a good sign, not a guarantee; if your site behaves strangely, a server-side scan of the files and database is the next step.
Why does my site redirect only some visitors to spam?
Many infections hide from the site owner. They redirect only visitors who arrive from Google, only mobile users, or only first-time visitors, and show normal content to logged-in admins and to Googlebot. That is why we fetch your pages as a desktop visitor, as a mobile visitor arriving from Google and as Googlebot, and compare where each one ends up.
What should I do if the scanner finds malware?
Act quickly: take a full backup for evidence, change all passwords (hosting, FTP, database, admin users), update the CMS, themes and plugins, and remove the malicious code from the files and database, not just from the page. Then find how the attacker got in so it does not come back, and ask Google to review the site if it was flagged. Our malware removal service can do all of this for you.
Is the scan safe for my website?
Yes. The scan only reads public pages and files, much like a visitor with a browser: about a dozen page loads plus the scripts they use. It does not log in, submit forms, try passwords or probe for secret files, and it runs from our server in Germany with its own identifiable user agent.
Is the scanner free, and can I get the report as a PDF?
Yes, it is free with no sign-up, and reports are kept for 30 days so you can share the link. To receive a PDF, enter your email address under the report: we send a one-time code to confirm the address, then email the full report. We do not add you to any mailing list.
Let’s Connect
Has Your Website Been Hacked?
We clean infected WordPress and other websites, remove malware from files and the database, close the security hole, get blocklist warnings lifted and keep the site protected.