Website Virus Checker: How to Scan a Site for Malware
A customer emails to say your site just redirected them to a fake prize page. Your homepage looks normal to you. A website virus checker is the fastest way to find out whether your site has been infected, but a single free scan rarely tells the whole story. Here is how to check properly.
What Is a Website Virus Checker?
A website virus checker is a tool that scans a site’s pages, scripts and files for malware, malicious redirects, injected spam and blacklist warnings. Remote checkers scan what visitors see from outside; server-side scanners inspect the files and database directly. Most site owners need both.
Website Virus vs Website Malware
“Website virus” is the everyday term, but websites rarely catch true self-copying viruses. What they usually carry is malware: injected JavaScript, hidden redirects, backdoor scripts, phishing pages, spam links or code that pushes downloads to visitors.
What a Website Malware Scanner Checks
- Malicious or obfuscated JavaScript and iframes
- Redirects to scam, phishing or adware pages
- Injected spam links and pharmaceutical or casino content
- Known malware signatures in files
- Blacklist status with Google Safe Browsing and security vendors
- Outdated software versions with known vulnerabilities
Signs Your Website Has Malware
- Browsers or Google show a “Deceptive site ahead” or similar warning
- Visitors, especially mobile users or those arriving from search, are redirected elsewhere
- Strange pop-ups or fake virus alerts appear
- Search results show spam titles or foreign-language pages under your domain
- Unknown admin users, files or scheduled tasks appear
- Your host suspends the account or reports unusual traffic
- Google Search Console reports security issues
Some infections only trigger for first-time visitors or certain devices, so “it looks fine to me” is not proof.
How to Scan a Website for Malware (Step by Step)
Step 1: Run a Free Remote Website Virus Check
Enter your URL into a remote scanner such as Sucuri SiteCheck. It loads your public pages like a visitor and reports visible malware, spam, redirects and blacklist status. It is quick, but it cannot see files on the server.
Step 2: Check Blacklist Status in Google Safe Browsing and Search Console
Look up your domain in Google’s Safe Browsing site status tool. Then open Google Search Console and check the Security Issues report, which lists hacked content, malware or deceptive pages Google has found, often with sample URLs.
Step 3: Scan URLs and Files With VirusTotal
Submit your URL, and any suspicious files you find, to VirusTotal. It checks them against many antivirus engines and URL blocklists at once, which helps confirm whether something is flagged widely or by only one vendor.
Step 4: Run a Server-Side Scan of Files and the Database
Use a server-side scanner, a security plugin or your host’s malware scanning tool to inspect every file and database table. This is where backdoors, modified core files and hidden admin accounts show up. Compare core files against clean copies from the official source.
Step 5: Review Results and Confirm Infections
Not every flag is real. Check flagged files against known-good versions, look at modification dates, and review server access logs for unusual uploads or logins. Note every infected file before you start cleaning.
Remote vs Server-Side Website Scanning
| Remote scanning | Server-side scanning | |
|---|---|---|
| What it sees | Public pages and loaded scripts | All files, database and configuration |
| Setup | None; enter a URL | Plugin, agent or host access |
| Finds backdoors | Rarely | Yes |
| Finds blacklist status | Yes | Sometimes |
| Best use | Quick check and monitoring | Confirming and cleaning infections |
A clean remote scan does not mean a clean site. Backdoors and dormant code often stay invisible until triggered.
Free Website Virus Checkers to Know
These tools are listed for reference, not ranked.
Sucuri SiteCheck
A free remote scanner that checks public pages for known malware, spam, defacements and blacklist status.
VirusTotal
A free service that analyzes URLs and files against many security engines and blocklists.
Google Safe Browsing Site Status
Google’s public tool showing whether Google currently considers a site unsafe.
urlscan.io
A free service that loads a page in a sandbox browser and records every request, redirect and script, useful for spotting where malicious code calls out to.
Quttera and PCrisk Website Scanner
Additional free remote scanners that check for malicious code and suspicious files from outside.
How to Scan a WordPress Site for Malware
WordPress sites are common targets because of plugins and themes. Keep core, plugins and themes updated, remove anything unused, and run a server-side scanner inside the site.
Wordfence, MalCare and Jetpack Scan
Wordfence, MalCare and Jetpack Scan are widely used WordPress security plugins that scan core files, plugins, themes and, in some cases, the database for malware and known vulnerabilities. Choose one and avoid running several scanners at once, which can slow the site.
What to Do If the Scan Finds Malware
Isolate, Clean and Restore From Backup
- Put the site in maintenance mode or take it offline.
- Change every password: hosting, database, admin, FTP and SFTP.
- Restore from a clean backup made before the infection, or remove malicious code and replace core files.
- Update all software and remove unused plugins.
- Rescan with both remote and server-side tools.
CISA and the UK NCSC both publish guidance on recovering from compromise; if customer data may be exposed, check your legal reporting duties.
Request a Google Review and Blacklist Removal
Once the site is clean, use Search Console’s Security Issues report to request a review. For other blocklists, follow each vendor’s delisting process.
How to Check if a Website Is Safe Before You Visit
Visitors can paste a URL into Google Safe Browsing site status or VirusTotal before opening it. Watch for misspelled domains, keep the browser’s built-in protection turned on, and never install software a site says you “need” to view a page.
How Often Should You Scan Your Website?
Run automated server-side scans at least daily for business sites, with remote monitoring alongside. Scan again after every plugin, theme or code update, and immediately if you see any warning signs.
Your Website Virus Checker Routine
Use this checklist to keep your site clean:
- [ ] Weekly remote website virus checker scan
- [ ] Daily automated server-side scan
- [ ] Search Console security alerts switched on
- [ ] Software, plugins and themes updated promptly
- [ ] Off-site backups tested regularly
- [ ] Strong, unique admin passwords with MFA
For help cleaning an infected site or setting up monitoring, contact Cyber Security Solutions Ltd through our contact page.
FAQs
For a quick check, yes, but not for full protection. Free remote scanners only see public pages, so they miss backdoors, modified files and database injections on the server. Business sites should add a server-side scanner, regular backups and monitoring, especially if they handle customer accounts or payments.
Yes. A compromised or malicious site can push fake software downloads, redirect you to phishing pages or try to exploit outdated browsers and plugins. Keeping your browser and operating system updated, using built-in browser protection and never installing software a site urges you to download greatly reduce the risk.
Common signs include browser warnings, unexpected redirects, spam pages in search results, unknown admin accounts, new or modified files you did not create, and security alerts in Google Search Console. Some infections only target certain visitors, so scan from outside and inspect server files to be sure.
Yes. Google Safe Browsing regularly checks sites and warns users when it finds malware or deceptive content. If you verify your site in Google Search Console, the Security Issues report tells you what Google found, and you can request a review after cleaning the site to remove warnings.
Simple infections can be cleaned in a few hours, especially with a recent clean backup. Complex cases with many backdoors, database injections or blacklisting can take several days, including Google's review. Finding and fixing the original entry point, such as an outdated plugin, is essential to stop reinfection.
A scanner finds problems after they happen; a web application firewall blocks many attacks before they reach your site, such as exploit attempts against plugins and brute-force logins. Most businesses benefit from both: the firewall reduces infections, and the scanner catches anything that gets through.
