Free website malware scanner
Is your site hacked? Enter a domain to check its homepage for injected scripts, hidden iframes, cryptominers, spam links, cloaked redirects shown only to Google, and Google blocklisting. Takes a few seconds, no account needed.
What this checks
- Malicious code on the homepage: hidden iframes, miners, obfuscated scripts, spam links, scripts from IP addresses and known bad CDNs.
- Cloaking: the page seen as Googlebot and as a search visitor, compared with a normal visit.
- Google Safe Browsing: whether browsers warn visitors away from the site.
- At most three requests to the homepage. Nothing is attacked or stored. Not a full scan of the site.
What website malware usually looks like
Injected scripts and iframes
Attackers add a script tag or an invisible iframe that loads code from their own server, often to redirect visitors, show fake updates or steal card details on checkout pages.
Cryptominers
Code that uses visitors' processors to mine cryptocurrency. Pages become slow and laptops get hot.
SEO spam and cloaking
Hidden links or whole pages about pharmacy, casino or loans, often shown only to Google so the owner never notices. Rankings fall and Google may label the site as hacked.
Conditional redirects
Visitors from a Google search on a phone are sent to scam sites, while a direct visit looks normal. Owners usually hear about it from customers.
Frequently asked
Is this a full malware scan?
No. It checks the homepage from the outside, the way visitors, Google and attackers see it. Malware in other pages, server files or the database, or code that shows only to some visitors, can be missed. For a complete picture, verify the site in Webforta: full scans, hourly malware checks and, on WordPress, file scans from inside the site.
What exactly does it request?
The homepage, loaded once as a normal browser (following up to three redirects that stay on the same site), then the same page once as Googlebot and once as a phone visitor coming from a Google search. That is at most three requests. Nothing is posted, no other pages or files are requested, and private or internal addresses are refused.
What does it look for?
Hidden iframes, cryptocurrency miners, obfuscated JavaScript, hidden spam links, scripts loaded from raw IP addresses or from CDN domains known to have served malware, spam or redirects shown only to search engines or search visitors, and whether Google Safe Browsing lists the site as dangerous.
My site was flagged. What now?
Change your passwords, then find and remove the malicious code, update all software and request a review from Google. Our guide to checking and cleaning a hacked website walks through it, and Webforta customers get a recovery guide built from their own scan results. Webforta does not offer a manual cleanup service.
Are results stored?
No. Results are not saved to a database or tied to an account. A finished result is cached for about 10 minutes so the share link works. A per-network counter is kept to enforce the hourly limit on free checks.
Why is the number of checks limited?
To keep the tool from being used against other people's websites: each network can run a few checks an hour, each website can only be checked a limited number of times an hour by everyone together, and there is a human check (Turnstile).