hakovansajt.com
Free website malware check: has your site been hacked?
Enter your website address and get a risk signal in under a minute. We check everything that's publicly visible: HTML and JavaScript, redirects, DNS and TLS, and whether your site is flagged by Google Safe Browsing. No account, no installation, no credit card.
Only publicly available content is checked. Files, database and admin accounts are not in this check.
What exactly we check
Our server opens your site the same way a visitor or Google would, and looks for patterns that commonly come with a compromise.
- Public HTML and JavaScript: injected scripts, obfuscated code and known malware patterns.
- Hidden iframes and spam links: content that visitors don't see but search engines do.
- Suspicious redirects: redirects to other domains, including ones that don't happen every time.
- Cloaking: we compare what your site shows a regular visitor with what it shows a search engine. Hacked sites often serve spam to Google and a clean page to the owner.
- Up to 8 internal pages and 8 same-domain scripts, because infections often don't show up on the homepage.
- HTTP headers, DNS and the TLS chain: whether the configuration and certificate look right.
- Google Safe Browsing: whether your site is already flagged as dangerous.
Every request goes through SSRF protection, so the tool can't be abused to attack other servers. The scan changes nothing on your site and never tries to log in.
What this check can't see
This is a surface-level signal, not proof that your site is clean. A remote scan can't see:
- backdoor files on the server that don't output anything to the page
- malicious code injected into the database that only triggers under certain conditions
- rogue administrator accounts
- scheduled tasks (cron jobs) that bring the infection back after a cleanup
That's why a clean result is not a guarantee. If you have symptoms but the scan shows nothing, the next step is a local inspection: a dedicated tool on the site itself that reviews files, the database and accounts.
How to read your result
The check found clear signs of compromise that are visible from the internet. Don't wait for Google or your host to act for you. Send us your site address and a short description and we'll tell you what to do next.
The check found something suspicious, but no clear proof of a compromise. It may be a harmless configuration or an early sign of infection. Look at what the report flagged. If you're also seeing any of the symptoms below, get in touch and we'll dig deeper.
Nothing suspicious is visible from the internet. That's a good sign, but not a guarantee, because a backdoor in the files or database stays invisible to this check. If you still see odd redirects, unknown accounts or a warning in search results, the next step is a local inspection. If you have no symptoms, run the check again from time to time or turn on monitoring.
Symptoms worth running a check for
- Google shows a warning that your site is dangerous.
- Visitors from search end up on someone else's site, while everything looks normal to you.
- Japanese or pharmaceutical text appears next to your business name in Google.
- Your host tells you the site is sending spam emails.
- The site has suddenly slowed down for no obvious reason.
- There's a WordPress administrator you don't recognize.
If you notice any of these, run the check right away.
What if your site is hacked?
The quick check stays free. When the risk is clear, we go deeper with a dedicated tool on the site, remove what we find and close the holes.
from €100
Deep scan of files, database and accounts, removal of malware and backdoors, short report.
from €150
Everything in Standard, plus priority handling during the working day and closing known holes after the cleanup.
from €30/month
Updates, backups, uptime and security monitoring, with an alert when something changes.
We confirm the exact price after a short review, before any work begins.
Frequently asked questions
Is the check really free?
Yes. No account, no credit card and no installation. Enter the address and you get a result.
How long does it take?
Usually under a minute.
Can the check slow down or damage my site?
No. The tool opens your site like a regular visitor and reads up to 8 pages and 8 scripts. It changes nothing, submits no forms and never tries to log in.
Can I check a site that isn't mine?
Yes. The check only uses publicly available content, the same content any visitor sees.
Does it only work for WordPress?
The check works for any publicly accessible website, regardless of platform. Our cleanup and maintenance services focus on WordPress and WooCommerce sites.
My result is clean, but the site still behaves strangely. What now?
That happens often. The most persistent infections hide in files and the database, where a remote scan can't see. Get in touch and we'll suggest a local inspection.