Skip to content
MaaSec
Free guide

How to check your website for malware

Website malware is code that an attacker has slipped into your site. It might redirect visitors to scam pages, show spam in Google results, steal payment details from your checkout, or quietly use your server to attack others.

Most website owners only find out when a customer or Google tells them. This guide shows how to check for yourself, using free tools, and what those tools can and can't tell you.

Written and reviewed by MaaSec volunteers · Last updated 1 November 2026

Signs your website may have malware

  • Visitors, especially on phones or arriving from Google, are redirected to other sites.
  • Google results for your site show titles or descriptions in another language, or for products you don't sell.
  • Your browser, antivirus or Google shows a warning when people visit your site.
  • New pages, files or admin users appear that nobody on your team created.
  • Your hosting company warns you about malware or unusual traffic, or suspends the account.
  • The site is suddenly slow, or your email from the website's domain starts landing in spam.

Some malware is designed to hide from the site owner. It only shows to visitors who aren't logged in, or only to people arriving from search engines. So a site that looks fine to you can still be infected.

How to check your website for malware for free

  1. 1Check Google Safe Browsing. Enter your address at Google's Safe Browsing site status. It shows whether Google currently considers your site unsafe.
  2. 2Check Google Search Console. If you've verified your site in Search Console, the Security issues report lists hacked content or malware Google has found, often with example pages.
  3. 3Run a free remote scanner. Reputable free scanners such as Sucuri SiteCheck load your public pages and look for known malware, blocklisting and outdated software.
  4. 4Check the address with VirusTotal. VirusTotal checks a URL against dozens of security vendors at once.
  5. 5Look at your site the way a visitor does. Open it in a private browser window, on a phone, and by clicking through from a Google search result.

What a website virus scanner can't see

Online scanners only see what your website sends to visitors. They can't see files on your server, your database, or malware that only activates for certain visitors. A clean result is good news, but it's not proof that your site is clean.

For a deeper check, scan from the inside as well:

  • Ask your hosting company whether they offer a server-side malware scan. Many include one.
  • If you use a CMS like WordPress, a reputable security plugin can compare your files with the official versions and flag changes.
  • Look at recently modified files on the server, and for files with odd names or in odd places, such as PHP files in an uploads folder.

Check my site for malware in Google's search results

A quick, free check that often reveals hidden infections: search Google for site:yourdomain.com (with your own domain). This lists the pages Google has found on your site.

  • Look for pages you never created, often with titles about medicines, gambling, cheap designer goods or loans.
  • Look for titles and descriptions in a language your site doesn't use.
  • Click a suspicious result from the Google results page. Some malware only redirects visitors who arrive from a search engine.

Spam pages like these usually mean an attacker can create files on your site, so treat them as a hack, not just an SEO problem.

How malware gets onto small websites

Knowing the usual ways in helps you check the right places and close the gap afterwards:

  • Outdated plugins, themes or CMS versions with publicly known vulnerabilities. Attackers scan the internet for them automatically.
  • Stolen or weak passwords for the CMS, hosting control panel or FTP, often reused from another site that was breached.
  • Abandoned extras: an old test copy of the site, a forgotten admin account, or a plugin that's switched off but still installed.
  • Upload forms that accept files without checking what they are.
  • Shared hosting neighbours: on some hosting setups, one infected site can affect others on the same account.

Scan my website for malware: a monthly routine

Ten minutes a month catches most problems early:

  1. 1Check Search Console for new security issues or warnings.
  2. 2Run a free remote scan and a Safe Browsing check.
  3. 3Install pending updates for your CMS, plugins and themes.
  4. 4Review the list of admin users and remove anyone who shouldn't be there.
  5. 5Make sure your latest backup ran and is stored somewhere safe.

What to do if you find malware on your site

Don't just delete the infected file. Malware usually comes back unless you also close the hole the attacker used. Follow our step-by-step guide: my website was hacked: what to do now.

Malware scan or penetration test: what's the difference?

A malware scan looks for signs that your site has already been compromised. A penetration test looks for the weaknesses an attacker could use to get in, such as outdated software, risky settings, exposed files or weak login protection, so you can fix them before anything happens.

They complement each other. Our free AI penetration test is not a malware scanner, but it can tell you where your site is vulnerable.