Is Your WordPress Site Hacked?
Run a free instant check for malware, Google blacklist warnings, spam injections, and security gaps. See your result in seconds.
What the Scanner Checks
A fast first look at the signals that most often reveal a hacked WordPress site.
Google Blacklist
Checks Google Safe Browsing for "this site may be hacked" / "deceptive site" flags.
Malware & Injections
Scans the homepage for injected spam, obfuscated scripts, redirects and known malware signatures.
WordPress Hardening
Looks for exposed version, directory listings and exposed config backups attackers exploit.
SSL & Headers
Verifies HTTPS and key security headers that protect your visitors and login.
The scanner is a quick triage, not a replacement for a full audit. If it flags anything — or you suspect a hack it cannot see from the homepage — our team can run a complete file and database investigation.
How to Check if Your WordPress Site is Hacked
Follow these standard troubleshooting steps if you suspect your website has been compromised.
Run an External Malware Scan
Use our free tool above to scan your public files. It checks your homepage HTML, scripts, and server headers for obvious injections, redirects, or search engine blacklist warnings in under 30 seconds.
Inspect Google Search Console (GSC)
Log in to your GSC account and check the "Security Issues" tab under "Security & Manual Actions". If Google has detected malware, phishing, or spam queries, they will detail the infected URLs and issue a warning.
Check Your Google Search Results (SERPs)
Search for "site:yourdomain.com" in Google. Check if your main meta titles and descriptions look normal, or if you see injected keywords in foreign characters (known as the Japanese keyword hack) or pharma links.
Audit User Accounts and Core Files
Check your WordPress admin dashboard under "Users" for rogue administrator accounts. If you see unfamiliar profiles or notice file system changes in wp-config.php, your site requires deep forensic cleanup and backdoor removal.
Scanner FAQs
Can a free scanner really tell if my WordPress site is hacked?
A scan is a fast first look. It reliably catches the signs visible from outside your site — Google blacklist flags, injected spam and malware on the homepage, unwanted redirects, exposed config and backup files, an exposed .git or .env, leaked usernames, and missing HTTPS or security headers. It cannot see every backdoor hidden in your files or database, so a clean result is reassuring but not a guarantee. If anything is flagged, or you still have symptoms, a full file and database investigation is the next step.
Is it safe to run the scan on my site?
Yes. The scanner only makes a handful of normal, read-only web requests to public pages — the same kind your browser makes when you visit the site. It does not log in, change anything, or store your site’s content.
The scan says my site is clean but I still think it was hacked. What now?
Homepage scanning can miss malware that only triggers for search engines, logged-out visitors, or specific countries, as well as backdoors buried in files or the database. If you are seeing spam pages in Google, redirect complaints, or host warnings, contact us for a complete malware investigation that goes beyond what an external scan can reach.
What should I do if the scanner finds a problem?
For hardening warnings (exposed version, XML-RPC, missing headers) you can usually fix them yourself or with a security plugin. For confirmed infections — injected spam, known malware signatures, a Google blacklist flag, or exposed credentials — clean up promptly and close the entry point so it cannot return. Our UK team can do this for you, including the Google Search Console reconsideration request if you have been blacklisted.