Website malware scanner: look for the signs of a hack from outside
Enter a site. This free website malware scanner loads its homepage and up to four pages it links to, the way a visitor does and the way a visitor arriving from Google search does, and looks for what hacked sites show: pharmacy, gambling or Japanese keyword spam, redirects to other sites, and a listing on Google's list of unsafe sites.
Free, no account. One site per scan: the homepage and up to 4 pages it links to. Results are kept for 24 hours and shared for the same address; up to 5 scans every 10 minutes and 20 a day.
What a hacked site shows from the outside
Spam on the pages
Pharmacy, gambling, counterfeit goods, payday loans and adult spam, Japanese keyword spam, and text in a script the site doesn't use: what most hacks inject so the site ranks for someone else.
Redirects for visitors from Google
Many hacks only redirect people who arrive from a search, so the owner never sees it. The scanner opens each page as a visitor from Google search as well, and flags one that's sent to another site only then.
Redirects off the site
A page that sends every visitor to another site, by an HTTP redirect or a meta refresh. The other site is named, never opened.
Search-based redirect scripts
An inline script that sends visitors elsewhere depending on whether they came from a search engine: a common hack, though some tracking scripts do it too, so it's something to look at, not a verdict.
Google's unsafe-sites list
Whether Google's Web Risk list has the address as possibly hosting malware, a suspected phishing or deceptive site, or possibly distributing unwanted software: the warning Chrome shows visitors.
Read-only
Ordinary requests for public pages and nothing else: it never logs in, never submits a form, and never opens the sites a redirect points to.
What a scan from the outside can't see
The scanner sees what the site shows to visitors. It can't see files on the server, so a backdoor, an extra admin account or malicious code that shows nothing on the pages won't turn up. A clean result means no signs of a hack were found from outside, not that the site is clean.
It also leaves out one view on purpose: hacks that show spam only to Google's crawler. Checking that means asking the site as Googlebot, which Relvato does only for a site's own owner. Spam injected on pages deeper than the ones the homepage links to isn't scanned either.
And it's one moment. Relvato's Signs of a hack monitor checks your own site again every day, including the view Google's crawler gets and spam in your Google Search results, and alerts you by email, Slack or webhook. On WordPress, the Relvato plugin also checks your core, plugin and theme files and your admin accounts from inside.
Questions, answered
Does a clean result mean my site isn't hacked?
No. It means none of the signs a hack shows to visitors were found on the pages scanned. Much malware hides on the server and shows nothing until it's used. If you suspect a hack, check your files, users and scheduled tasks too, or follow our WordPress hacked checklist.
Why does it load the pages twice?
Once as someone who typed the address, and once as someone who clicked a Google search result. Hacks often treat the two differently, so the owner, who types the address, never sees the spam or the redirect that searchers get.
My site is on Google's unsafe-sites list. What now?
Find and remove the cause first: the scan's other findings, your files and your admin accounts. Then ask Google to review the site in Search Console, under Security issues. Advisory provided by Google; the listing itself comes from Google's Web Risk service.
Does it work on WordPress and other platforms?
Yes. It looks at the pages from outside, so it works on any site: WordPress, WooCommerce, Shopify, Joomla, a static site or an app. Nothing needs installing.
What happens to the sites I scan?
Relvato loads a few public pages once, from a browser that can only reach public addresses, asks Google's Web Risk list about the address, and keeps the result for 24 hours so the same address isn't scanned again. Nothing else about the scan is stored.
Know about a hack before your customers or Google do.
Relvato's Signs of a hack monitor checks your site from outside every day, on any platform, and the WordPress plugin adds the view from inside: files, admin accounts and sign-ins. On every plan, Free included: on Free you run it yourself or weekly; paid plans run it daily.