Maybe something felt off: a strange email from your host, a dip in traffic, a customer comment you could not quite verify. If you have noticed an actual symptom, our guide to the signs of a hacked website tells you what each one means. This piece is the other half: the checks you can run right now, free, to get a real answer either way.
How do I check if my website has been hacked?
Run six free checks: Google's Safe Browsing status page, a site: search of your own domain, the Security Issues report in Search Console, an external malware scanner, an incognito visit from Google on your phone, and an audit of your admin users. Together they take about ten minutes and catch the overwhelming majority of infections.
Check 1: Google's Safe Browsing status
Google publishes its verdict on any site. Search for "Google Safe Browsing site status", open the transparency report page, and enter your domain. "No unsafe content found" is a good sign; anything else means Google has already found malware or phishing on your site, and your visitors are being warned away. If so, go straight to our guide on removing the "Deceptive site ahead" warning.
Check 2: search your own domain
Search Google for site:yourdomain.ie and read every result. You are looking for pages you never created: designer handbags, pills, casino reviews, Japanese or Russian text. SEO spam infections create thousands of junk pages under your domain while the site itself looks untouched, and this one search exposes them instantly.
Check 3: Search Console's Security Issues report
If your site is verified in Google Search Console, open Security Issues. A clean site says "No issues detected". An infected one names the problem (deceptive pages, malware, harmful downloads) and lists sample URLs, which is exactly the evidence a professional clean starts from. Not verified yet? It takes ten minutes and it means Google emails you the moment anything is found, so future infections never go unnoticed for weeks.
Check 4: run an external malware scanner
Free scanners like Sucuri SiteCheck or VirusTotal fetch your pages from outside and check them against known malware and blocklists. A positive result is reliable: something is there. A clean result is weaker evidence, because external scanners cannot see files on your server, database contents or cloaked malware that hides from scanners. Treat "clean" as "nothing obvious", not "nothing".
Check 5: visit like a stranger
Much malware hides from site owners and shows itself only to fresh visitors from search. So impersonate one: open a private browsing window, ideally on your phone, search Google for your business and click through from the results. Watch for redirects, popups, fake virus alerts or pages you do not recognise. One weird bounce is enough to matter, that selective behaviour is exactly how redirect malware operates.
Check 6: audit your admin users
Log into your CMS and read the full user list, including inactive accounts. Every admin account should belong to a person you can name. Attackers add their own admin users to keep access after clean-ups, usually with bland, plausible names like "support" or "wp_admin2". An account nobody on your team created is about as close to proof as these checks get.
What if a check comes back bad?
Treat the site as infected and move to response mode: change every password from a clean device, contact your host, and do not delete anything yet, the infected files are the evidence of how the attacker got in. Our pillar guide on what to do when your website is hacked walks the whole recovery in order.
And if you would rather hand it over at this point, that is literally what our hacked website repair service is for: we confirm the infection, clean it at hosting level, and get any Google warnings lifted.
Frequently asked questions
All six checks came back clean. Am I definitely safe?
You are very probably clean, but no external check can fully rule out a deep or brand-new infection, only a file-and-database inspection can. If something still feels wrong, or the site behaves oddly for visitors, a professional scan settles it for certain.
How often should I run these checks?
Monthly is a sensible habit for any business site, plus immediately whenever anything odd happens. Better still, put the site on monitoring so file changes and blocklist hits are flagged automatically, that is part of what a maintenance plan does.
Are free website malware scanners reliable?
Reliable when they find something, weak when they do not. They check your site from outside against known threats, so hidden backdoors, database malware and cloaked code routinely slip past. Use them as an early check, never as the final word.
Can I check someone else's website the same way?
The Safe Browsing status page and external scanners work on any domain, so yes, they are a quick way to vet a supplier's site or a link you have been sent before trusting it.
One of the checks come back bad? We will confirm what it is and clean it properly. Get emergency help.