How to check a website for malware: what online scanners see, and what they miss
Maybe a client told you your site "took them somewhere weird". Maybe your host sent an email with the word malware in the subject line. Or maybe something just feels off: the site is slower, a result you never created has appeared in Google, or there's a name in your user list you don't recognize. In every one of those cases the first question is the same: is the site infected or not?
The good news is that the first check costs nothing and takes less than a minute. The bad news, which is rarely said out loud, is that a free online check has a clear limit. It only sees what anyone on the internet can see. Everything hidden in your files and database stays out of its reach.
In this article we explain how to check website for malware the right way: how a remote check works, what exactly it can find, where it stops, how to read the result and when it's time for a deeper review.
In short: a free check scans publicly available content (HTML, scripts, redirects, Google Safe Browsing) and quickly confirms visible problems. A clean result is not proof that the site is clean, because backdoors in files and the database are invisible from the outside. If you have symptoms but the check is clean, you need a review on the site itself.
Why check a site that "works fine"
The most common misconception among site owners is that they would "notice" a hack. In practice it's the opposite. Modern malware is built so that the owner doesn't see it.
The attacker's goal isn't to break your site. It's to use it: to redirect visitors to their pages, to inject spam links that Google sees and you don't, to send email from your server, or to steal the data customers type in. All of that works better and longer if you don't know it's happening.
That's why infections are often set up to:
- activate only for visitors arriving from Google search, not when you type the address directly,
- show only on mobile phones,
- skip users who are logged in to WordPress admin,
- show only to Google's crawler, so the spam gets indexed,
- run only at certain hours or for visitors from certain countries.
So a site owner can look at their own site for months and see nothing, while visitors, Google and the host see something completely different. Regularly checking your website for malware is how you see what a stranger sees. A longer list of symptoms is in our article on signs a site is hacked.
How an online malware check works
An online check, or remote scanner, behaves like a visitor. The scanner's server opens your site over the internet, downloads what a browser would download, and analyzes it. It has no access to your hosting, files or database. That's why it needs no account, password or installation.
A good remote check usually does several things at once.
Reviewing HTML and JavaScript
The scanner downloads the source of the homepage and several inner pages and compares it against known malware patterns. It looks for things like hidden iframes, scripts loaded from suspicious domains, obfuscated JavaScript, code that injects links off-screen, or scripts that tamper with payment forms.
Checking redirects and cloaking
This is the part owners value most, because it's hard to check on their own. The scanner opens the site several times with different "identities": as a regular browser, as a mobile phone, as a visitor arriving from Google, as Google's crawler. If the site responds differently depending on who's looking, that's called cloaking, and it's one of the clearest signs of infection. More on this in site redirects to another site.
Google Safe Browsing and reputation lists
The check asks Google's Safe Browsing database whether your domain is flagged as dangerous. If it is, Chrome users already see a red warning and you have an urgent problem. What to do then is covered in website blacklisted by Google.
DNS, TLS and HTTP headers
It checks whether the domain points where it should, whether the SSL certificate is valid, and whether the response headers reveal anything unusual, such as an unexpected server-level redirect.
Our free website check does exactly this: it reviews public HTML and JS, up to 8 inner pages and 8 same-host scripts, tests cloaking with multiple identities, and checks Google Safe Browsing and the DNS and TLS chain. It usually finishes in under a minute.
What an online check can NOT see
This is the part most tools keep quiet about, and for you it's the most important. A remote check only sees what the server sends to a visitor. It doesn't see what's sitting on the server, waiting.
Backdoor files. A backdoor is a hidden entrance an attacker leaves so they can come back. It's usually a small PHP file in the uploads folder, among plugins, or buried in a theme file. It doesn't print anything on the page. Visitors don't see it, so a remote scanner doesn't either. How backdoors are found is explained in how to find a WordPress backdoor.
Code in the database that doesn't always show. Some infections live in the database and only fire under certain conditions. If the condition isn't met at the moment of the check, the scanner sees nothing.
Spam-sending scripts. A script sending thousands of emails from your server doesn't appear on the site. Your host sees it in the logs, you find out when your account is suspended, and a remote check doesn't see it at all.
Fake administrators. An unknown admin account exists only in the database. It isn't visible from outside.
Scheduled tasks. Attackers often leave a cron task that re-injects malware after cleanup. That's the classic reason an infection returns after cleanup.
Infections targeting specific visitors. If malware only runs for visitors from a particular country or at particular hours, a scanner can miss it.
So the simple rule is: a suspicious result is a strong signal; a clean result is a good sign, not proof.
How to read the result
The result usually falls into one of three categories.
The result shows risk
The scanner found something visible from the internet: a suspicious script, a hidden iframe, a redirect that fires for mobile visitors, or a Google Safe Browsing flag. This confirms the site is compromised.
What to do: don't panic and don't delete files blindly. What was found is only the visible part. There is almost always an invisible part too, usually the backdoor through which the code was injected. If you remove only the visible part, the infection returns within days. The order of steps is in my site is hacked: what to do first.
The result is clean and you have no symptoms
This is the best possible outcome for a quick check. It doesn't guarantee the site is clean, but it means nothing suspicious is currently reaching visitors. Repeat the check periodically, for example once a month, or set up automated monitoring.
The result is clean, but you have symptoms
This is the most important case and the one most often misread. If your host has sent an abuse notice, if you see an unknown administrator, if Google shows spam pages under your domain, or if the site is inexplicably slow, but the check shows nothing, it doesn't mean the host is wrong. It means the problem is where a remote check can't see: in the files and database.
In that case the next step is a deep review on the site itself.
What the most common findings mean
When the check shows risk, the report usually names the type of finding. Here's how to read them without a technical background.
Suspicious external script. The site loads JavaScript from a domain that has nothing to do with your site, theme or plugins. This is the most common way redirects and data-stealing scripts are injected.
Obfuscated code. A long string of letters and numbers with no readable word, decoded only in the browser. Legitimate plugins rarely do this on public pages; malware almost always does.
Hidden iframe. A frame zero pixels in size or positioned off-screen that loads someone else's page in the background. The visitor doesn't see it, but the browser runs it.
Different response for different visitors. The site shows one thing to Google's crawler and another to people, or one thing to desktops and another to phones. This is cloaking and almost always means infection.
Google Safe Browsing flag. Google has already judged the site dangerous. Visitors see a warning before they reach it.
Hidden links. Links to casinos, pharmacies or betting sites hidden by color, size or position. They're meant for Google, not people, and they hurt your rankings.
None of these findings tell you how the attacker got in. That only becomes visible in the files, logs and database.
Remote check vs. deep review: the difference in one table
| Remote check | Deep review on the site | |
|---|---|---|
| What it looks at | Public HTML, scripts, redirects, domain reputation | All files, database, users, scheduled tasks |
| Access needed | None | A dedicated tool on the site or hosting access |
| Duration | Usually under a minute | Depends on site size |
| Finds backdoors | No | Yes |
| Finds spam scripts | No | Yes |
| Finds fake admins | No | Yes |
| Price | Free | Part of the cleanup service |
A remote check is triage. A deep review is diagnosis.
How often to check your website for malware
For most small business sites, this is reasonable:
- Once a month, a quick remote check, if the site has no automated monitoring.
- Immediately after any suspicious signal: an email from your host, a message from a client, an odd Google result, an unknown user.
- After every cleanup, several days in a row, to confirm the infection hasn't come back.
- After major changes, such as installing new plugins or switching themes, especially if they came from outside the official repository.
For sites that directly bring in revenue, like shops and booking sites, a manual monthly check isn't enough. An infection can run for weeks before anyone notices. There it makes sense to have automated monitoring that compares the state of files and database every day and reports changes.
Common mistakes after a check
Ignoring a clean result when there are symptoms. If your host says the site is sending spam and the check is clean, believe your host. They see the server logs.
Deleting only what the scanner found. Visible code is a consequence. The cause is the entrance it came through. Without closing that entrance, the code comes back.
Installing five security plugins at once. Plugins don't remove what's already deep in the system, but they slow the site down and make diagnosis harder.
Restoring an old backup without checking. If you don't know when the infection started, you may restore an already infected version.
Waiting. Every day an infected site stays online means more visitors redirected elsewhere, more damage in Google and a higher risk of your host suspending you.
A manual check you can do yourself in 15 minutes
An online check is the fastest first step, but there are a few things you can check yourself with no tools at all. Combined with a remote check, they give a much fuller picture.
1. Look at the site through a stranger's eyes
Open a private window in your browser. Don't type the address directly; search for your company name on Google and click your result. Repeat the same on your phone, over mobile data rather than home Wi-Fi. Many infections fire only for visitors from search and only on mobile. If it takes you to someone else's site even once, you have confirmation.
2. Check what Google knows about your site
Search Google for site:yourdomain.com and go through the first few pages of results. Look for pages you didn't create: text in Japanese or Chinese, pages about pharmaceuticals, casinos, betting, replica watches. If you see them, the site is compromised even if the homepage looks normal. Explanations are in our articles on the Japanese keyword hack and pharma spam in Google results.
3. Open Google Search Console
If you have Search Console set up, open the security issues report. If Google sees malware, it will report it there first, often with specific URLs of infected pages.
4. Go through the user list in WordPress
In admin, open Users and filter for administrators only. Any account you don't recognize is a serious sign. Don't delete it right away, because deleting it doesn't close the entrance it was created through. Why, we explain in unknown admin account in WordPress.
5. Look at recent changes on your hosting
If you have File Manager access, sort files by modification date. Files in wp-content/uploads with a .php extension should not exist. Files modified at times when nobody on your side worked on the site are also a clue.
This manual check doesn't replace a deep review, but in 15 minutes it gives you enough information to decide whether the situation is urgent.
A special note for shops
If your site takes orders and payments, checking it for malware matters even more. With shops, attackers usually aren't after redirects but customer data. A script injected into the payment page can copy what the customer types while the shop keeps working perfectly normally. Orders come in, payments go through, and you find out only when customers start reporting card fraud.
A remote check can catch some of these scripts, especially those loaded from external domains. But some fire only on the payment page and only with a full cart, so an external scanner can't always trigger them. That's why shops need a stricter rule: regular checks plus automated file monitoring, not just occasional manual checks.
When it's time to contact us
Get in touch if any of the following happens:
- the check shows risk,
- the check is clean, but your host, Google or clients report a problem,
- the site has already been cleaned and the problem came back,
- it's a shop or a site that brings in revenue.
We do the deep review through a dedicated tool installed on the site that sees the files, database and accounts. Afterwards you get a clear report of what was found and what was removed. Cleanup starts from €100, and urgent cases are handled with priority during the business day, from €150.
Request a review or call +381 65 402 5000.
The first step takes less than a minute
If you suspect malware, you don't have to guess. Enter your site's address and in under a minute you'll know whether anything suspicious is visible from outside. If it is, or if you still have symptoms, we're here to go deeper.
