Free tool
Website malware scan
A website malware scan looks for signs that a site has been compromised or is easy to compromise. An external scan, like Vigilbase's free check, finds exposed files, outdated server banners and missing protections from the outside. Malware hidden in your files or database needs a server-side scan as well, so use both.
- ISO 27001 compliant
- SOC 2 Type 2 compliant
- Preferred Cloudflare Partner
- 24/7 follow-the-sun support
External scan versus server-side scan
- External scan: works from the public internet with no access needed. Finds exposed .git folders, backups and environment files, weak TLS, missing headers and version leaks.
- Server-side scan: runs on the server or inside your CMS. Finds injected code, web shells, malicious redirects and changed core files.
- Both together: the external scan shows how attackers get in, the server-side scan shows whether they already did.
Signs a website has malware
- Visitors are redirected to spam, gambling or fake prize pages, often only on mobile or only from search results.
- Google Search shows a 'This site may be hacked' warning, or browsers show a red warning page.
- New admin users, unknown plugins or files you did not upload.
- Your host suspends the account for sending spam or using unusual resources.
After a clean-up, stop it happening again
Most site infections come through outdated plugins, stolen admin passwords or exposed files. Update everything, rotate passwords and keys, turn on two-factor login, and put the site behind a web application firewall that blocks exploit attempts before they reach your server.
How Vigilbase helps
Vigilbase runs security operations and website protection for businesses that would rather not build a security team.
Vigilbase Shield
Managed Cloudflare WAF, DDoS and bot protection, configured and watched by our team.
Learn moreIncident response
Help to contain, clean up and recover when something has already gone wrong.
Learn moreVigilbase OS
AI investigates every alert and brings you only verified threats, with the fix ready to approve.
Learn moreFrequently asked questions
Can an online scan detect all website malware?
No. An online scan only sees what the site serves publicly. Code hidden in files or the database, or shown only to some visitors, needs a server-side scan.
Is the Vigilbase scan safe to run?
Yes. It makes ordinary web requests and does not change anything on the site.
How do I stop my site being reinfected?
Patch the hole that let the attacker in, rotate every credential, and add a web application firewall. Vigilbase Shield provides a managed one.
More free tools and guides
Security handled, around the clock
Vigilbase is ISO 27001 and SOC 2 Type 2 compliant and a Preferred Cloudflare Partner, with follow-the-sun support from teams in Kenya, South Africa, the UAE and Portugal.