Website Malware Scanner

Security and access

Found malware or a vulnerability? We’ll clean it up and close the holes

BB STUDIO technical support from ₴2,900/mo: updates, backups, 24/7 monitoring and an outage response within an hour. One-off jobs welcome too.

Outage response within an hour
Malware and backdoor removal
HTTPS, DNS and domain email
Daily backups

Learn more: Malware removal

What the scanner checks

Only what is visible from outside, with no access to your hosting. That is enough to spot most hacks that visitors and Google see.

Page and script code The home page, up to 6 more pages and the site’s JS files: eval with base64, packed and obfuscated injections, hidden iframes, miners.

SEO spam Hidden blocks with links to other sites, casino and pharmacy words in hidden text, and Japanese keyword spam.

What Google sees We compare the page Googlebot gets with the one a person gets, plus what a visitor arriving from search on a phone receives.

Blacklists Google Safe Browsing (or a direct link to check in Google), Spamhaus DBL and SURBL for the domain, and spam lists for the server IP.

Exposed files .env, .git, wp-config copies, database dumps, archives and error logs. We check the file contents, not just the response code.

WordPress and OpenCart An outdated WordPress version, readme.html, xmlrpc.php, a public user list, and a leftover install folder in OpenCart.

Server settings HTTPS and SSL, mixed content, security headers, directory listing and software version disclosure.

What to do next Each finding comes with a short tip on how to fix it, plus links to independent services for a second check.

Signs your site has been hacked

Modern malware hides itself: the owner opens the site and everything looks normal. So you judge by indirect signs.

Strange links in the footer The most common case. Casino or pharmacy links are hidden in the footer, white on white — visible only in the page source.

Redirects only on mobile On a desktop the site loads fine; on a phone it sends visitors elsewhere. The code deliberately tells them apart.

A warning in search results Google flags the site as dangerous and the browser shows a red warning instead of your page. Traffic drops to near zero within a day.

Unfamiliar pages in search URLs you never created appear in Search Console, often in a language you do not use.

An email from your host The provider warns about suspicious activity or spam being sent from your account.

The site suddenly slowed down Injected code eats server resources. If speed dropped without any change on your side, it is worth checking.

What to do when malware is found

Order matters: clean up without changing passwords first and the code returns the same day.

1 Change every password Hosting, FTP, database, site admin — in that order. Otherwise the attacker simply returns through the door you left open.

2 Restore from a backup Use a copy made well before the infection. Faster and safer than hunting injected fragments by hand.

3 Close the hole Update the CMS and its extensions. Most break-ins come through an outdated plugin, and without updating it will happen again.

4 Check again Run the site through the check above and confirm it is clean. While you are at it, see whether the IP landed on a blacklist.

5 Request a review If Google has already flagged the site as dangerous, request a review in Search Console. How to do it and how long it takes is explained in the next section.

Google says “This site may harm your computer” — what to do

The red warning in Chrome or the label in search results is removed only after Google reviews the site again itself. Here is what to do.

1 See what Google found Search Console → “Security issues”: it shows the type of problem (malware, hacked with spam, phishing) and sample URLs.

2 Clean the site and close the hole Find and remove the malicious code, change every password, update the CMS and plugins. Otherwise the code will come back.

3 Request a review In the same section, click “Request review” and briefly describe what you fixed.

4 Wait for the decision Google usually reviews phishing within a day, malware within a few days, and spam hacks within up to several weeks.

How to avoid being hacked again

Updates A vulnerability in a popular extension gets published, and within hours bots are testing every site online. Updating closes that window.

Backups Automatic, and stored separately. A copy sitting next to the site disappears along with it.

Admin access Strong passwords, two-factor authentication, and an IP restriction if you always log in from one place.

Unused extensions Every plugin you do not use is an open door. Delete them rather than just switching them off.

Useful alongside this tool

AI website checker Lovable, v0, Bolt, Tilda, Wix — can Google and ChatGPT see the text? SSL Certificate Check SSL certificate: issuer and days remaining. Security Headers Check Security headers: HSTS, CSP, X-Frame-Options.

FAQ

What exactly do you check?

The home page, up to 6 more pages and the site’s JS files for signs of malicious code; hidden links and SEO spam; what Googlebot and visitors from search see; exposed service files and folders; common WordPress and OpenCart holes; SSL, security headers and domain and IP blacklists. Every finding comes with a tip on what to do.

Does this replace a proper website antivirus?

No, and that matters. We only see what is served externally: the code of several pages and scripts, service URLs, plus what Googlebot and a mobile visitor from search receive. Malicious code can hide in server files, in the database, inside plugins, or switch on only now and then. A full check requires file system access and a scan of the entire site. Our tool is a fast external diagnosis that catches the most common cases.

Why is an accessible .env or .git file dangerous?

A .env file usually holds database passwords, payment system keys and API tokens in plain text. If it is reachable by direct link, an attacker does not need to break anything: they simply open the URL and read your keys. A .git directory is no less dangerous: it lets someone reconstruct your entire source code along with its change history, which often contains passwords that were once committed and later removed. Both must be blocked at the web server level.

What should I do if malicious code is found?

Follow this order. First change every password: hosting, FTP, admin panel, database — infections usually start with stolen access. Then restore a clean backup made before the infection date. Update your CMS and all extensions: in most cases the entry point is an outdated plugin. Review the list of admin users — attackers routinely leave themselves an extra account. Once cleaned, submit the site for review in Google Search Console if it was flagged as dangerous.

How do I check a website for malware online?

Enter the site address in the field above and press “Check site”. In 10–30 seconds you get a score from 0 to 100, a list of findings by severity and a tip for each. No sign-up needed.

How do I find out whether Google has blacklisted my site?

The “Blacklists” section of the report shows the Google Safe Browsing status or a direct link to Google’s own check page. The most accurate source is Search Console, “Security issues”, which shows both the type of problem and sample URLs.

Why does my site redirect elsewhere only on phones?

That is how a common piece of malware works: it redirects only people arriving from search on mobile and leaves the owner, who opens the site directly on a computer, alone. The scanner separately opens the site as a mobile visitor from Google and will show such a redirect.

How much does malware removal cost?

With us it starts at ₴2,500 one-off: we clean the code and database, find and close the hole the attackers used, and help remove the Google warning. Protection and support afterwards start at ₴2,900/month. No prepayment.

What we offer

NEW CASE

Let's take the first step towards your website — write to us