Is this hacked website checker free?

Yes. You confirm your email once with a 6-digit code, then you can scan any site as often as you like for 30 days. There is no paid tier and we do not send you marketing emails.

How do I know if my website has been hacked?

Common signs are spam pages in Google when you search site:yourdomain.com, results in Japanese or about casinos and pills, visitors being sent to other websites (often only on phones or only from Google), a red browser warning, a sudden drop in traffic, new admin users, and a warning from your host or Search Console. Our guide to the signs your website has been hacked covers each one.

Why does my site look fine to me but Google shows spam?

That is called cloaking. Hacked code checks who is asking: logged-in owners and normal visitors get the real page, while Googlebot gets spam links or pages. Some hacks also redirect only visitors who arrive from a Google search on a phone. This scan compares all three views for that reason.

What is the Japanese keyword hack?

It is an SEO spam attack that creates thousands of auto-generated pages in Japanese (often selling fake brand goods) on your domain and adds them to a sitemap so Google indexes them. You usually find it by searching site:yourdomain.com in Google. It needs a full cleanup, removal of the spam sitemaps and Search Console work to drop the pages.

Does this scan check Google’s blacklist?

Not automatically: Google Safe Browsing and the other lists require a key or forbid automated lookups by third parties. Instead the report gives you one-click links that open the official Google Safe Browsing status page, VirusTotal and Sucuri SiteCheck already filled in with your domain.

My scan is clean. Can my site still be hacked?

Yes. An outside scan cannot see backdoor files, hidden admin users or malware that only runs for some visitors. If you have other signs, have the server files and database checked, and keep software, plugins and passwords up to date.

Can you clean or rebuild my hacked website?

Yes. Our website security service handles cleanup, hardening and monitoring. Or we build you a new, secure website and app for free: you see it finished, and you pay $150 one-time only if you are happy with it.

Free tool

Is My Website Hacked? Free Quick Scan

Enter your website and in about 20 seconds we look for the signs hackers leave on small business sites: spam words and links you never added, Japanese or Chinese keyword-hack text, pages that show Google something different from your visitors, hidden redirects for people arriving from Google, fake “verify you are human” pop-ups, and scripts that load malware. You get a clear verdict, the exact code we found, one-click blacklist checks and the first steps to take if something is wrong.

Step 1: verify your email

We send a 6-digit code. Verify once and use every free tool for 30 days. We send no other emails.

What this scan checks

We load your page three times: as a normal visitor, as Googlebot (the robot that decides your rankings) and as a phone user who clicked your result in Google. Many hacks only show up in one of these, so comparing them catches spam and redirects that the owner never sees on their own computer.

Spam and SEO hacks: pharma, casino, slot (judi / gacor), adult and fake-goods words, Japanese or Chinese keyword-hack text, hidden links to other sites, and spam pages listed in your robots.txt or sitemap.
Cloaking and redirects: content or redirects that appear only for Google or only for visitors coming from search, and meta refresh tags that send people to another domain.
Injected code: fake CAPTCHA “ClickFix” pop-ups that ask visitors to paste a command, scripts that pull their payload from a blockchain (EtherHiding), eval(atob()) and document.write(unescape()) loaders, hidden iframes, code added after the closing </html> tag, and scripts from unknown domains.
Easy doors for attackers: an outdated WordPress core, an upload folder anyone can browse, and an invalid SSL certificate.

How to read the result

Red means we found a strong sign of a hack, such as spam only Google can see, a redirect to another website or a fake CAPTCHA script. Treat it as urgent: visitors may be getting infected and Google can put a red “Deceptive site ahead” warning on your site. Amber means something worth a closer look, for example a script from a domain we do not recognise. It may be fine (a chat widget, a booking tool) but you should know what every script on your site is.

Every finding shows the piece of code or text we saw, so you or your developer can search for it in your files. Below the checks you get one-click links to Google Safe Browsing, VirusTotal and Sucuri, plus ready-made Google searches that show spam pages Google has already indexed under your domain.

What a quick scan cannot see

This is an outside-in scan of one page, the way a visitor or Google sees it. Backdoors, malicious admin users, changed core files and database spam that is not printed on that page are invisible from the outside, and some malware only fires once per visitor, only on certain countries or only on real Googlebot IP addresses. A clean result is good news, not a guarantee.

If your site has been slow, sends emails you did not write, shows strange search results, or your host or Google Search Console has warned you, assume it is hacked and follow our hacked website recovery guide. For WordPress sites, outdated plugins are the most common way in, explained in our guide to WordPress plugin vulnerabilities.

If the scan finds something: the first hour

Do not delete files at random and do not restore an old backup straight away: the hole the attacker used is usually still open.

Change every password: hosting, FTP/SFTP, database, every admin user and the email linked to them. Remove admin users you do not recognise.
Take a full backup of the hacked site first, so nothing is lost and the infection can be studied.
Open Google Search Console → Security issues and Manual actions to see what Google has detected.
Ask your host for a malware scan of the files and the access logs for the last 30 days.
Clean or rebuild, update everything, then request a review in Search Console so warnings are removed.

Frequently asked questions

Is this hacked website checker free?: Yes. You confirm your email once with a 6-digit code, then you can scan any site as often as you like for 30 days. There is no paid tier and we do not send you marketing emails.
How do I know if my website has been hacked?: Common signs are spam pages in Google when you search site:yourdomain.com, results in Japanese or about casinos and pills, visitors being sent to other websites (often only on phones or only from Google), a red browser warning, a sudden drop in traffic, new admin users, and a warning from your host or Search Console. Our guide to the <a href="/guides/signs-your-website-has-been-hacked">signs your website has been hacked</a> covers each one.
Why does my site look fine to me but Google shows spam?: That is called cloaking. Hacked code checks who is asking: logged-in owners and normal visitors get the real page, while Googlebot gets spam links or pages. Some hacks also redirect only visitors who arrive from a Google search on a phone. This scan compares all three views for that reason.
What is the Japanese keyword hack?: It is an SEO spam attack that creates thousands of auto-generated pages in Japanese (often selling fake brand goods) on your domain and adds them to a sitemap so Google indexes them. You usually find it by searching site:yourdomain.com in Google. It needs a full cleanup, removal of the spam sitemaps and Search Console work to drop the pages.
Does this scan check Google’s blacklist?: Not automatically: Google Safe Browsing and the other lists require a key or forbid automated lookups by third parties. Instead the report gives you one-click links that open the official Google Safe Browsing status page, VirusTotal and Sucuri SiteCheck already filled in with your domain.
My scan is clean. Can my site still be hacked?: Yes. An outside scan cannot see backdoor files, hidden admin users or malware that only runs for some visitors. If you have other signs, have the server files and database checked, and keep software, plugins and passwords up to date.
Can you clean or rebuild my hacked website?: Yes. Our website security service handles cleanup, hardening and monitoring. Or we build you a new, secure website and app for free: you see it finished, and you pay $150 one-time only if you are happy with it.