Passive scan · no exploit code
Website security check: is my website hacked?
Enter a website to scan what its visitors see for signs of a hack, blocklists, the PHP2Shell bug and missing security headers. Nothing is sent but ordinary page requests.
Website scanner_
This website security check is a free website scanner for the question most owners actually have: is my website hacked, and is it exposed to the bug everyone is talking about this week? It loads the homepage the way a visitor does, and again the way a visitor from Google arrives, then looks for the marks that hacks leave in a page: spam keywords, hidden links, injected or obfuscated scripts, hidden frames, crypto miners, fake "verify you are human" boxes and redirects to other domains. It asks two public resolvers that block malicious domains, reads the PHP version when the site shows it, and lists the security headers that are missing.
It works as a website malware scanner from the outside only. It never sends attack code and never looks for hidden files, so it is safe to run on any site, including one you do not own.
PHP2Shell: check this first if your site runs PHP
On 21 October 2026 PHP released fixes for two critical bugs, CVE-2026-109618 and CVE-2026-109619, called PHP2Shell, that can let anyone run code on a server without logging in. Every PHP version from 5.4 up is affected until it is updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and exploitation attempts were seen before the fix came out. The check above leads with a PHP2Shell verdict whenever it can see PHP. For the full explainer, patched versions and how to update on cPanel, hPanel, Plesk or a VPS, use the PHP2Shell checker.
How does this website security check work?
Our server requests four things, and only those: the homepage (following each redirect itself, at most 8), the homepage again with Referer: https://www.google.com/, /robots.txt and /.well-known/security.txt. It also asks Quad9 (9.9.9.9) and Cloudflare's malware-blocking resolver (1.1.1.2) for the domain. The page's HTML, up to 256 KB, comes back to your browser, which parses it into an inert copy (DOMParser) where no script runs and nothing loads, and runs every pattern check there.
A worked example. We ran the check on our own homepage, isitupordown.com, on 25 October 2026. The homepage answered HTTP 200 over HTTPS in one hop with 170,908 bytes of HTML. The version for a visitor from Google was the same page (size ratio 1.0, no extra scripts), Quad9 and Cloudflare's malware resolver both resolved the domain normally, and there was no PHP header, PHP cookie or .php link, so the PHP2Shell row said "No sign of PHP". The verdict was "No signs found in what a visitor can see", with the missing security headers and security.txt listed as optional improvements.
For comparison, twitter.com redirects to x.com. The check follows both hops and flags "Redirects to another domain" as a warning to look at, not as a hack, because a move to a new brand name is normal. Whether it is normal for your site, only you can say.
How to run a website security check, step by step
1Enter the website
Type a domain such as example.com, or paste any address on the site. We always check its homepage.
2We load the homepage like a visitor
Our server opens the homepage over HTTPS, follows each redirect one hop at a time, then loads it again the way a visitor from a Google result arrives, and reads robots.txt and security.txt.
3We ask two blocklist resolvers
Quad9 and Cloudflare's malware-blocking resolver both refuse domains their threat feeds list as malicious. We compare their answers with a normal resolver.
4Your browser scans the page
The page is scanned on your device for spam, hidden links, injected scripts, hidden frames and fake verification pages, using an inert copy where nothing runs or loads.
5Read the verdict and what to do
Each check has a plain verdict, why it matters and what to do. Copy the link to share the result with whoever runs the site.
How do I know if my website has been hacked?
Hacks are built to stay hidden from the owner and visible to search engines or to visitors from somewhere else. That is why the owner is usually the last to know. Signs to look for:
- Your Google results show titles in Japanese, or about slots, pills or loans, that you never wrote.
- Visitors say they ended up on another site after clicking your link in Google, while typing your address works fine.
- Chrome or Firefox shows a red warning page, or Google Search Console reports a "Security issue".
- New admin users, unknown plugins, or files with odd names in your hosting account.
- Your host suspends the site or warns about malware or spam sent from your account.
The check above covers the first two from the outside. For the rest you need your CMS admin, Search Console and your hosting panel.
Common website hacks this scanner looks for
SEO spam (pharma, slots, loans)
Words like "slot gacor", "togel", "viagra" or "payday loans" in text that has nothing to do with the page, often inside a hidden block. Indonesian slot spam is one of the most widespread hacks right now.
Japanese keyword hack
Pages full of auto-generated Japanese text selling fake brand goods, on a site that is not in Japanese. Often added with new sitemaps and a new owner in Search Console.
Hidden link blocks
A block hidden with display:none or pushed off screen, holding links to other sites. Visitors never see it; search engines do.
Conditional redirects
Code that sends only visitors from Google (or only phones) to a scam or betting site, so the owner, who types the address, never sees it.
Injected scripts
eval() of decoded text, long String.fromCharCode chains, scripts after the closing html tag, and scripts from domains like polyfill.io that were used to attack visitors.
Fake verification and update pages
A fake "verify you are human" box that asks visitors to press Windows + R and paste a command (ClickFix), or a fake "update your browser" message with a download.
Hidden frames and miners
Zero-size iframes loading another site, and in-browser crypto miners such as the old CoinHive script.
Blocklisted domain
Quad9 or Cloudflare's malware resolver refusing the domain, which means a threat feed lists it for malware or phishing.
How to check a website for malware
To scan a website for malware from the outside, a scanner has to look at what the site serves. Our check reads the homepage's scripts: where each one loads from, whether inline code decodes and runs hidden text (eval(atob(...)), String.fromCharCode chains, unescape), whether a script writes another script into the page, and whether known bad sources appear, such as polyfill.io and the four domains Censys tied to the same operator in the 2024 supply chain attack, or crypto mining services. Scripts from unusual domains (a rarely used extension, a bare IP address, a long random name) are listed for you to confirm.
What no website virus checker can see from outside is the server itself: a backdoor file that is never linked, a hacked admin account, or a database change that only shows on one post. If the check finds signs of a hack, assume there is more on the server and follow the steps below.
Check website blacklist status
We resolve the domain through two free public resolvers that block malicious domains. Quad9 answers NXDOMAIN (no such domain) for names on its threat feeds; we tell that apart from a name that really does not exist by Quad9's own flags, which we checked with its test name isitblocked.org on 25 October 2026. Cloudflare's 1.1.1.2 (security.cloudflare-dns.com) answers 0.0.0.0 for malware domains, which we checked with Cloudflare's test name malware.testcategory.com. If either blocks the domain, people using that resolver, or a router or company network set up with it, cannot open the site.
Google Safe Browsing, the list behind the red warning pages in Chrome, Firefox and Safari, and VirusTotal, which asks dozens of security vendors, both need an API key and limit their free versions to non-commercial use, so the result links straight to their pages for the domain instead.
Is this website safe to visit?
If you are about to visit a site rather than fix your own, the check above answers part of it: blocklists, signs of a hack, and where the address really ends up. It cannot tell you whether a shop is honest or whether a login page is fake. For that, check how old the domain is with the domain expiry checker (scam sites are often only weeks old), and for a link from a QR code use the QR code checker, which shows every redirect before you open it.
Security headers explained
| Header | What it does | A safe starting value |
|---|---|---|
| Strict-Transport-Security | Browsers use HTTPS only, even if someone types http | max-age=31536000 |
| Content-Security-Policy | Limits where scripts, frames and styles may load from, which blunts injected scripts | Start with Content-Security-Policy-Report-Only |
| X-Frame-Options or frame-ancestors | Stops other sites showing yours in a frame (clickjacking) | SAMEORIGIN |
| X-Content-Type-Options | Stops browsers guessing a file is a script | nosniff |
| Referrer-Policy | How much of your addresses other sites see | strict-origin-when-cross-origin |
| Permissions-Policy | Switches off camera, microphone and location for the page and its scripts | camera=(), microphone=(), geolocation=() |
| security.txt | Tells researchers where to report a problem (RFC 9116) | A Contact: and an Expires: line |
Missing headers are listed as improvements, not as problems: plenty of well run sites lack some of them, and a header never fixes a hacked site.
What to do if your website is hacked
- Do not delete everything in a panic. Take a full backup of the hacked site first (files and database), so you can see later how it happened.
- Change every password: hosting, FTP or SSH, database, CMS admins and email. Turn on two-factor login.
- Update the CMS, plugins, themes and PHP, and remove plugins you do not use. Outdated plugins are how most sites get in. If PHP is older than the PHP2Shell fix, update it now.
- Clean or restore. Restore a backup from before the hack, or have your host or a cleanup service scan the server. Remove admin users you did not create.
- Ask for review. In Google Search Console, fix the issues under Security and request a review. Run the check above again to see that the signs are gone.
How accurate is this website security check?
Each strong sign we flag is something legitimate sites rarely do, but none is proof on its own: a site about casinos uses casino words, and some old widgets pack their code. That is why every result says what we saw and lets you judge. The other way round, a clean result misses everything that is not in the homepage: other pages, server files, the admin area, the database, and hacks that only show for logged-in users, certain countries, phones or search engine crawlers (we never pretend to be Googlebot). We read the first 256 KB of the page, and a site that blocks automated visitors cannot be scanned at all. Results are cached for 5 minutes.
Why we built this website security check
People come to Is It Up or Down when a site behaves strangely, and a hacked site often looks like a broken one: it redirects, shows odd pages, or gets blocked. The free scanners we tried mostly answer with a list of headers, or with a "clean" badge that sounds like a guarantee nobody can give from outside. PHP2Shell made it urgent: millions of sites run PHP, and their owners needed a quick way to see whether theirs shows an old version.
Nitin Raja, who builds Is It Up or Down, puts it this way: "After testing out a lot of websites, I found what is needed by people and what is not, and built around this." For this tool that meant a plain verdict first, the reason and the fix under each finding, and a clear statement of what we cannot see.
What this website scanner measures
- Reachability and HTTPS: the homepage over HTTPS with each redirect followed by our server (at most 8, 7 seconds each), plain http only if HTTPS fails, the final domain, and HSTS.
- Search visitor cloaking: a second load with
Referer: https://www.google.com/, compared on the final address, the page size and the scripts it loads. - Signs of a hack in the page: spam keyword groups (slots and gambling, pharmacy, loans, fake goods), Japanese text on a non-Japanese page, hidden blocks of outside links, hidden frames, eval of decoded text, long character code chains, document.write of scripts, code after the closing html tag, polyfill.io and related domains, crypto miners, ClickFix and fake browser update text, meta refresh and script redirects to other domains, and odd sitemaps in robots.txt.
- Software: Server and X-Powered-By headers, the PHPSESSID cookie, .php links, WordPress, Joomla, Drupal and other CMS markers, the WordPress version against wordpress.org's release list, and Cloudflare in front of the site.
- Blocklists: Quad9 and Cloudflare 1.1.1.2 for the domain you entered and the domain it ends on.
- Headers: Content-Security-Policy, X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and security.txt.
What it does not measure: other pages, server files, databases, admin accounts, plugins that do not show in the page, open ports, or anything that needs a login. It does not send attack code, test for vulnerabilities by trying them, or look for hidden paths like /.env, /.git or backup files: anyone can enter any domain, so we only do what a visitor does.
Why this website security check is different
The check is passive by design, and says so. Your browser does the page analysis, so the page is never shown or run. Every finding explains why it matters and what to do, the verdict never says "safe", and the share link repeats the check for whoever fixes the site.
| This check | Typical online scanners | |
|---|---|---|
| What it sends | Ordinary page requests only, with an honest name | Varies; some probe hidden paths |
| Search visitor redirects | Loads the page a second time as a visitor from Google | Often one load only |
| PHP2Shell | Version verdict, including distribution builds | Rarely covered yet |
| Blocklists | Quad9 and Cloudflare live, links to Safe Browsing and VirusTotal | Their own list or vendor feeds |
| Verdict | "No signs found in what a visitor can see", with the limits stated | Often a "clean" or "safe" badge |
| Account | None | Often needed for a full report |
Sources
- PHP security advisory, 21 October 2026 and CISA alert on PHP2Shell
- Quad9 FAQ: how blocked domains are answered and Cloudflare 1.1.1.1 for Families setup (1.1.1.2, test domains)
- Censys on the Polyfill.io supply chain attack and related domains
- Google Search Central: hacked sites and malware
- RFC 9116: security.txt and MDN: HTTP headers
- WordPress.org release list (version-check API)
Website security questions
How do I know if my website has been hacked?
The most common signs are visible to visitors and search engines before the owner notices: spam words or links in your pages (often hidden), visitors from Google being sent to another site, a browser or Google warning, Japanese or gambling pages in your search results, and new admin users you did not create. Run the check above for the first three, look at Google Search Console for security issues and pages you did not make, and check your CMS user list.
Is this website security check free?
Yes. There is no account and no limit beyond a fair-use limit of a few checks a minute per visitor. The link in the address bar repeats the check for the same site, so you can send it to your developer or host.
Can an online scanner find all malware on my website?
No. Any remote scanner, ours included, sees only what the site sends to a visitor. Backdoors in server files, malicious admin accounts, database changes and code that only runs for logged-in users or certain countries are invisible from outside. A server-side scan by your host, or a security plugin, is needed for those.
Will checking a site alert the owner or harm it?
No. We load the homepage twice, robots.txt and security.txt, the same files any visitor or search engine loads, and identify ourselves as "isitupordown.com site checker". We never send attack code and never look for hidden files, so the owner's logs show two ordinary page views.
What does "Signs of a hack found" mean?
We found at least one strong sign that someone other than the owner changed the site: hidden spam links or words, a decoding script that runs hidden code, a hidden frame to another site, a redirect that only fires for visitors from Google, a fake "verify you are human" page, or the domain on a malware blocklist. Each sign comes with what to do.
Why does the check say it could not read the page?
Some sites block automated visitors with a firewall or a "checking your browser" challenge. Then we can still check DNS blocklists and the headers, but not the page itself. That is a security setting, not a sign of a problem.
Does a clean result mean my site is safe?
No, and we never say that. It means nothing we can see from outside looks wrong. Keep your CMS, plugins, themes and PHP updated, use strong unique passwords with two-factor login, and keep backups. Those prevent most hacks.
How do I check if a website is safe to visit?
The check above shows whether the domain is on Quad9's or Cloudflare's malware blocklists and whether the page shows signs of a hack, and links to Google Safe Browsing and VirusTotal for a second opinion. For a site you have never heard of, also check how old the domain is with our domain expiry checker: scam sites are usually only weeks old.