Website Malware Checker

What the Website Malware Checker checks

This checker answers a narrower and more honest question than “is my site clean?”: are there signs of infection that anyone can see from outside? It checks the page and every third-party script and frame it loads against Google’s Web Risk lists, the same lists behind Chrome’s red warning page, and against hosts known to have served malware, such as polyfill.io after it changed owners in 2024.

It then reads the page the way a careful reviewer would. It looks for the fake “verify you are human” boxes that tell visitors to press Win+R and paste a command (ClickFix kits), for blockchain calls on sites that have nothing to do with crypto, for code placed before or after the page’s HTML, for links hidden from visitors but shown to search engines, for packed scripts and invisible frames, and for scripts served from domains registered a few days ago. Nothing is sent to your server beyond a normal visit: the page, robots.txt and the sitemap.

Why it matters

Hacked sites rarely look hacked to their owners. Injected code often hides from logged-in administrators, from returning visitors or from everyone except search engines, and blocklists usually add a site days after the infection started. By then visitors have been sent to scams or infected, and search results show spam under your name.

Some things can never be seen from outside: a backdoor file on the server, a modified database row or code that only runs for some visitors. A result without signs therefore means “nothing visible within this scope”, not a guarantee, and the result says exactly what was checked. Read our guide to signs of infection for what each finding means.

How to fix common problems

If a blocklist lists the site or a strong sign appears, treat it as an incident. Take a backup for evidence, then find the injected code: compare theme and core files with clean copies, look at recently changed files and plugins, and check database options and widgets for script tags. Remove what you find, update everything and change every password and API key.

When the site is clean, ask Google for a review in Search Console under Security issues, and remove spam URLs from the index. Weak signs, such as a packed script or a new domain, are worth a look but often have an innocent explanation: confirm who added the code before you delete it.

To hear about new signs early, monitor the site from your account. The full PerfoMetrix audit adds what loads in a real browser and 170+ checks of security, performance and SEO.

Questions

Can this tool prove my site has no malware?

No outside scan can. Files on the server, the database and pages behind a login are not visible over the web. The tool reports signs it can see and lists what it checked.

Does the checker run anything on my server?

No. It makes the same requests as a normal visit (the page, robots.txt, the sitemap) and asks Google Web Risk and domain registries about the addresses it found. It never downloads or runs your scripts.

A sign was found. Is my site infected?

Not necessarily. A blocklist listing is a third-party fact; the other findings are signs worth checking. Each one links to a guide on how to confirm it.

Why can’t I see what was matched?

The snippets and hosts each sign matched are shown to signed-in members, so a shared result doesn’t hand anyone a list of a site’s suspicious code. A free account is enough.