Is my WordPress site hacked?
A free check from the outside, in about 20 seconds. We look at your site the way a visitor, a phone user coming from Google, and Google’s crawler see it. No access or password needed.
Free. The result has its own link and is deleted after 90 days.
What the check looks at
- Redirects to other sites
- Including the ones that only fire for phone visitors arriving from Google.
- Content shown only to Google
- Cloaked spam pages that visitors never see, but Google indexes.
- Spam on the page
- Pharmacy, gambling and fake-goods spam, the Japanese keyword hack and hidden links.
- Injected scripts
- Obfuscated code, scripts from bare IP addresses, hidden frames and known WordPress malware.
- Google and blocklists
- Google Safe Browsing and security blocklists, where available.
- WordPress, plugins and theme
- Versions we can see from outside, compared with the latest releases.
- Weak spots
- Public user names, XML-RPC, browsable upload folders and a public error log.
- HTTPS certificate
- Whether it’s valid, and how many days are left before it expires.
What it can’t see
Files on the server, the database, admin accounts, and pages other than the one you enter. Many hacks hide there, and some only show to Google’s real servers. A clean result is good news, not proof.
If your host, Google or your visitors say something is wrong, trust that over this check.
Start a cleanup, $199