You want a straight answer: is my website infected or not? So you paste the address into an online scanner, wait a few seconds, and get a green tick. Relief. Then a customer mentions a strange redirect again, and you are back where you started.
Free malware scanners are useful. They are also narrower than most people assume. This post explains the free ways to scan a website, what each one can actually see, and the kinds of infection that slip past all of them, so you can read a “clean” result for what it is.
Two kinds of scanner, two different views
Every scanning tool falls into one of two groups, and the difference explains most of the confusion.
Outside scanners visit your site over the internet, the way a browser does. They load your public pages and look at the code that comes back. They need no login and install nothing. But they only see what the server chooses to show them.
Inside scanners run on the server or within WordPress. They read the actual files and, in some cases, the database. They can find code that never appears on a public page. But they need access to install, and they are running on the very system that may be compromised.
A thorough check uses both. Neither is complete by itself.
Free outside checks
Sucuri SiteCheck
Enter your address and it fetches your pages, looking for known malicious scripts, spam links, suspicious redirects and whether the site appears on several blocklists. It is quick and needs nothing from you. It reads only the pages it can reach without logging in, so it cannot see files on the server that are never linked from anywhere.
Google’s Safe Browsing site status
Google’s Transparency Report has a page where you can enter a web address and see whether Safe Browsing currently considers it unsafe. It is the system behind the full-page alerts explained in our guide to Google’s “Deceptive site ahead” alert. A clear result means Google is not warning visitors right now, which is a narrower thing than being free of malware.
VirusTotal
VirusTotal lets you submit a URL and shows how a range of security vendors classify it. It is a good way to find out whether antivirus products are blocking your site even when Google is not. A single vendor flagging you deserves a look; a long list of them usually means something real.
Google Search Console
If your site is verified in Search Console, the Security Issues report shows anything Google has detected, with example URLs. The URL Inspection tool lets you see a page the way Google fetched it, which is one of the few free ways to catch spam that is shown only to search engines.
Your own eyes
Two quick manual checks catch things automated tools miss. Search Google for “site:” followed by your domain and scan the titles for pages you never created. Then open your homepage in a private window on a phone, using mobile data, and see whether anything unusual happens.
Free inside checks
Security plugins
Several well-known WordPress security plugins include a free scanner. Wordfence, for example, compares your core, theme and plugin files with the versions published on WordPress.org and flags differences, and also checks files against known malware patterns. Other security plugins offer similar scans. Install one, run a full scan, and read the results carefully rather than clicking “delete all”.
Your hosting panel
Some hosts include a malware scanner in the control panel or run scans on their side and report what they find. Look for a security or malware section in your panel, or ask support whether they have scanned your account recently and what came up.
Checksum verification
If you or a developer can use WP-CLI on the server, the command wp core verify-checksums compares every WordPress core file with the official version and lists any that differ or should not be there. WP-CLI has a matching check for plugins that came from the official directory. We explain how to read the output in our guide to checking WordPress core file integrity.
A few manual looks
Through the file manager or SFTP, sort folders by modified date and look for files changed on days when nobody was working on the site. Check the uploads folder for anything ending in .php, since that folder is meant for images and documents rather than code. In the dashboard, review the list of administrators.
What each method sees and misses
| Method | Good at finding | Usually misses |
|---|---|---|
| Outside scanner | Malicious scripts on public pages, visible spam links, blocklist status | Files on the server, backdoors, anything shown only to certain visitors |
| Safe Browsing / VirusTotal | Whether browsers or security vendors are warning people | Infections they have not detected yet |
| Search Console | Spam shown to Google, hacked content Google has spotted | Anything Google has not crawled or flagged |
| Security plugin scan | Changed core and plugin files, known malware patterns | New or custom code, some database injections, premium plugins it cannot compare |
| Checksum verification | Any change to official WordPress files | Themes, premium plugins, uploads and the database |
What scanners commonly miss
This is the part that matters most if you have had a clean result but still suspect something is wrong.
Code that picks its audience
Plenty of malicious code checks who is visiting before it acts. It may target only phones, only visitors coming from a search engine, or only people who are not logged in. An outside scanner that does not match the target profile gets your normal site back and reports nothing.
Malware nobody has catalogued
Pattern-based scanners recognise code they have seen before. A fresh variant, or something written for one particular site, may not match any pattern yet. Scrambled or encoded code makes this harder still.
A single changed line in a legitimate file
Adding one line to a genuine theme file is enough to load malware on every page. If the theme was bought rather than downloaded from WordPress.org, a scanner has no official copy to compare it with, so the change can go unnoticed.
Problems in the database
Scripts injected into posts, widgets or the options table are invisible to file scans. Some plugins check parts of the database, but rarely all of it. If you think this is where your problem is, our hacked database cleanup page explains what a thorough check covers.
Access, rather than code
A rogue administrator account, a changed admin email address or a new Search Console owner is not malware in the file sense, so many scanners do not mention it. Yet any of these lets the attacker return whenever they like.
Backdoors in disguise
Small files that let an attacker run commands are often named to look harmless, stored in the uploads folder, or tucked inside a plugin you rarely think about. Some are only a few lines long. These are the files that make an infection return after it seemed to be gone.
Things outside WordPress
Other sites on the same hosting account, server cron jobs, and files stored above the public web folder sit outside what a WordPress plugin normally scans.
A scanner running on a hacked site
An inside scanner works within the system it is checking. Some infections disable security plugins, change their settings or hide from them. A scan run on a compromised site is still worth doing, but it is not a neutral witness.
False alarms happen too
Scanners also flag things that are harmless: a caching plugin that writes PHP files, a theme that uses encoded code for licensing, a file left over from an old update. Do not delete files just because a scanner listed them. Look at what each one is, where it sits and when it changed. If you are not sure, keep a copy before removing anything.
Keep a record of every scan
Whatever tools you use, write down the date, the tool and what it reported, and save a screenshot of the result. A scan on its own is a snapshot. A series of them shows change over time, which is far more telling. If a file appears in one week’s results that was not there the week before, you have a rough date for when something got in, and that date is often the best clue to how.
A sensible free routine
If you want to check a site yourself without paying for anything, this order works well:
- Check Search Console’s Security Issues report and Google’s Safe Browsing status.
- Run an outside scan and a VirusTotal URL check.
- Test the site in a private window on a phone using mobile data, arriving from a Google search.
- Install one reputable security plugin and run a full scan.
- If you can, verify WordPress core checksums.
- Review administrator accounts and look in the uploads folder for PHP files.
If everything comes back clean and no one has reported anything odd, the site is probably fine. If any step shows a problem, or people keep reporting symptoms despite clean scans, assume something is hidden. Our website security best practices guide covers how to keep a clean site that way, and our page on getting help with a hacked website explains the options if it is not clean.
If scans keep saying “clean” while the problems keep coming back, a hidden access point is the usual explanation. Our service for removing WordPress backdoors is aimed at that situation, where the visible malware has gone but something keeps letting it back in.
Next in this series: Unknown Admin User in WordPress: What It Means
