Security

Is My Website Safe? How to Check for Malware and Vulnerabilities

Plenox Studio

AUGUST 10, 20267 min read

Two very different people ask this question.

One is about to enter card details on a site they’ve never heard of and wants to know whether it’s a scam. The other owns a website and has a nagging feeling something’s wrong — a strange redirect, a warning from Google, a customer mentioning an odd popup.

Both are covered below. If you’re checking a site you’re about to visit, start with the next section. If it’s your own site you’re worried about, skip ahead.

Part 1: Checking whether a site you’re visiting is safe

The fastest check: Google Safe Browsing Site Status

Google maintains a database of sites known to host malware or run phishing, and lets anyone check a URL against it directly. The Site Status tool checks a specific URL against Google’s threat lists — straightforward and effective for sites that have already been reported and flagged.^[1]

It’s hosted inside Google’s Transparency Report, and it’s designed exactly for this: you enter a URL, website, or domain, and get back the most recent Safe Browsing analysis for that page — without having to visit it.^[2]

The important limitation: it only knows about threats already catalogued. Because detection depends on sites being previously identified and added to Google’s lists, newly created scam pages can go undetected until enough reports accumulate.^[3] A clean result means “not currently flagged,” not “definitely safe.” Treat it as a floor, not a verdict.

Second opinion: VirusTotal

Where Safe Browsing gives you one authority’s answer, VirusTotal gives you dozens. It scans URLs, files, and domains against more than 70 antivirus engines and security services at once, producing a transparent multi-vendor view of how different security companies classify the URL.^[1]

Useful because vendors disagree. One flag among seventy might be a false positive; fifteen flags is a pattern.

Other checkers worth knowing

Norton Safe Web — a common starting point given how many people search for it by name; a reputation-based rating for a given site
Sucuri SiteCheck — scans the live page rather than just checking a database, so it can catch things not yet reported
URLVoid / ScamAdviser — aggregate reputation and domain-age signals, useful for judging a site nobody’s heard of

Run two, not one. Any single database has gaps.

Signals no tool will catch for you

Automated checks miss the most common scams, because a well-built fake shop isn’t technically infected with anything — it just never ships the goods. Check these yourself:

The domain is brand new. A store claiming years of business on a domain registered six weeks ago is the clearest red flag there is. Domain age is visible in a WHOIS lookup or through the reputation checkers above.

The URL is almost right. Character swaps and extra words in a familiar brand’s domain are the standard phishing setup. Read the domain carefully rather than glancing at it.

No real contact details. No address, no phone, a contact form only, and a generic free-mail address — legitimate businesses can be reached.

Prices that don’t make sense. Deep discounts on items that never get discounted are the oldest signal in the list.

Copied content and stock everything. Product descriptions lifted word-for-word from elsewhere, no real photos, no genuine reviews.

Odd payment methods. Wire transfer, crypto, or gift cards as the only options — these exist because they’re irreversible. A legitimate retailer takes cards.

Missing HTTPS. Necessary but not sufficient. Scam sites have padlocks too — the padlock only means the connection is encrypted, not that the recipient is honest.

Part 2: Checking whether your own site is compromised

Different problem entirely. Here you’re looking for something that’s already happened to a site you control.

Signs you may already have

Google Search Console has sent a security notification
Visitors see a red interstitial warning before reaching your site
Your site redirects somewhere unexpected, sometimes only on mobile or only from search results
Traffic dropped sharply with no other explanation
Pages appear in Google results that you never created — often in a different language, often pharmaceutical or gambling spam
Your host suspended the account
Unexpected admin accounts, or files with recent modification dates you can’t account for

The redirect-only-on-mobile pattern is worth knowing specifically, because it’s designed to hide from you: the attack checks the visitor’s device and referrer, so the site looks completely normal when the owner tests it directly on desktop.

How to check properly

1. Google Search Console. If you have it connected, the Security Issues report is the most authoritative signal available — it’s what Google actually saw. If you don’t have it connected, connect it now; this is the channel Google uses to tell you something’s wrong.

2. Run a remote scanner. Sucuri SiteCheck, Quttera, or similar tools scan the live page for injected code, malicious redirects, and blacklist status. Free scans catch a lot.

3. Check your Safe Browsing status. Same tool as Part 1, pointed at your own domain — this tells you whether Google is currently warning visitors away.

4. Look at the files themselves. Sort your site’s files by modification date. Anything changed at a time when nobody was working on the site deserves scrutiny. Compare against a known-good backup if you have one.

5. Audit user accounts. Unfamiliar admin users are a common persistence mechanism — attackers add a second door so removing the malware alone doesn’t lock them out.

6. Check the database, not just the files. Injected spam frequently lives in database content rather than in files, which is why a file-only scan can come back clean on an infected site.

An important gap in remote scanning

Remote scanners see what a visitor sees. They cannot see server-side files, backdoors that don’t affect page output, or malicious code that only triggers under specific conditions. A clean remote scan is genuinely good news but not proof of a clean site — which is why the file and database checks above still matter.

If you find something

Take a full backup before you touch anything, including the compromised state. You may need it for forensics, and a rushed cleanup that destroys evidence makes reinfection much harder to diagnose.

Change every password — hosting, CMS admin, database, FTP/SFTP, and any connected service. Reused credentials are how attackers come back a week later.

Remove the malicious code, ideally by restoring from a clean pre-infection backup rather than trying to surgically delete injected code. Manual removal often misses one file, which is enough for the whole thing to return.

Close the entry point. Cleanup without a cause is temporary. It’s almost always an outdated plugin or CMS version, a weak or reused password, or vulnerable custom code.

Update everything — CMS core, plugins, themes, dependencies.

Request a review in Search Console once you’re clean, to clear the warning shown to visitors.

Watch for reinfection for the next few weeks. Recurrence usually means a backdoor was left behind.

If your site handles customer payment data or personal information, treat a confirmed breach as more than a technical cleanup — there may be legal notification obligations depending on your jurisdiction, and that’s worth a conversation with a lawyer rather than a guess.

Preventing it in the first place

Keep everything updated. Outdated plugins are the single most common entry point on the most common platforms.
Delete what you don’t use. An inactive plugin is still installed code and still exploitable.
Use strong, unique passwords with two-factor authentication on every admin account.
Run off-site backups automatically. Backups stored on the same server they’re protecting are worth very little when that server is the problem.
Limit admin access to people who genuinely need it.
Monitor continuously rather than checking occasionally. Malware often runs for weeks before anything visibly breaks, and that gap is where the real damage happens — to rankings, to reputation, and to customers.

That last point is the one most sites get wrong. A scan today tells you about today. Sites get compromised on a Tuesday afternoon when nobody’s looking, and the difference between a minor incident and a serious one is usually how many days passed before anyone noticed.

The short version

Checking someone else’s site: run Google Safe Browsing Site Status plus VirusTotal, then judge the human signals — domain age, contact details, payment methods, prices
A clean database result means “not yet flagged,” not “safe” — new scam sites aren’t in the lists yet
Checking your own site: Search Console first, then a remote scanner, then files, users, and database
Remote scanners can’t see server-side backdoors — a clean scan isn’t proof
If compromised: back up first, change all passwords, restore clean rather than surgically deleting, then close the actual entry point
Prevention is updates, unique passwords with 2FA, off-site backups, and continuous monitoring rather than occasional checks

Sources

Want this monitored continuously rather than checked when something already feels wrong? That’s what our Security & Backups service covers.