Website Security Scanner
Enter a domain and we check its homepage from the outside, the way a visitor sees it: signs of malicious code, blocklists, SSL, security headers, cookies, an outdated CMS and email records. No install, no sign-up.
What is checked
- Homepage code: obfuscated JavaScript, hidden iframes, crypto miners, card-skimmer patterns, scripts from suspicious hosts, API keys in the HTML.
- Blocklists: URLhaus (malicious URL database) and Spamhaus DBL.
- HTTPS, HTTP-to-HTTPS redirect, SSL certificate expiry, outdated TLS 1.0/1.1, mixed content.
- Security headers (HSTS, CSP, X-Frame-Options and more), cookie flags, server version disclosure.
- CMS, WordPress plugins and JavaScript libraries visible in the code, matched against a database of known vulnerabilities (CVE).
- Email and DNS: SPF, DMARC, CAA, MTA-STS.
What an external scan cannot see
- Files on the server: web shells, backdoors and infected PHP files that print nothing on the homepage.
- Other pages of the site — only the homepage is checked.
- Malware shown only to Googlebot, mobile users, visitors from search or from certain countries (cloaking).
- The admin panel, database, passwords, and plugins’ internal code or versions that are not visible in the HTML.
- Exposed service files (.git, .env, backups) and vulnerabilities that only active probes reveal — we do not run those against sites without proof of ownership.
Need more than an outside view? PromoPilot Shield
This is the free part of our security scanner. Shield adds checks that require proof that you own the site:
- Deep scan ($19 one-off): exposed .git/.env and backups, CMS and plugin vulnerabilities, injection and SSRF surface, CORS, a cloaking and SEO-spam check as Googlebot. AI report with a fix plan, plus PDF.
- Ready-made fixes: an .htaccess file, nginx config and DNS records built from the findings (for paid scans).
- A read-only server agent that looks for web shells, backdoors and injected code in the site files and checks WordPress core integrity (with a comprehensive audit or a subscription).
- Monitoring from $12/month: scheduled rescans and alerts about new threats and certificate expiry.
Free Website Security Scanner and Malware Check
This tool checks a website from the outside — the way a visitor, a browser and a search engine see it. It loads the homepage and looks through its code for signs of infection: obfuscated JavaScript, hidden iframes, crypto miners, payment-card skimming code, scripts from suspicious hosts and API keys left in the HTML. The domain is looked up in the URLhaus malicious URL database and Spamhaus DBL. Alongside that it checks HTTPS and the SSL certificate, outdated TLS versions, security headers, cookie flags, CMS, WordPress plugin and JavaScript library versions against a database of known vulnerabilities, and the SPF, DMARC, CAA and MTA-STS email records. The scan is passive: no path brute-forcing, no attack payloads, no admin login attempts. You get an A+ to F grade and a list of findings grouped by risk, each with a short explanation.
How to Use
- Enter a domain or any page URL — the homepage of that domain is checked
- Wait for the scan to finish — usually 5 to 30 seconds
- Start with Critical and High findings, then work through the rest
FAQ
Checking a website for malware from the outside: what it can and cannot tell you
An online website malware scanner works the way a visitor’s browser does: it requests the homepage and looks at what the server sends back. If malicious code is embedded in that page — a redirect script, a hidden iframe, a crypto miner, a skimmer on the checkout form — it shows up. If the malware sits in files on the server and prints nothing on the homepage, no external scanner will find it, whatever it calls itself. So a clean result means “no signs of infection on the homepage or in public blocklists”, not “this site is guaranteed not to be hacked”.
| Visible from outside | Not visible from outside |
|---|---|
| Homepage code: obfuscated JavaScript, hidden iframes, scripts from suspicious hosts | Web shells, backdoors and infected PHP files that output nothing |
| Whether the domain is listed in malicious URL databases and spam blocklists | Inner pages, if only they are infected |
| CMS, plugin and JavaScript library versions, when they appear in the HTML | Plugins whose versions do not appear in the page source |
| SSL, HTTPS redirect, security headers, cookies | Malware served only to Googlebot, mobile users or visitors from search |
| SPF, DMARC and other email records | Passwords, the admin panel, the database |
Signs your website has been hacked
Most owners find out about an infection from symptoms, not from a scanner. Take a closer look if:
- Google shows a “may be hacked” note under your result, or Chrome displays a red warning page;
- visitors on phones or arriving from search land on someone else’s site, while a direct visit from your laptop looks fine;
- a
site:yourdomain.comsearch returns pages you never created — casino, pharma, Japanese keyword spam; - Search Console has a message in the Security issues report;
- your host suspended the account or emailed you about malicious files;
- unknown admin users appear in the CMS and mail from your domain starts landing in spam.
Many of these are exactly the kind of malware that hides from direct visits. If you see symptoms but the external scan is clean, look at the server files and the Search Console report, which lists sample infected URLs.
What to do if the scan finds signs of infection
- Back up the site and database as they are now — you will need the copy to work out how the attacker got in.
- Change passwords for hosting, FTP/SSH, the CMS admin and the database. Remove admin accounts you do not recognise.
- Find the source. Search for the code from the report in your theme files,
index.php,.htaccessand the database. Check recently modified files and any PHP files in the uploads folder — they should not be there. - Update the CMS, plugins and themes, and delete the ones you no longer use. An outdated component flagged in the report is the likely way in.
- Scan again, and if Google flagged the site, request a review from the Security issues report.
A “needs review” label means the signal is heuristic. Obfuscated code, for example, also appears in legitimate analytics snippets. Make sure it is not your own script before deleting anything.
Website vulnerability check: where to start
Even without an infection, the report shows weak spots. A sensible order:
- Critical and high — an outdated CMS or plugin with known CVEs, an expired certificate, no HTTPS. Fix these first.
- Medium — missing HSTS and Content-Security-Policy, cookies without Secure, legacy TLS 1.0/1.1. Usually a few lines of server config. For a header-by-header breakdown use Security Headers; for the certificate, the SSL checker.
- Low and info — server version disclosure, missing SPF, DMARC or CAA. Email records stop others from sending mail that pretends to come from your domain; set them up with the SPF and DMARC checkers.
If your mail goes to spam, also check the server IP against IP blocklists — that reputation is separate from the domain’s.
When an external scan is not enough
An external scanner does not replace a file-level check. If the site has been hacked before, takes payments or earns real money, a deeper check with server access makes sense. Once you verify ownership, PromoPilot Shield adds probing for exposed service files (.git, .env, backups), a cloaking check as Googlebot, a read-only server agent that looks for backdoors in files, and monitoring with alerts about new threats.