Is your website hacked? Know before Google, or your client, does.
IsHacked checks your sites from the outside, the way visitors and Google see them: cloaked spam, sneaky redirects, malware, PHP errors, expiring SSL, broken email and the WCAG accessibility failures behind ADA demand letters. Try it free on any site, then monitor every client site daily.
Free, no sign-up, about a minute. Daily monitoring from $3/month for 10 sites: start monitoring.
What gets checked
Built from real hacked-WordPress cleanups: spam shown only to Google, ad loaders hidden from logged-in admins, a blank index.html served instead of the homepage. Plus the everyday failures that hurt just as much.
Hacks and malware
- Redirects only phones, Google visitors or one country see
- Malware signatures: NDSW, Balada, SocGholish, pop-under loaders, obfuscated eval
- New script, iframe and form domains
- Rogue WordPress users and hex-named fake plugins
- A dropped index.html replacing WordPress
- Exposed database dumps, wp-config backups, .env and .git
SEO spam and indexing
- Cloaking: what Googlebot sees versus visitors
- Casino, pharma and Japanese keyword spam
- Hidden links and spam anchors
- Injected or foreign sitemaps, sudden URL growth
- robots.txt tampering and surprise noindex
Uptime and errors
- Reachability from Germany, the US and the UK
- HTTP 5xx, PHP fatal errors and WordPress critical-error screens
- Database connection errors and stuck maintenance mode
- Suspended-account and default server pages
- Slow homepage responses
SSL, domain and DNS
- Certificate validity and expiry (alerts at 14 and 7 days)
- Domain registration expiry via RDAP
- Nameserver and MX changes (hijack signs)
- http to https redirect
Email deliverability
- SPF: present, single, within 10 lookups, no +all
- SPF and DKIM match the mailbox provider (Google Workspace, Microsoft 365, Zoho…)
- DMARC present and enforced
- Spamhaus domain and IP blocklists
Security hygiene
- Outdated WordPress core and end-of-life PHP
- Mixed content on https pages
- Version leaks, username enumeration, XML-RPC
- HSTS and clickjacking headers
Accessibility (WCAG 2.2 AA)
- Menus, prices, hours and flyers posted only as images or PDFs
- Links coded as buttons, buttons that open pages
- No skip link or main landmark
- Zoom blocked on phones
- Form fields without visible labels or autocomplete
- Missing page titles, language and headings
Accessibility checks for the ADA demand-letter era
Plaintiffs filed 3,117 website accessibility lawsuits in US federal court in 2025, 27% more than in 2024, and many more demand letters settled before anyone filed. They cite the same WCAG 2.2 AA failures again and again, and online shops, restaurants and local businesses get most of them.
Every scan checks the homepage and the inner pages it samples for those failures, lists each one with the page, the element and the fix, and tells you in your digest when a new one appears, for example after someone uploads this week's menu as a photo. Turn the area off for any account that doesn't need it.
Automated checks find part of WCAG, not all of it, and a clean result isn't a compliance certificate or legal advice.
Built for how you work
One account covers every client site, with the right level of detail for whoever reads the report.
Developers and freelancers
Raw response headers, HTML as Googlebot and as a phone, redirect chains, DNS, SPF and DMARC records, and the full JSON snapshot of every scan. A REST API and webhooks for your own tooling.
Agencies
Paste hundreds of URLs with client labels, see problems first, export to CSV, and route alerts to Slack, Discord or a shared inbox. Re-check every site after a deploy with one click.
Marketers and SEO
Know when Google is being served spam, the sitemap fills with junk URLs, robots.txt blocks crawlers, or a page goes noindex, before rankings drop.
Site owners
Plain-English alerts saying what's wrong and what to do next, an email naming what got fixed, and a checklist of everything that passed.
How it works
- Enter your email and confirm it.
- Pick a plan and pay with Stripe.
- Paste your clients' URLs, one per line, with an optional label.
- The first report arrives in about a minute. After that you hear from us only when something changes.
Made for developers
Everything in the dashboard is available as JSON. Trigger checks from CI after a deploy, pull status into your own dashboard, or send alerts to Slack.
curl -X POST https://ishacked.com/api/v1/check-all \ -H "Authorization: Bearer ih_…" curl https://ishacked.com/api/v1/sites/<id> \ -H "Authorization: Bearer ih_…" | jq '.checks[] | select(.status != "pass")'
Inside WordPress and on the server
The outside check sees what visitors and Google are served. These two see the files and the database.
Free WordPress security plugin
More than 60 read-only checks from wp-admin: vulnerable plugins, core and plugin files compared with the official releases, malware patterns, hidden administrators and risky settings.
Server scanner, a Wordfence CLI alternative
One PHP file that scans every WordPress install on a server and runs Wordfence CLI's commands unchanged: malware-scan, vuln-scan, db-scan and remediate. Included with every plan.
Priced at cost
Run by a Codeable expert. The plans cover the servers, VPN exits, email and card fees, plus a small margin. Every plan gets every check. Cancel any time.
Solo
- Up to 10 sites
- 30 uptime monitors for subdomains
- Every check, daily, from up to 5 countries you pick
- Uptime checks every 5 minutes
- 20 on-demand checks a day
- Email, Slack and webhook alerts
- API, raw data and CSV export
Pro Most popular
- Up to 50 sites
- 150 uptime monitors for subdomains
- Every check, daily, from up to 5 countries you pick
- Uptime checks every minute
- 60 on-demand checks a day
- Email, Slack and webhook alerts
- API, raw data and CSV export
Agency
- Up to 200 sites
- 600 uptime monitors for subdomains
- Every check, daily, from up to 5 countries you pick
- Uptime checks every 25 seconds
- 150 on-demand checks a day
- Email, Slack and webhook alerts
- API, raw data and CSV export
Questions
How do I know if my website is hacked?
Most hacked sites look normal to their owners. Compare what Googlebot sees with what you see, load the site as a phone visitor arriving from Google, search site:yourdomain.com for spam titles, and check the sitemap. IsHacked runs these checks for you, free once or daily with monitoring.
Do you need access to the site?
No. Everything is checked over public HTTP and DNS, as a visitor or search engine would see it. No plugin, no login, nothing to install.
Can it prove a site is clean?
No external scanner can. A backdoor that shows nothing to the public stays invisible from outside; in one recent cleanup a well-known external scanner reported a compromised site as clean. IsHacked catches the symptoms visitors and Google see. Pair it with a server-side scan of files and the database.
How much traffic does monitoring send?
About 50 requests per site per day: a few homepage loads, robots.txt, sitemaps, the WordPress REST index and a short list of files that should never be public, plus DNS lookups.
Can I run a check right away?
Yes, per site or for all sites at once. Each site can be checked on demand once every 10 minutes, within a daily allowance of 20, 60 or 150 checks depending on the plan. The daily checks don't count against it.
What if a firewall blocks the checks?
IsHacked falls back to its US and UK locations automatically. You can also allow the server IP 46.224.160.47 in the firewall.
What about false alarms?
The first scan learns what is normal for each site: its script sources, users and plugins. After that only changes are reported, and anything you mark as not a problem stays quiet, on one site or on all of them. Tell us when a check gets it wrong and we fix it for everyone.
Do you check website accessibility (WCAG and the ADA)?
Yes, on every scan and in the free check. IsHacked looks at the homepage and the inner pages it samples for the WCAG 2.2 AA failures that US ADA demand letters cite most: menus and opening hours posted as images, links coded as buttons, no skip link, zoom blocked on phones and form fields without labels. Each finding names the page, the element and the fix. It is not a compliance certificate: much of WCAG needs a person to test it.
Who gets the alerts?
You, plus up to 5 extra addresses per account (a client, a colleague, a shared inbox), and optionally a Slack, Discord or custom webhook.
Guides from real cleanups
What hacks look like from outside, and how to find and remove them.
Critical PHP RCE (CVE-2026-109618 and CVE-2026-109619): how to check every site and patch
Two critical unauthenticated RCEs hit every PHP below 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Commands to find the PHP each site really runs, patch it and mitigate.
How to check if your website is hacked
12 practical tests to tell if a website or WordPress site is hacked: cloaked spam, mobile-only redirects, injected scripts and exposed files.
The Japanese keyword hack: detect it, remove it, keep it out
Google shows Japanese titles for your site? How the Japanese keyword hack works, how to confirm it, and how to clean WordPress and Search Console.
WordPress redirect hack: when only some visitors get sent to spam
Your WordPress site redirects visitors to spam, but not you? How mobile-only and Google-referrer redirects work and where the code hides.
SEO spam and cloaking: casino and pharma links only Google can see
Casino, slot or pharma titles in Google for your site? How SEO spam cloaking works, how to see what Googlebot sees, and how to clean it up.
SPF, DKIM and DMARC for WordPress sites: why your emails land in spam
Contact form emails landing in spam? SPF and the 10-lookup limit, DKIM for Google Workspace and Microsoft 365, and DMARC, with records to copy.
Start monitoring today
Enter your email and we'll send a link to confirm it. Then pick a plan and paste your sites.