Is your website hacked?
Find out in 30 seconds.
itsMalicious scans your site the way attackers and Google see it: malware, injected spam, hidden links, cloaking, blacklists and leaked files. Anything suspicious is flagged as a warning with a clear fix.
No signup. No installation. Works with WordPress, WooCommerce, Shopify, Joomla, Drupal, custom sites.
- Malware & backdoor signatures
- SEO spam & hidden links
- Googlebot cloaking check
- Blacklist & reputation
- Exposed files & leaks
Typical scan takes 10–30 seconds depending on the target's speed.
Ten detection layers. One honest answer.
Most free checkers only match a few signatures. itsMalicious combines signature matching with behavioural checks that catch what modern hacks actually do: hide spam from you, show it to Google, and make money off your domain.
Malware & backdoors
Obfuscated JavaScript, eval/atob chains, ndsw and SocGholish injections, WP-VCD, cryptominers, card skimmers, hidden iframes, known malware domains and defacements.
SEO spam keywords
Pharma, casino and gambling spam in 9 languages, the Japanese keyword hack, counterfeit goods, essay mills and piracy terms, with relevance scoring so legitimate sites are not flagged.
Hidden content & links
Blocks hidden with display:none, off-screen positioning, zero font size or noscript tricks that contain outbound links. Invisible to visitors, indexed by Google.
Irrelevant link intelligence
Every outbound link is scored: spam anchor text, foreign-script anchors on a Latin site, high-abuse TLDs, spam-themed domains and commercial anchors unrelated to your topic.
Cloaking check
We fetch your homepage as a browser and as Googlebot and compare titles, text and links. Spam that only search engines can see is caught here.
Malicious redirects
Domain hijacks in the redirect chain, meta-refresh and JavaScript redirects to external sites, and redirect loops.
Blacklist status
Spamhaus DBL and ZEN, SURBL, URIBL and SpamCop out of the box; Google Safe Browsing and VirusTotal with your own API keys.
Software & versions
CMS detection, WordPress core version against the current release, visible plugins and plugins with a history of critical vulnerabilities, outdated jQuery.
Exposed files & leaks
.env, wp-config backups, .git, debug and error logs, SQL dumps, phpinfo, directory listings, user enumeration via REST and author archives, spam in sitemaps and robots.txt.
HTTPS & hardening
Certificate trust and expiry, HTTP to HTTPS redirect, mixed content, login forms posting insecurely or to third parties, security headers, version disclosure and cookie flags.
Built to catch the hacks others report as "clean".
Signature-only remote scanners miss cloaked spam and injected links because the page looks normal in a browser. We look at the site the way Google and attackers do, and then we hand you the tool to fix it, free.
| Capability | itsMalicious | Sucuri SiteCheck | Quttera | VirusTotal |
|---|---|---|---|---|
| Malware signature scan | Yes | Yes | Yes | URL reputation |
| Googlebot vs browser cloaking comparison | Yes | No | No | No |
| Irrelevant / foreign-language outbound link scoring | Yes | Partial | No | No |
| Gambling, pharma & Japanese keyword hack detection | 9 languages | Partial | Partial | No |
| Sitemap & robots.txt spam detection | Yes | No | No | No |
| Exposed .env / config / .git / log probes | 18 probes | Some | No | No |
| Fix instructions per finding | Yes | Generic | Generic | No |
| Clean-up tool included | Free plugin | Paid service | Paid service | No |
| Signup required | No | No | No | For details |
Comparison based on publicly documented features of each free tool as of October 2026. Product names belong to their owners.
Scan it. Find it. Fix it.
Scan
Enter your address. We fetch the site twice (as a visitor and as Googlebot), crawl a few internal pages and your scripts, and probe for leaks, all within about 30 seconds.
Find
You get a score, a verdict and every finding grouped by layer, with the exact evidence we matched, the affected URLs, and why it matters.
Fix
Anything found is marked as a warning with a fix. On WordPress, install the free itsMalicious plugin: it scans the server, repairs files, strips spam and puts a firewall in front.
Found something? Clean it with itsMalicious, free.
The remote scan shows you the symptoms. The plugin removes the cause, from inside your server, and keeps attackers out afterwards.
- Malware scanner & one-click repair. Compares core and plugin files with official checksums, flags modified, missing and unknown files, restores them, and quarantines everything it removes.
- Gambling & spam Content Guard. Finds casino, judi slot, togel, pharma and hidden spam links in posts, widgets, menus and options, cleans them and blocks new ones, even through REST and XML-RPC.
- Web Application Firewall. SQL injection, XSS, file inclusion, RCE, malicious uploads, fake crawlers, rate limiting and country blocking. Optional extended protection runs before WordPress loads.
- Login protection. Brute-force lockouts, two-factor authentication, breached-password checks, user-enumeration blocking.
- Hardening & alerts. Security headers, hidden version, protected config and log files, live traffic, audit log and email alerts.
Install in two minutes
- Download the zip above.
- In WordPress go to
Plugins › Add New › Upload Plugin, pick the zip and activate. Protection starts immediately with safe defaults. - Open
itsMalicious › Scanand run your first scan. Review the issues table and click Repair or Quarantine. The homepage is never deleted; spam is stripped from it in place. - Go to
itsMalicious › Firewalland click Optimize the Firewall for extended protection, then enable two-factor authentication on your profile. - Re-run the remote scan here to confirm the warnings are gone.
No telemetry. The plugin never sends your site data to us. Works on shared cPanel hosting, LiteSpeed, NGINX and managed WordPress.
Questions people ask before scanning
How do I know if my website is hacked?
Typical signs: visitors get redirected to other sites, Google shows pages or titles you never wrote (often casino, pharma or Japanese text), browsers or Search Console warn about the site, unknown admin users appear, email starts bouncing, or the site becomes slow. Many hacks show none of these to the owner, which is why the scan compares what you see with what Googlebot sees.
What does "irrelevant links or keywords" mean?
Hackers monetise your domain by injecting links and keywords for things you do not sell: casinos, pills, replica watches, essay services. The scanner builds a topic profile from your title and headings, then flags outbound links and keywords that do not belong, that are hidden, or that are written in a different script than your site.
Can a remote scan find everything?
No remote scanner can. It sees only public pages, not server files, databases or dormant backdoors. That is exactly why the free itsMalicious plugin exists: it scans from inside the server with checksums and signatures, and it cleans what it finds.
Will the scan harm or slow my site?
No. The scan makes a few dozen normal page requests, like one visitor browsing for a minute. It never logs in, submits forms or writes anything.
My site is not WordPress. Can I still use this?
Yes. The scanner works on any site. Every finding includes a fix you can apply on any platform, and your host can perform a server-side clean-up. The plugin is WordPress-only.
Why did a clean site get warnings?
Low and informational items, like missing security headers or a visible version number, are hardening advice rather than signs of a hack. Anything medium or above is worth a look. If you believe a finding is wrong, re-scan with "fresh" after fixing or tell us so we can tune the detection.