# Website malware scan

> A website malware scan looks for signs that a site has been compromised or is easy to compromise. An external scan, like Vigilbase's free check, finds exposed files, outdated server banners and missing protections from the outside. Malware hidden in your files or database needs a server-side scan as well, so use both.

This site is run by Vigilbase (https://vigilbase.com), a managed security provider. It covers: website malware scan.

## Run the check

- In the browser: https://websitemalwarescan.com/ (results shown on the page)
- API: POST https://api.vigilbase.com/tools/v1/agent/tools/security-headers/execute with {"target":"example.com"}

## External scan versus server-side scan

- External scan: works from the public internet with no access needed. Finds exposed .git folders, backups and environment files, weak TLS, missing headers and version leaks.
- Server-side scan: runs on the server or inside your CMS. Finds injected code, web shells, malicious redirects and changed core files.
- Both together: the external scan shows how attackers get in, the server-side scan shows whether they already did.

## Signs a website has malware

- Visitors are redirected to spam, gambling or fake prize pages, often only on mobile or only from search results.
- Google Search shows a 'This site may be hacked' warning, or browsers show a red warning page.
- New admin users, unknown plugins or files you did not upload.
- Your host suspends the account for sending spam or using unusual resources.

## After a clean-up, stop it happening again

Most site infections come through outdated plugins, stolen admin passwords or exposed files. Update everything, rotate passwords and keys, turn on two-factor login, and put the site behind a web application firewall that blocks exploit attempts before they reach your server.

## FAQ

### Can an online scan detect all website malware?

No. An online scan only sees what the site serves publicly. Code hidden in files or the database, or shown only to some visitors, needs a server-side scan.

### Is the Vigilbase scan safe to run?

Yes. It makes ordinary web requests and does not change anything on the site.

### How do I stop my site being reinfected?

Patch the hole that let the attacker in, rotate every credential, and add a web application firewall. Vigilbase Shield provides a managed one.

## Related

- [Block attacks with Shield](https://vigilbase.com/shield)
- [Get help with a compromised site](https://vigilbase.com/start)
- [Security headers checker](https://vigilbase.com/tools/security-headers)
- [HSTS checker](https://vigilbase.com/tools/hsts-checker)
- [DNSSEC checker](https://vigilbase.com/tools/dnssec-checker)
- [CSP evaluator](https://vigilbase.com/tools/csp-evaluator)
- [Cloudflare checker](https://vigilbase.com/tools/cloudflare-checker)