Is your WordPress site hacked? Check in 30 seconds.

What this tool checks

Enter a URL and this tool fetches the site's public homepage — the same page a browser or search engine already loads — and checks it for common, publicly visible signs of a hack: a hidden redirect to another domain, a near-invisible iframe, obfuscated inline scripts, hidden spam text, and an executable .php file sitting in /wp-content/uploads/ (a common backdoor-shell location, checked only against paths the page itself already links to — never guessed). Where a Google Safe Browsing lookup is configured, it also checks whether Google itself currently lists the page as unsafe.

How to read the result

The verdict is plain-English, not a raw data dump: Clean means none of these signs were found. Flagged — action needed means at least one strong signal was found — something a legitimate site essentially never has a good reason for. Inconclusive means a weaker signal turned up that has a plausible innocent explanation but is still worth a manual look.

What this can't do

This only reads what's already publicly visible on the homepage — the same way a visitor's browser does. It can't see inside wp-admin, the database, or files that aren't linked from the page, so a clean result here is a genuinely good sign, not a guarantee. A backdoor that isn't doing anything visible yet won't show up in a public scan; if you were hacked once already, or a previous clean-up didn't fully stick, a proper look under the hood catches what a public check structurally can't.

If it comes back flagged

Treat it as urgent, not as something to get to later. A site that's actively hacked keeps losing search ranking, visitor trust and often real revenue for every day it stays live, and Google's own blacklist status doesn't clear itself once the underlying problem is fixed — it has to be requested. See WordPress Malware Removal for the full process, or read what to do when your WordPress site gets hacked for the complete step-by-step.