Arsal • Location • Starter

Free No signup
Weekly Signature updates
Read-only Nothing on your site is changed
HostCry Icon

How it works

What this scanner checks

This is a free, read-only check of your website's public pages. We look for signs of compromise attackers often leave behind: PHP backdoors, web shells, exposed .env or database backups, and risky external scripts.

We also check blacklist reputation, detect WordPress and server software from the page, and review HTTPS and security headers.

Results are cached for 24 hours. Each run checks malware patterns, reputation, software, and security headers.

Website Security Scan
HostCry Icon

What this free scan includes

A public-page check, not a full server antivirus

Malware patterns

We look at public HTML for PHP backdoors, web shells, obfuscated scripts, crypto miners, and hidden SEO spam. We do not scan files behind a login.

Reputation

We ask Google Safe Browsing, PhishTank, and VirusTotal whether this URL is already flagged. If an API is busy, that source shows Unavailable — not Clean.

Software

We detect the public stack, including WordPress when it is visible, and note outdated components when version data is available.

HTTPS and headers

We check that the site uses HTTPS and whether common security headers are present. This is not a penetration test.

Weekly signatures

HostCry refreshes the public-page rule pack from its own list plus maintained Neo23x0 and Tenable YARA sources.

Shareable report

Each scan gets a link you can send. If something looks infected, contact HostCry for cleanup. If it looks clean, hosting is the next step.

HostCry Icon

What We Check For

Comprehensive Security Scanning

Malware & Viruses

  • PHP backdoors and known web shells
  • Obfuscated JavaScript on public pages
  • Crypto-miner script names
  • Hidden SEO spam
  • Exposed .env, backups, and common shell filenames

Blacklist Status

  • Google Safe Browsing
  • PhishTank database
  • VirusTotal (70+ engines)
  • WordPress.org version checks
  • WPScan CVE data (optional API key)

Outdated Software

  • WordPress core version, when it is public
  • Visible plugin and theme names
  • Outdated component notes when version data exists

Security Issues

  • HTTPS on the scanned URL
  • HSTS, CSP, and X-Frame-Options
  • Cookie Secure and HttpOnly flags, when a cookie is set
  • Server version banners in response headers

Threat Intelligence

  • Real-time threat reputation analysis
  • Domain reputation scoring
  • IP geolocation risk assessment
  • Suspicious URL pattern detection
  • Homograph attack detection
  • DGA pattern recognition

Advanced Analysis

  • Machine learning threat detection
  • Behavioral pattern analysis
  • Advanced obfuscation detection
  • Comprehensive WordPress analysis
  • Plugin vulnerability database
  • 24-hour intelligent caching

50,000+

Websites Scanned

15,000+

Threats Detected

99.9%

Accuracy Rate

< 30s

Scan Time

HostCry Icon

Why use this checker

Honest limits, useful next steps

Usually under a minute

A scan checks public pages, reputation, software, and headers. The first run of a new site can take most of that minute. Repeat checks use a 24-hour cache unless you scan again.

Three reputation sources

Google Safe Browsing, PhishTank, and VirusTotal. If a source cannot be reached, it shows Unavailable instead of Clean.

Advanced Threat Detection

Pattern-based scanning of your public pages finds backdoors, shells, and exposed sensitive files—the same issues hosting support teams look for first.

Public pages only

We read pages a visitor can open, plus common exposed paths such as .env and backup files. Password-protected files and the rest of the server stay unseen.

Detailed Security Reports

Get comprehensive reports with actionable recommendations, threat severity levels, and step-by-step remediation guides to secure your website effectively.

Privacy & Security

Your website data is never stored or shared. Our scanning process is completely secure and respects your privacy while providing thorough security analysis.

After the scan

If the report shows malware, we can help clean it. If it looks clean, HostCry hosting is there when you want a place to run the site.

Cleanup help for an infected public site
Hosting if the scan comes back clear
A shareable report link for that domain
Start free scan

HostCry

Public-page malware checker

3 Reputation sources
Weekly Rule updates
Read-only Your site is not changed
HostCry Icon

Updated malware detection engine

Free website malware scanner with weekly signature updates

HostCry’s free website malware scanner helps site owners worldwide check whether a domain is compromised, blacklisted, or exposing risky files — without installing plugins or giving us FTP access. Enter any public URL and run a full malware scan covering malware patterns, reputation, software, and security headers.

The detection engine is built for real-world threats: PHP backdoors, web shells, obfuscated JavaScript, crypto-miner scripts, SEO spam injects, and accidentally public files such as .env, database dumps, and WordPress config backups.

Weekly-updated malware patterns from open-source intelligence

Malware signatures go stale quickly. HostCry refreshes detection patterns at least once a week by merging:

  • HostCry’s curated rules tuned for remote / public-page scanning
  • Actively maintained PHP webshell rules from Neo23x0 signature-base (gen_webshells.yar)
  • Obfuscated PHP patterns from Tenable YARA rules

Rules are stored on our servers and applied during each scan — not loaded from a public CDN — so your online virus checker stays current without slowing the page down.

What our website security scanner checks today

  • Malware & webshell indicators on public HTML/PHP responses
  • Exposed sensitive paths (.env, .git, SQL dumps, common shell filenames)
  • Blacklist / reputation via Google Safe Browsing, PhishTank, and VirusTotal
  • WordPress & software fingerprinting, with outdated component and CVE signals when available
  • HTTPS & security headers for a basic configuration review
  • Sitemap-assisted crawl of extra public pages for injected code

Faster scans, clearer results, fewer false alarms

Recent upgrades focus on usefulness for site owners who need a quick website malware check:

  • Parallel path probing with a hard time budget so scans finish instead of hanging
  • Duplicate findings across many pages collapsed into one clear report row
  • Noisy heuristics (such as over-broad “hidden iframe” matches) removed to cut false positives
  • Progress UI that stops cleanly when the scan reaches 100%

Website malware scanner for businesses & WordPress sites

If you run a blog, online store, SaaS app, or company site on shared or WordPress hosting, a regular free malware scan helps catch compromise early — especially after plugin updates, migrations, or suspicious traffic. HostCry offers this website security checker at no cost so you can verify safety before visitors notice a problem.

Important: this tool inspects publicly reachable URLs only. It cannot see password-protected files or the full server filesystem. For deep cleanups, combine this scan with your hosting panel malware tools (for example Imunify / Maldet) or professional malware removal.

How to use this free malware detection tool

  1. Enter your domain or full URL in the scanner above.
  2. Run the scan to check malware patterns, reputation, software, and security headers.
  3. Review findings, then fix exposed files, update outdated software, and use Scan again after cleanup.

Looking for a reliable website malware scanner online before you buy hosting or after a hack? Start with HostCry’s free checker, then harden the site with SSL, backups, and timely updates.

hostcry-logo

The best out there

See Why People love us!

#

The best out there

FAQ

A website malware scanner is a security tool that analyzes your website for malicious code, viruses, and security vulnerabilities. It helps detect threats that could harm your visitors or damage your reputation.

We scan the public HTML of your site for known PHP backdoor patterns, web shells, obfuscated JavaScript, crypto-miner scripts, SEO spam injects, and common exposed files such as .env or database backups. Detection patterns are updated at least weekly from HostCry’s curated pack plus maintained open-source YARA sources (Neo23x0 signature-base and Tenable). It does not scan every file on your server.

We check your URL against Google Safe Browsing, PhishTank, and VirusTotal (many antivirus engines in one lookup). Unavailable means we could not reach that API right now. WordPress sites also get outdated-plugin checks and CVE data when WPScan is configured.

Outdated software and plugins often contain security vulnerabilities that hackers can exploit. Our scanner identifies outdated components and recommends updates to maintain security.

We recommend scanning your website at least weekly, or immediately after making changes, installing new plugins, or if you suspect any security issues. Regular scanning helps catch threats early.

If malware is detected, immediately isolate the infected files, remove the malicious code, update all software, change passwords, and consider professional malware removal services if needed.

Yes, our scanner is completely safe. It only reads and analyzes your website content without making any changes or modifications to your files or database.

We check whether your site uses HTTPS, whether security headers are present, and common cookie settings. This is a basic configuration review, not a full penetration test.

Yes. This free website malware checker also works as an online virus checker for public pages. It looks for malicious scripts, webshells, and reputation signals — it is not an antivirus install for your PC.

It can flag common WordPress homepage injects, spam SEO hacks, and known public-file patterns. For a full WordPress file-system clean, also scan inside cPanel/Imunify or contact HostCry support.

Run this malware scanner, remove the infected files/plugins, update WordPress/core themes, rotate passwords, then request a review in Google Search Console. Our blacklist check includes Google Safe Browsing when the API is available.

No. Only pages and files reachable without a login are tested. Use your hosting control panel or Imunify/Maldet for full-server scans.

Explore more free utilities

Need more diagnostics for your website?

Run speed, SEO, malware, SSL, DNS, and IP checks from one place.

View all tools