Website Malware Scanning: How to Detect and Prevent Infections

Website malware rarely announces itself. Instead of defacing your home page, most infections stay quiet: sending spam from your server, redirecting some visitors to scam pages, injecting hidden links for search spam, or giving the attacker a backdoor to return later. The longer it goes unnoticed, the more damage it does to your reputation, your search visibility and your visitors.

Warning signs

• Browsers or search engines display a "deceptive site" or "this site may be hacked" warning.
• Visitors, but not you, are redirected to unrelated pages, often only from mobile or from search results.
• Search results show strange titles or pages in other languages for your domain.
• Unknown administrator accounts, new plugins or changed files appear.
• The site suddenly becomes slow, or your host reports unusual CPU use or outgoing mail volume.
• Your emails start bouncing or landing in spam, because the server is sending junk.
• Unfamiliar scripts, iframes or links appear in the page source.

Types of scanner

Scanner type	What it does	Limits
Remote scanner	Fetches your public pages and looks for known malicious code, blocklist status and suspicious redirects	Cannot see files that are not served to it, such as backdoors in the file system
Server-side scanner	Reads your actual files and compares them with known malware signatures	Misses brand new or obfuscated code
File integrity monitoring	Compares files with a known clean baseline or official copies	Flags legitimate changes too; needs a clean baseline
Plugin-based scanner	Runs inside WordPress, checking core, plugin and theme files against originals	Runs on the same server that may be compromised

No scanner finds everything. Use more than one approach, and treat a clean result as encouraging, not as proof.

Manual checks that find real problems

1. Compare core files. For WordPress, download a fresh copy of the same version and compare it with the files on your server. Anything different in core folders deserves explanation.
2. Look at recently modified files. Files changed on dates you did not update anything are suspicious.
3. Search for PHP in places it should not be, especially upload folders. Uploaded images should never be executable PHP scripts.
4. Review users for unknown administrators.
5. Check scheduled tasks in the CMS and the server, since attackers use cron jobs to reinstall malware after you remove it.
6. Inspect the database for injected content in posts, options and widget text.
7. View the page source as a visitor from a different device and browser, and search for unknown scripts or iframes.
8. Check Google Search Console for security issues and manual actions messages.

Prevention matters more than detection

Most infections of small sites come through a short list of causes. Fixing them prevents the majority of cases:

• Outdated software: vulnerable plugins, themes and CMS versions are the most common entry point. See our article on keeping software updated.
• Stolen or weak passwords for the CMS, hosting panel, SFTP or database.
• Nulled and pirated themes and plugins, which often ship with backdoors. Only install software from official or reputable vendor sources.
• Over-broad file permissions that let a compromised script write anywhere.
• Abandoned installs: old test sites and forgotten staging copies sitting on the same account, unpatched. Delete what you do not use.
• Infected computers used to manage the site, which leak saved passwords.

Set up regular scanning

1. Schedule a server-side or plugin scan weekly, or daily on busy shops.
2. Enable change notifications for core files and new admin users.
3. Monitor blocklist status and Search Console alerts.
4. Keep off-site backups from before any infection, so you have a clean restore point.
5. Use a web application firewall (see the WordPress hosting options) to block known exploit attempts before they reach the site.

If a scan finds something

Do not just delete the file the scanner flagged. Malware usually comes with a backdoor and a reason it got in. Take a backup of the current state for investigation, restore from a known clean backup if you have one, update everything, change all passwords and keys, and find out how the attacker entered. Our incident response article explains the steps in order.

What a blocklist warning means

Search engines and browsers maintain lists of sites known to host malware or phishing. If your domain lands on one, visitors see a full-page warning before your site loads, and traffic can collapse overnight. Check Google Search Console's Security issues report, which explains what was detected and lets you request a review once the site is clean. Review requests are only worth making after you have removed the infection and closed the hole, because a reinfected site that fails review again costs more time.

Do not forget email and DNS

A compromise is not always limited to files. Attackers who reach your hosting account can create mail accounts, send spam from the server or change DNS records for the domain. After any infection, check the list of email accounts and forwarding rules, the DNS records at your registrar or provider, and the outgoing mail queue. Look for unexpected TXT records, new subdomains pointing at unfamiliar addresses, and mailbox rules that forward messages to outside addresses.

Keep a clean reference copy

For custom sites, store your code in version control such as Git, and deploy from it. A deploy from a known-good repository replaces any tampered files, and a diff against the server shows exactly what changed. For WordPress, keep a note of installed plugin and theme versions so that a scanner's report of modified files can be checked against what you expect.

A clean, up-to-date platform

Zebra Hosting Cloud runs Plesk on every plan, which includes tools for managing files, backups and PHP versions. For an overview of the measures that keep a site safe, see the security page.