Is my website hacked? How can I check for free?

Enter your domain in the scanner above. It passively checks your homepage for spam keyword injections, malicious redirect chains, hidden iframes, obfuscated script payloads, missing security hardening and reachability problems — the most common visible signs of a hacked website.

What can't a passive scan see?

Backdoors in files that aren't linked from your homepage, database infections, malicious cron jobs and rogue admin accounts are only visible with server access. A clean passive scan is a good sign, not a guarantee.

Free scanner

Is my site hacked?

A passive check of the most common visible hack signs — spam injections, rogue redirects, hidden payloads. Free, instant, no signup.

Passive only — we request your homepage once, like a browser would. Nothing intrusive. Leave an email and we'll send your report and what to watch for.

What we check

Eight signals, straight from your live homepage.

SEO spam

Pharma/casino keyword injections in your HTML.

Rogue redirects

Homepage silently sending visitors off-domain.

Hidden payloads

Hidden iframes, obfuscated eval chains, base64 script blobs.

Reachability

DNS, HTTPS and server errors that often accompany a hack.

Blocklist status

Google Safe Browsing flag check.

Hardening

Missing security headers — the tell of an unwatched site.

Software disclosure

Whether your site announces exploitable version info.

Response anomalies

Redirect chains and error codes that don't belong.