Malware and phishing lists
Your address and its final address after redirects are checked against known malware and phishing lists.
Is my website hacked?
Enter your address and get a quick outside look at your site: is it on a malware list, and does it show signs of the hidden spam and injected code that hacked sites usually carry? It takes a few seconds and needs no account.
Run the free check
Free, no account needed. It opens in the ServerMonitor app.
What it checks
Injected scripts
Unknown or suspicious JavaScript added to your pages, including scripts that are created on the fly.
Hidden links and spam
Links hidden from visitors, and spam keywords such as pills, casinos and counterfeit goods.
Cloaking
Pages are requested the way a normal visitor, a mobile visitor, a search engine crawler and a visitor arriving from a search result would request them. If they receive different content, that is a classic sign of a hack.
WordPress details
If the site runs WordPress, the version and risky exposed files are noted.
How to read the result
- A clean result means nothing suspicious was visible from the outside. It is not a guarantee: malware that hides well, or sits only on the server, cannot be seen from a public check.
- A warning means something suspicious was found, with the page and the reason. Treat it as a reason to investigate, and check for false alarms such as a legitimate third-party script.
- A "likely compromised" verdict, for example a listing on a malware list, deserves immediate attention.
A check shows you today. Monitoring watches every day.
ServerMonitor runs checks like this one on a schedule, for uptime, certificates, domains and security, and alerts you by email, Telegram, Slack or webhook the moment something changes. Free for 3 sites.
Start freeQuestions
- Can this tool tell me for certain that my site is safe?
- No. It checks what any visitor or search engine can see. It cannot look inside your server, so a clean result lowers the risk without removing it. Regular monitoring is what keeps looking.
- Does it change or touch my website?
- No. It only requests public pages, the way a visitor would, and never sends anything to your site beyond ordinary page requests.
- What should I do if it finds something?
- Do not start deleting files at random. Make a backup, change your passwords, find the injected code, and close the way the attacker got in. Our guide walks through the steps in order.
- Is the tool really free?
- Yes, with no account and no card. There is a limit on how many checks one visitor can run per day, to keep the service fair.
- Can I check a site that is not mine?
- The tool only reads public information, but please check only sites you own or are allowed to check.
Related guides
· 3 min read
My website was hacked: what to do first
A calm, step-by-step checklist for the first hours after you find out your website was hacked: contain it, clean it, and stop it from happening again.
Read the article →· 2 min read
How to tell if your WordPress site has been hacked
The warning signs of a hacked WordPress site, where to look for proof, and the quick checks that catch an infection before your visitors or Google do.
Read the article →· 4 min read
The Japanese keyword hack and the pharma hack, explained
Two common WordPress attacks fill your site with spam pages that only search engines see. Learn how they work, how to spot them, and how to clean them up.
Read the article →· 3 min read
How to remove the "Deceptive site ahead" warning from your website
Chrome shows a red warning page on your site. Learn what it means, why it appears, and how to clean the site and ask Google to review it.
Read the article →Other free tools: SSL certificate checker, Domain expiry checker