Moatline

Check your website for malware

Is my website hacked? This free malware checker looks at your site the way visitors and Google see it: malware scripts, fake “verify you are human” pop-ups, spam and hidden redirects. It takes about 20 seconds and works best for WordPress.

Free · no sign-up · checks your home page from 3 points of view

Checking your site as a computer user, a phone user from Google and Google's robot… this takes up to 30 seconds.

How it works

What this check looks for

Malware scripts

Scripts loaded from servers used by this year's malware campaigns, including the ones that hide their instructions on a blockchain.

Fake CAPTCHA pop-ups

“Verify you are human” boxes that tell visitors to paste a command into Windows and infect their own computer.

Hidden redirects

Visitors from Google on a phone sent to scam or casino sites, while you see your normal site.

Spam shown to Google

Pharmacy, casino and gambling text served only to Google's robot, so the hack stays hidden from you.

Scrambled code

Deliberately obfuscated JavaScript and invisible frames, the usual fingerprints of injected code.

Plugins and PHP under attack

Plugins on our list of plugins being actively exploited right now, and PHP versions open to PHP2Shell or past their end of life.

Questions

About the check

How do I check my website for malware?
Enter your address above and click Check my site. In about 20 seconds you see what visitors on a computer, visitors on a phone coming from Google, and Google’s own robot get from your home page, and anything suspicious we find. For a full check of files and the database, install the free Moatline Malware Scanner plugin.
Is this check really free?
Yes. There is no sign-up and we don't store your address with your details. Results are kept for ten minutes so repeat checks are quick, then deleted.
Can an online check find all malware?
No. It sees only what the public sees: the pages, scripts and redirects your visitors and Google get. Backdoors, hidden admin accounts and malware in the database are invisible from outside. For those, install the free Moatline Malware Scanner plugin, which checks every file and the database from inside WordPress.
My site passed. Does that mean it's clean?
Not always. A lot of malware only shows itself to some visitors (for example people arriving from Google on a phone, once a day) or stays hidden until it's told to act. A clean result is a good sign, not a guarantee. A full scan from inside WordPress is the only reliable way to know.
Why does it check three times?
Hacked sites often behave differently for different visitors. We load your home page as a computer user, as a phone user arriving from Google, and as Google's search robot, then compare what each one gets.
My site was flagged. What now?
Don't panic and don't delete things at random. Follow our guide to removing malware from WordPress, install the free scanner to find the infected files, or have us clean it for you.