How to scan your website for malware
Website malware is rarely dramatic. It hides in a footer include, an obfuscated JavaScript payload, or a database row that only serves to search-engine crawlers. This guide walks through the practical steps to detect it, remove it, and keep it out — from a five-minute remote check to a full server-side audit.
Signs your site may be infected
Common indicators: unexpected redirects to unrelated domains, spam keywords appearing in Google search results for your site, browser warnings ("Deceptive site ahead", "This site may harm your computer"), sudden traffic drops, admin accounts you didn't create, unfamiliar files in wp-content/ or /public, and hosting provider notices about outbound spam. Any one of these warrants a scan.
Step 1 — Run a remote scan (no server access needed)
Start with a passive external scan. This fetches your public pages and checks them against known malware signatures and blacklists. Use Google Safe Browsing site-status, VirusTotal URL scan, and Sucuri SiteCheck. Also check your Google Search Console "Security issues" report — Google will flag hacked content there before most tools notice.
Step 2 — Compare against a clean baseline
If you have a recent backup or a git repo of your site's files, diff the current filesystem against it. Anything unexpected in image directories (.php files inside /uploads), obfuscated JavaScript (eval, base64_decode, long single-line strings), or newly-modified core CMS files is suspicious.
Step 3 — Server-side scan
For WordPress: Wordfence, Sucuri, and MalCare all offer server-side scanners that inspect every file. For generic PHP/Node/Python stacks: ClamAV plus maldet (Linux Malware Detect) catch known signatures. Run them from a shell, not a plugin, so a compromised admin can't hide the results.
# Install ClamAV + maldet, then scan
sudo apt install clamav clamav-daemon
sudo freshclam
sudo clamscan -r --infected /var/www/
# Or Linux Malware Detect
sudo maldet -a /var/www/Step 4 — Clean up and rotate
Remove or restore infected files from a known-clean backup. Rotate every credential the compromised server could touch: CMS admin, database, SSH keys, API tokens, and email/SMTP passwords. Force-logout all sessions. Update all software (CMS core, plugins, themes, OS packages). Assume anything the attacker could read is exposed.
Step 5 — Prevent reinfection
Most reinfections happen because the entry point wasn't closed. Enable auto-updates on your CMS. Put a WAF (Cloudflare, Sucuri) in front of the site. Enforce a strict Content-Security-Policy so injected scripts can't run. Turn on file-integrity monitoring so any unexpected change alerts you. And run a scheduled remote scan weekly — set it up once and forget it until it fires.
Request a Google review
If Google flagged your site, clean it, then request a review in Search Console under Security & Manual Actions → Security Issues. Reviews usually take a few days. Do not request one until you're confident every trace is gone — a failed review extends the warning period.
Frequently asked questions
Try it on your site
Run a free Website Auditor scan and see which of these controls you're missing.
Run a scan