Online website virus check: international services and protection against hacking

Infection of a website with malicious code and the appearance of hidden technical errors are two major threats to the stable operation of a web resource. Unlike PC viruses, web threats operate stealthily: they may show no signs of presence to the administrator, but activate exclusively when users arrive from search engines (cloaking, hidden redirects) or inject malicious scripts to steal data.

Simultaneously, internal and external technical issues (broken links, cyclical redirects, non-working external scripts) undermine SEO metrics and degrade user experience.

In this detailed guide, we will analyze current international services for checking a website for viruses online, key types of web threats, methods for identifying internal and external issues, as well as a step-by-step action plan for cleaning up and securing the resource after a hack.

1. Signs and Symptoms of a Website Infection

Before proceeding with scanning, it is important to timely identify indirect signs that a resource has been attacked:

• Security system warnings: Browsers (Chrome, Firefox, Safari) block access to the site with a message about an unsafe resource.
• Unauthorized redirects: When visiting the site (or navigating internal pages), users are automatically redirected to third-party advertising, phishing, or casino resources.
• Injection of third-party content: The appearance of pop-up windows, third-party banners, external links in the footer or inside articles, as well as spam pages (often with hieroglyphs or irrelevant semantics).
• Creation of new administrators: Unknown user accounts with superadministrator privileges have appeared in the CMS control panel.
• Abnormal server load: The site begins to slow down significantly or crash because a malicious script is sending spam via your server or participating in a DDoS attack.
• Notifications from webmasters: Receipt of security issue notifications in Google Search Console or from your hosting support service.

2. Analysis of Common Types of Web Threats and Viruses

To effectively identify and eliminate the consequences of a hack, you need to understand what specific types of malware you may encounter on a web server:

Web Shells and Backdoors

• What it is: Malicious scripts (usually in PHP) that hackers upload to the server to maintain permanent remote access to the file system and database.
• Where they hide: Often masked as CMS system files, placed in media upload directories (e.g., /uploads/, /wp-content/uploads/), or embedded directly into theme and plugin files.
• Danger: They allow attackers to execute arbitrary commands on the server, upload new viruses, and bypass standard administrator passwords.

SEO Spam and Cloaking

• What it is: A technique where a hacked site generates thousands of malicious or spam pages (often advertising counterfeits, casinos, or pharmaceuticals).
• Cloaking principle: The malicious code checks the visitor’s User-Agent and IP address. Regular users and administrators see a normal site, while search engine bots see spam content.
• Danger: Rapid de-indexing of the site, Google penalties, and a severe drop in rankings.

Malicious Redirects

• What it is: Injection of scripts or modification of configuration files (.htaccess, nginx.conf) that send visitors to third-party resources.
• How they work: Often activated conditionally—only when arriving from search engines or mobile devices, making it difficult for the site owner to spot the issue from a desktop.
• Danger: Loss of mobile and search traffic, domain blacklisting by antivirus laboratories.

Web Skimming / Magecart

• What it is: Injection of malicious JavaScript scripts into online store checkout forms.
• How it works: Intercepts bank card details, names, addresses, and customer passwords at the moment of form submission and secretly transmits them to the attackers’ server.
• Danger: Leakage of personal and financial customer data, lawsuits, and reputational risks.

Drive-by Downloads

• What it is: Injection of scripts that automatically download malicious executable files (Trojans, ransomware) onto a visitor’s device.
• Danger: Your platform becomes a source of infection for your users’ computers and smartphones.

3. Official Google Security Check

Search engines are the first to respond to the appearance of malicious code, as their goal is to protect users from infection. Google Safe Browsing Transparency Report is a global official tool from Google to check the current security status of any URL or domain.

1. How to use: Enter your website address into the service’s search bar.
2. What it shows: The presence of malware, unwanted software, phishing pages, or social engineering. If the domain is blacklisted, the service will specify the exact threat type.

4. Overview of Current Online Scanners

Cloud scanners are used for full verification without placing a load on the server. They analyze source HTML code, connected JavaScript files, external connections, and vulnerability databases.

Service	Check Type	Key Features
VirusTotal	Cloud URL Analyzer	Checks against databases of 65+ global antiviruses
Sucuri SiteCheck	Heuristic Web Scanner	Searches for spam injections, redirects, and malicious scripts
Detectify	Vulnerability Scanner (DAST)	Automated pentest and code vulnerability search
Acunetix (Invicti)	Comprehensive Web App Audit	Deep code analysis, SQL injection, and XSS search
WPScan	Specialized CMS Scanner	Analysis of WordPress core, plugin, and theme vulnerabilities

VirusTotal

One of the most powerful and fast international services for instant analysis of individual URLs, files, and domains.

• How it works: After entering a link, VirusTotal scans the resource against the databases of over 65 leading global security vendors (including Sophos, Avast, BitDefender, ESET, etc.) simultaneously.
• When to use: Ideal for targeted checks of suspicious URLs discovered by crawlers or specified in Google Search Console reports.

VirusTotal aggregates independent sources; it does not issue verdicts itself and cannot directly remove a specific vendor’s flag. A single “Malicious” result alongside other “Clean” results is not automatically proof that a site is infected: false positives, the domain’s reputation history, ads/redirects, or content that Webroot classifies differently are possible.

Sucuri SiteCheck

A specialized security scanner developed by Sucuri security experts.

• How it works: Mimics the behavior of a visitor and search bot, analyzing server responses, structured data, header files, and external scripts.
• Advantages: Detects not only static malicious code but also heuristic signs of infection: hidden iFrames, conditional redirects, .htaccess modifications, and blacklist presence.

Detectify

An external security scanning platform created by professional ethical hackers.

• How it works: Allows you to find security flaws before attackers exploit them. Conducts automated penetration testing.
• Advantages: Ideal for complex web applications and SaaS platforms, helping identify business logic vulnerabilities, open ports, and insecure server configurations.

Acunetix Website Security Scanner (Invicti)

A professional solution for in-depth security analysis of web applications and REST APIs.

• How it works: Scans site structure in detail, analyzing dynamic JavaScript and Ajax code.
• Advantages: One of the best solutions for finding zero-day vulnerabilities, SQL injections, Cross-Site Scripting (XSS), and web server configuration flaws.

WPScan

A specialized tool for sites running WordPress (the most popular CMS in the world, which is a frequent target for attacks).

• How it works: Scans the CMS core version, installed plugins, and themes, cross-referencing them with its own vulnerability database (WordPress Vulnerability Database).
• Advantages: Identifies outdated modules with known vulnerabilities, spots insecure configurations, and helps eliminate entry points for hackers.

5. Comprehensive Internal and External Website Audit

Website security is closely tied to its overall technical condition. Unauthorized external links or broken internal URLs that appear are often the consequence of a hack or development errors. For a complete diagnosis of a resource, internal and external audits must be separated.

Internal Audit

Internal issues concern the site’s code, structure, server settings, and database.

• Broken internal links (404 Error) and cyclical redirects (301/302): Lead to search engine crawl budget waste and degrade user navigation.
• Server and script errors (500 Internal Server Error, 502/504 Bad Gateway): Occur due to PHP code failures, plugin conflicts, or database overload from malicious requests.
• Mixed Content analysis: The presence of internal elements (images, scripts, styles) loaded via insecure HTTP on a site running over HTTPS.
• Tools for internal audits: Sitebulb, Ahrefs Site Audit. They crawl the entire site and generate a detailed report for every internal page.

External Audit

External issues relate to the site’s interaction with other servers, search engines, and external infrastructure.

• Outbound Broken Links: Links leading from your site to third-party resources that no longer exist or return a 404 error. Such links can be exploited by hackers after a third-party domain registration expires (Broken Link Building / Domain Expire Attacks).
• Suspicious outbound links: Unauthorized external links to spam resources embedded into the site code as a result of a hack (often hidden via display: none CSS styles or pushed off-screen).
• Unavailability of external APIs and CDN services: Delays or blocking of third-party scripts (analytics, chat widgets, JS libraries) loaded from external servers, which can critically slow down your site.
• DNS and SSL certificate issues: Expired or incorrectly configured SSL certificates, as well as errors in DNS server records.
• Tools for external audits: Ahrefs, SEMrush, specialized broken link checkers (Apify Broken Link Checker, Links Auditor), and domain analytics in Google Search Console.

6. How to Find Dangerous Content and Hidden Malicious Pages

Sometimes Google Search Console sends a notification about dangerous content (Security Issues) but does not provide an exact list of infected URLs. To precisely localize and find problematic pages, it is recommended to combine the following methods:

Step 1. Deep Scanning via Specialized Crawlers

1. Run a technical crawler like Screaming Frog SEO Spider and perform a full scan of your website.
2. Upon completion, apply built-in and Custom Search filters:
   • Configure a search in page source for <script> elements containing suspicious calls (eval, base64_decode, document.write(String.fromCharCode)).
   • Filter pages by server response code (301/302 redirects) to find unauthorized redirections.
   • Check the external links tab—sort the list by irrelevant or suspicious domains referenced by your resource.

Step 2. Targeted Check via VirusTotal

Once the scanner generates a list of all site URLs, export the suspicious links and check them via the API or web interface of VirusTotal to get a detailed report for each address.

7. Checklist: What to Do After Restoring Access to a Hacked Site

Cleaning a site from malicious code is only half the battle. If you do not close the vulnerability through which the breach occurred, the site will be reinfected within hours.

Perform the following steps immediately after regaining control of the resource:

1. Complete change of credentials:
   • Change CMS administrator passwords (for all users).
   • Change hosting account and server control panel passwords (cPanel, Plesk, etc.).
   • Update FTP / SFTP / SSH access passwords.
   • Change database user passwords (MySQL / PostgreSQL) and update them in configuration files (e.g., wp-config.php).
2. Updating the entire software stack:
   • Update the CMS core, themes, and all used plugins to the latest versions.
   • Delete all unused plugins and themes (they are a frequent source of vulnerabilities).
   • Ensure the server runs up-to-date versions of PHP and databases.
3. File integrity comparison and audit:
   • Compare the current file structure with a clean backup from before the infection or the official CMS distribution using version control systems (Git) or file comparison tools (Meld, WinMerge).
   • Pay special attention to executable .php files, configuration files (.htaccess, nginx.conf, wp-config.php), and .js scripts.
4. Database audit:
   • Check user tables (e.g., wp_users) for unknown accounts.
   • Search the database for injected <script> tags, <iframe> elements, or Base64-encoded strings.
5. Hunting for hidden backdoors (Web Shells):
   • Examine directories meant solely for media uploads (e.g., /uploads/ or /media/). They should not contain files with a .php extension.
   • Check server file modification dates and delete recently created files with disguising names (e.g., index-backup.php, wp-login-code.php, etc.).
6. Logging and traffic monitoring:
   • Set up regular analysis of server logs (Access Log / Error Log) for suspicious POST requests to static files.

8. The Role of Infrastructure: Hosting-Level Protection

Even the strictest security policy within a CMS cannot protect a site if the server environment is improperly configured. Project security directly depends on choosing a shared hosting provider.

Quality virtual hosting providers offer a built-in suite of security tools:

• User isolation: Using CageFS technology prevents cross-infection of neighboring sites within a single hosting account.
• Automatic server scanning: Built-in server-level antivirus scanners that inspect files in real-time as they are uploaded or modified.
• DDoS protection and Web Application Firewall (WAF): Filtering malicious traffic and blocking brute-force attack attempts before they reach your CMS.
• Automatic backups: Creating daily isolated backups on separate storage servers, allowing the site to be restored in a few clicks in case of a failure.

Hosting your resource on reliable virtual hosting with active monitoring systems significantly reduces the risk of a successful attack and provides quick tools for eliminating consequences.

Conclusion

Website security is an ongoing process. Regularly perform preventive scans using VirusTotal and Sucuri, use crawlers to find hidden links, update software in a timely manner, and choose secure virtual hosting. This approach will preserve your search engine rankings and protect your users’ confidential data.

Frequently Asked Questions (FAQ)

How do I know if my site has been blacklisted by search engines?

The fastest way to check if a domain is blacklisted is via the Google Safe Browsing Transparency Report. Simply enter your site’s URL, and the service instantly displays information regarding threats. Detailed blocking status and reasons for indexing restrictions are also shown in Google Search Console under the Security Issues section.

What is the difference between a superficial and a deep website scan?

A superficial scan is performed via cloud online scanners that analyze exclusively public HTML code, open scripts, external links, and server response headers. A deep scan involves inspecting the server’s file system directly, including databases, executable PHP files, hidden directories, and CMS configuration parameters.

What types of malicious scripts are most dangerous for a website?

The greatest danger comes from web shells and backdoors, which give hackers full control over the server, as well as web skimmers that steal customer payment data directly from checkout forms. Cloaked SEO spam is equally dangerous, rapidly destroying search visibility.

What are internal and external technical website issues?

Internal issues relate to code errors, incorrect structure, broken internal links, server-side failures, and database problems. External issues include outbound links to non-existent or spam resources, failures when loading third-party scripts from external CDNs, and DNS/SSL certificate problems.

What if Google Search Console reports dangerous content but doesn’t list specific pages?

In such a situation, you should run a full resource scan using a specialized technical crawler. Configure program filters to search for potentially malicious constructs in source code, and check all external links and 301/302 redirects. The identified list of suspicious addresses should then be verified via VirusTotal to accurately confirm infection.

Can I scan website files for viruses directly on the hosting server?

Yes, most modern providers offer specialized antivirus protection tools right inside the control panel. An administrator can launch a scan of the entire site directory via a built-in server antivirus module, which identifies modified system files and malicious scripts.

Why does a site get reinfected after removing malicious code?

Reinfections happen when a hidden backdoor remains on the server or the original vulnerability is left unpatched. If an administrator deletes the virus itself but does not update outdated plugins, CMS, or close the entry point in the file system, attackers quickly regain access to the site.

What are the first steps immediately after restoring access to a hacked site?

First of all, you need to completely change all passwords for the admin panel, databases, FTP, and SSH. Immediately after, update the CMS core and all connected modules to the latest versions, audit users, check file integrity, and remove unused components.

Why choose secure virtual hosting?

High-quality virtual hosting provides robust server-level isolation, automated backups, and built-in web security tools that significantly reduce the attack surface and simplify recovery if an incident occurs.