External scanners: what a visitor would receive
An external (or "remote") scanner requests pages from your site over the internet, just like a browser, and analyses what comes back. It needs no access to your server and cannot be switched off by an attacker who controls it.
What an external scan can detect
- Injected scripts, hidden iframes, cryptominers and obfuscated JavaScript in the pages it loads.
- Hidden spam links and spam content, including content shown only to search engine crawlers if the scanner also requests pages as one.
- Redirects to other sites.
- Scripts loaded from domains known to have served malware, and third-party scripts without integrity checks.
- Blocklist status, for example with Google Safe Browsing.
- Exposed files that lead to compromise:
.env,.git, database dumps and configuration backups. - Outdated software with known vulnerabilities, when versions are publicly visible.
What an external scan cannot see
- Backdoors: PHP files an attacker uses to get back in usually produce no output until they receive a secret parameter.
- Malware in pages the scanner does not load. Most external scanners check the homepage and a handful of linked pages, not every URL.
- Malware in the database that is not rendered on the pages checked.
- Infections that fire only under conditions the scanner does not meet: once per IP address, only for logged-in users, only at certain times, only for certain countries.
- Anything behind a login, such as the admin area or customer accounts.
This is why a clean external scan is not a clean bill of health. It is good at finding infections that affect visitors, which are the most harmful ones, and good at catching them early through regular rescans.
Server-side scanners: what is in your files
A server-side scanner reads the files (and sometimes the database) directly. It runs as a CMS plugin, a hosting control panel tool, or software on the server. It uses three main techniques:
- Integrity checks: compare files with official copies. For WordPress, core files and plugins from wordpress.org have published checksums, so any modified file stands out. This is the most reliable technique where it applies.
- Signatures: match known malicious code patterns. Fast and precise for known malware, blind to new or heavily obfuscated variants.
- Heuristics: flag suspicious traits, such as PHP files in an uploads folder, or code that decodes and executes strings. Catches more, with more false positives.
Server-side scanning has its own blind spots: premium plugins and custom themes have no official checksums, malware can be stored in the database, and a scanner running on a compromised server can in principle be tampered with.
How to scan your website for malware, step by step
- Run an external scan of the homepage and key pages (checkout, login, contact forms). With Webforta, add the site, verify ownership with one DNS record and start a scan; each finding shows the evidence seen, the risk and the fix.
- Check blocklists: Google Search Console Security issues and the Google Safe Browsing site status page.
- Run a server-side scan. Many hosts offer one in the control panel. On WordPress, the free Webforta WordPress Security plugin checks core and wordpress.org plugin files against official checksums, finds PHP hidden in uploads and reports known malicious code by file and line.
- Review recently modified files and unknown administrator accounts by hand. Scanners help, but this step finds what they miss.
- Schedule rescans. A one-off scan tells you about today. Weekly or daily scans, plus monitoring for new external scripts on your pages, catch reinfections quickly.
Reading the results
Treat each finding as a lead, not a verdict. A "suspicious script" might be a legitimate analytics tag, and a modified core file might be a developer change. Good scanners show you the evidence so you can decide: the exact script URL, the file path and line, or the response that triggered the finding. Webforta lets you mark a finding as a false positive so it does not return on later scans.
If you confirm malware, follow what to do when your website is hacked. Webforta pinpoints infected files but does not clean them; the plugin can quarantine a file (undoably) or restore official core files, and the rest is up to you, your developer or a professional cleanup service.