If you suspect your website has been hacked, there are several warning signs and free security tools that can help you identify potential problems. However, no scanner can guarantee that a website is completely free from malware or security threats.
Quick signs your site may be hacked
- Sudden redirects/pop-ups, strange affiliate pages, or pharma/spam content.
- Unrecognised admin users, or password-reset emails you didn’t request.
- Traffic or server usage spikes you can’t explain.
- New/modified files in /wp-content/uploads/, unexpected .php files, odd cron jobs or .htaccess rules.
- Browser or Google search warnings when visiting your site.
Free external scanners (no install needed)
Run 2–3 of these to cross-check, each has different detection methods:
- Sucuri SiteCheck: remote scan for malware or unauthorised changes to website content and blacklist status: https://sitecheck.sucuri.net
- Quttera Online Scanner: remote scan for suspicious scripts or deliberately concealed malicious code and blacklist checks: https://quttera.com/scanwebsite
- VirusTotal: checks your URL against many security engines/blacklists: https://www.virustotal.com/gui/home/url
- Google Safe Browsing status: see if Google currently flags your domain: https://transparencyreport.google.com/safe-browsing/search
Note: Remote scanners only see the public side. Server-side malware (backdoors, injected core files) may not be visible externally.
Check with Google directly
- Google Search Console > Security & Manual Actions > Security issues, Google lists hacked content, malware, or phishing it detected. If anything appears here, treat it as high-priority.
If your site is WordPress
Install a WordPress security plugin to scan your website for malware, suspicious files and potential security threats. Depending on the plugin, additional features may include file integrity monitoring, firewall protection and security hardening:
- Wordfence (Free version): Malware scanner and firewall; scans WordPress core files, themes and plugins for malware, backdoors, malicious code and unauthorised modifications.
- Sucuri Security (Free version): File integrity monitoring, security activity auditing, remote malware scanning, blacklist monitoring and security hardening.
- Quttera (Free version): Scans website files for malware, malicious PHP code, suspicious scripts, backdoors and other security threats. Also checks security blacklists.
What to do if you see anything suspicious
- Put the website into maintenance mode or restrict access. Change all passwords (hosting, SSH, FTP, database and WordPress), and change them again after removing the infection.
- Back up your website before making changes, but remember that the backup may also contain malicious files and should not be restored without checking it first. Investigate suspicious files, then update WordPress, themes and plugins, and remove unused ones.
- Scan and clean your website with a security plugin. Confirm suspicious files are malicious before deleting them, particularly unexpected .php files in /wp-content/uploads/.
- Check for unknown administrator accounts, suspicious scheduled tasks or unexpected website configuration changes.
- If Google Search Console reports a security issue, fix it and request a review to remove the warning.
If you are concerned about your website’s security, contact me for a professional security review to help identify potential threats and recommend appropriate safeguards, please use my email: info@danielmrey.com
> Related article, Essential WordPress Apache Security Hardening: https://www.danielmrey.com/essential-wordpress-apache-security-hardening