How to Check a Website for Malware: 7 Detection Methods

A compromised website means lost traffic, damaged reputation, and exposed user data. Search engines block infected sites, browsers display warnings, and hosting providers suspend accounts. The sooner you detect a threat, the less damage it causes.

This guide covers 7 practical methods for checking a website for malware — from quick online scanners to deep server-side analysis.

1. Online Security Scanners

The fastest approach — check a URL through external scanners. They analyze the page's HTML, JavaScript, external links, and cross-reference the domain against malware databases.

Popular services:

• Google Safe Browsing — check via the Transparency Report. Shows if a site is flagged as dangerous in Chrome
• VirusTotal — URL scanning through 70+ antivirus engines simultaneously
• Sucuri SiteCheck — checks for malware, spam, injections, blacklists
• URLScan.io — detailed analysis of page behavior, network requests, and loaded resources

Limitations: online scanners only see what the server returns over HTTP. PHP backdoors, hidden cron jobs, and encrypted code remain invisible.

2. HTTP Security Headers Check

Missing security headers aren't malware themselves, but they leave the door wide open for attacks. Verify the presence of:

• Content-Security-Policy — protection against XSS and script injection
• X-Frame-Options — clickjacking protection
• X-Content-Type-Options: nosniff — prevents MIME-SNI
• Strict-Transport-Security — enforces SSL/TLS проверку

Use the Enterno.io HTTP Headers Checker for instant analysis of all server response headers.

3. Blacklist Check (DNSBL)

Your site's IP address and domain can end up on blacklists (DNSBL — DNS-based Blackhole Lists) due to spam sending, malware hosting, or phishing.

Being blacklisted leads to:

• Email delivery failures from your server
• Browser warnings for visitors
• Search ranking drops

Check your IP against dozens of blacklists at once with Enterno.io DNSBL Checker. For deeper IP reputation analysis, use AbuseIPDB Lookup.

4. SSL Certificate and HTTPS Analysis

Malicious sites often use forged or expired SSL certificates. Verify that:

• The certificate is valid and issued by a trusted CA
• No certificate chain errors exist
• No Mixed Content (HTTP resources on HTTPS pages)
• TLS 1.2+ is supported (TLS 1.0 and 1.1 are insecure)

Use SSL Check and Mixed Content Check on Enterno.io.

5. Server-Side File Scanning

The most reliable method — checking files directly on the server. PHP malware typically looks like:

• eval(base64_decode(...)) — obfuscated code
• $_POST['cmd'], system(), exec() — backdoors for remote command execution
• Suspiciously named files in uploads, tmp, or cache directories
• Modified .htaccess files with redirects to external sites

Detection commands:

# Search for suspicious PHP functions
grep -rl "eval(base64_decode|system(|passthru(|shell_exec(" /path/to/site/ --include="*.php"

# Files modified in the last 3 days
find /path/to/site/ -name "*.php" -mtime -3

# Find hidden .htaccess with redirects
find /path/to/site/ -name ".htaccess" -exec grep -l "Redirect|RewriteRule.*http" {} ;

6. Uptime and Content Monitoring

Compromise often manifests through:

• Hidden links and redirects appearing (SEO spam)
• Content swapping for mobile users (cloaking)
• Sudden performance drops (cryptomining scripts)
• Site downtime (DDoS or file corruption)

Set up Enterno.io monitoring with 30-60 second check intervals and instant alerts via Email, Telegram, or Slack. This way you learn about problems the moment they occur, not days later.

7. Google Search Console

Search engines proactively notify you about security issues:

• Google Search Console — the "Security Issues" section shows detected threats
• Bing Webmaster Tools — similar security notifications

If your site is flagged as dangerous — fix the issue and request a re-review. Google typically removes the flag within 1-3 days.

Website Security Checklist

• Regular updates of CMS, plugins, and themes
• Daily backups with at least 7 copies retained
• HTTP security headers configured (Content Security Policy, HSTS, X-Frame-Options)
• SSL certificate valid and auto-renewed
• Upload directories cannot execute PHP
• FTP/SSH/admin passwords are long and unique
• Uptime monitoring with alerts enabled
• WAF configured at server or CDN level
• IP not on any DNSBL blacklists

Summary

Website security is not a one-time check — it's a continuous process. Combine external scanners, server-side auditing, and constant monitoring. The earlier you detect a threat, the easier it is to fix and the less damage to your business.