How can you check if a website has malware?

Website malware is code someone has added to your site's files or database. It does not attack your own computer the way an email attachment might. It works on your visitors: it sends them to scams, shows fake warnings, captures what they type into forms, or uses your site to send spam.

Checking takes about fifteen minutes. Below are four steps, simplest first, and a plan for when you find something.

Symptoms you can spot without tools

Before you open any tool, think about whether any of these has happened:

• a customer says that opening your site took them to a prize draw, a fake shop or a message claiming their phone has a virus,
• searching Google for site:yourdomain.com shows pages nobody in your business created, such as adverts for pills or text in Japanese,
• the browser shows a red warning before letting people in,
• your host suspended the account or wrote to you about malicious files,
• email from your domain has started landing in spam,
• an administrator you do not recognise has appeared in the WordPress admin.

No symptoms does not mean a clean site. Malicious code often shows itself to only some visitors, for example only on phones and only to people arriving from Google. A logged-in administrator usually sees nothing. There is more on these signs in signs your website was hacked.

Step 1: Google Safe Browsing

Open the Google Safe Browsing site status page and enter your address. Google tells you whether it considers the site unsafe. Chrome and several other browsers use the same list, so if your site is on it, your customers see a warning.

The limit: the list shows only what Google has already found. A fresh infection may not be there yet.

Step 2: Google Search Console

If you have Search Console, open the Security issues report. Google lists hacked content there (injected code, injected content and injected URLs), malware, and pages that try to trick visitors. It usually gives example addresses, which are where you start looking.

Once the problem is gone, you request a review from the same report. How that works is covered in what to do when Google says your site is dangerous.

If you do not have Search Console, ask whoever looks after your site to add you as an owner. It takes a DNS record or a file on the server, and it is free.

Step 3: a scan from the outside

An online scanner sees the site the way a visitor does. Among its 20+ checks, ShieldWave looks at:

• whether the domain is on threat lists: Google Safe Browsing, URLhaus and DNS blocklists such as Spamhaus,
• whether the home page code contains hidden frames, suspicious redirects in scripts, or obfuscated code run through eval,
• whether the page loads scripts from bare IP addresses or from known malicious hosts,
• whether a cryptocurrency miner runs on the page,
• whether forms send data to a foreign server,
• whether files anyone can download sit on the server, such as a backup of the site.

The limit: a scanner sees what the site sends it. Code that shows itself only to mobile visitors arriving from Google, or a backdoor hidden in a PHP file with no trace in the page, can stay invisible. That is what step four is for.

Step 4: a check from the inside

You can check the files on the server in two ways. Many hosts have a file scanner in their control panel, usually under security settings. On WordPress, add a security plugin that compares your files with the official WordPress.org checksums and looks for PHP files in the uploads folder, new administrators and spam injected into posts.

How to choose one is covered in a free WordPress security plugin: what it should check.

How malware gets onto a site

Knowing this helps with the clean-up, because the same way in has to be closed afterwards. On small business sites, four routes come up again and again:

• An outdated plugin or theme with a known vulnerability. Bots check huge numbers of sites for specific versions and get in wherever nobody updated.
• A stolen or guessed password. For the WordPress admin, FTP or hosting, often a password also used on another service.
• A plugin or theme from a pirate source. Paid add-ons offered "for free" on random sites sometimes come with a backdoor included.
• A neighbour on the same server. On cheap shared hosting, another customer's infected site can reach your files if the server is badly configured.

Fixing the symptoms without closing the way in usually ends with the same problem a few days later.

What to do first when you find something

1. Do not delete things blindly. First ask your host or developer for a copy of the site as it is now. It helps work out what happened and since when.
2. Change passwords. For the WordPress admin, hosting, FTP, the database and the mailboxes on your domain. Remove administrator accounts you do not recognise.
3. Write down what you see. Screenshots, dates, addresses of suspicious pages, the wording of customer emails.
4. Tell your host. They often have tools and logs you cannot reach.
5. Think about data protection law. If the site collects personal data, through a form or a shop for example, and that data may have leaked, the GDPR (Article 33) gives you 72 hours from becoming aware of the breach to notify your supervisory authority. Other countries have their own rules, so check the one that applies to you.

When to call a developer

Straight away if any of these is true:

• the site takes payments or collects customer data,
• Google or a browser is warning visitors,
• your host has blocked the account,
• the malicious code comes back after you delete it, which usually means a backdoor nobody has found yet,
• you do not know which files were changed.

Deleting a single file rarely does it. A typical clean-up means restoring the site from a clean backup taken before the infection, updating everything, changing passwords and finding out how the attacker got in. Give your developer the list of symptoms, the dates and the scan results. The full ShieldWave report includes a brief they can price straight away.

Check your site. Enter your address at shieldwave.io. It takes about 90 seconds and needs no password and no account.