Free Website Virus Checker

What this website malware scanner checks

The tool fetches the source code of the page you enter and looks for patterns that often show up when a site has been hacked. It also checks whether a few common backdoor file names exist at the root of your domain.

• Hidden iframes: frames set to display:none, often used to load spam or harmful pages without the visitor seeing them.
• eval() calls: a JavaScript function often used to run hidden, encoded code.
• Base64 decoding: atob() or base64_decode() calls that can hide injected code.
• document.write(): an old method often used to inject content into a page.
• Scripts and iframes from unknown domains: anything loaded from outside a list of well known services such as Google, Cloudflare, Stripe or Shopify.
• Backdoor files: files like shell.php or c99.php that should never be public on a normal site.

Site security checks

Below the malware results you also get a set of site checks, each marked as passed, warning or failed:

• SSL certificate: whether it is trusted by browsers, who issued it and how many days are left before it expires.
• Security headers: which of six recommended headers your site sends, such as Strict-Transport-Security and X-Frame-Options.
• Mixed content: files loaded over plain http on an https page, which can break scripts or show a "Not secure" label.
• WordPress details: a visible version number, a public readme.html file or an uploads folder that lists all its files.

How to read your results

Each pattern that is found lowers the security score, and failed or warning site checks lower it a little too, and the report shows what was matched so you can find it in your code. A flag is a reason to look closer, not proof of an infection. Many safe sites use eval() inside a minified library, or load a script from a service that is not on our known list. Check where each match comes from before you change anything.

What to do if something looks wrong

1. Find the source. Search your theme, plugins and page builder for the matched code. Injected code often sits in the header, the footer or a recently changed file.
2. Update everything. Outdated plugins and themes are the most common way attackers get in.
3. Change your passwords. Reset admin, hosting and FTP passwords, and remove any users you do not recognize.
4. Restore or clean. If you have a clean backup from before the problem started, restoring it is usually the fastest fix. If not, ask your host or a security specialist to clean the files.
5. Scan again. Run the website virus checker once more after cleaning to confirm the flagged code is gone.

How to keep your site clean

• Install themes and plugins only from trusted sources, and delete the ones you no longer use.
• Turn on automatic updates for minor releases and security fixes.
• Use strong, unique passwords and two factor login for every admin account.
• Keep regular backups stored away from your hosting account, so you can roll back quickly.
• Limit admin access to the people who really need it.

Small habits like these stop most attacks before they start, and they make it much easier to check a website for malware and act fast when a scan does flag something.

When to check a website for malware

Run a scan when you notice warning signs such as strange redirects on mobile, spam pages showing up in Google results, new admin users or a browser warning on your domain. A quick monthly check is a good habit too. Hacked sites also often hide spam links with CSS, so the hidden content scan is a useful second step.

This website malware scanner only reads the public page source and a short list of file names, so it cannot see inside your server. For a site that handles payments or customer data, use it alongside a server side security plugin and regular backups.

Official reference: Google's Safe Browsing site status page shows whether Google currently flags a domain as unsafe, which is worth checking after any cleanup.