Is my website hacked? Check any site for free
Enter an address and IsHacked loads it as a visitor, as Googlebot and as a phone arriving from Google, from three countries, then checks the sitemap, WordPress, SSL, domain and email setup.
Each result gets a private link you can share with a client or colleague for 7 days. Details that could help an attacker are left out.
What the free check looks at
Cloaking
what Googlebot gets compared with what visitors get
Redirects
for phones arriving from Google, and from Germany, the US and the UK
Malware
known signatures, obfuscated scripts and loaders served from PHP files
SEO spam
casino, pharma and Japanese keyword spam, hidden links, polluted sitemaps
WordPress
suspicious users, fake plugins, a dropped index.html, exposed backups
Errors
HTTP 5xx, PHP fatals and WordPress critical-error screens
SSL and domain
certificate and registration expiry, http to https
SPF, DKIM and DMARC records, and Spamhaus blocklists
One check is a snapshot
Infections come and go: redirects fire for some visitors, spam is added in bursts, and cleaned sites get reinfected through backdoors. Monitoring runs every check daily on all your sites and emails you only when something changes.
Learn what the results mean
How to check if your website is hacked
The Japanese keyword hack: detect it, remove it, keep it out
WordPress redirect hack: when only some visitors get sent to spam
SEO spam and cloaking: casino and pharma links only Google can see
SPF, DKIM and DMARC for WordPress sites: why your emails land in spam