You want to know whether a website contains a virus or malware. Maybe it is your own site and customers reported a warning, or it is a site you are about to visit.
Here is how to check, from quick online scans to deeper checks for site owners.
Key takeaways
- Use a multi-engine scanner like VirusTotal for a broad first check.
- Google's Safe Browsing status shows whether browsers will warn visitors.
- External scanners cannot see server-side files; site owners also need to check from the inside.
- A detection can be a false positive, so look at which vendors flag the site and why.
Quick checks for any website
These free tools take seconds:
- VirusTotal: paste the URL to see verdicts from 90+ security vendors. Our link checker guide explains how to read it.
- Google Safe Browsing status: shows whether Chrome, Firefox and Safari will warn visitors.
- Sucuri SiteCheck: scans visible pages for malware, injected spam and blacklist status.
- URLhaus: shows whether the URL is known for distributing malware.
Reading the results
A clean result on all tools is a good sign. One or two detections may be a false positive, especially from machine-learning engines; check the label and vendor. Several detections with labels like malware or phishing mean you should avoid the site, or if it is yours, investigate. See one vendor flagging your domain.
Extra checks for site owners
External scanners only see what your site shows them. Many infections hide from scanners or logged-in admins. Also check:
- Google Search Console's Security Issues report.
- Your site from a phone on mobile data, logged out.
- Google search results for site:yourdomain.com, looking for spam pages.
- Recently modified files and unknown admin users on your server or CMS.
- Your host's malware scan, if available.
Running WordPress? Follow our WordPress hack checklist for a more detailed inspection.
If you find a virus
Clean the infection, close the entry point and verify with the external scanners again. Then request removal from every vendor that flagged you. Our CMS virus removal guide walks through each step.
If the site is clean but still flagged
That is a false positive. Submit a review request to each vendor, with evidence that the site is clean. Our false positive reporting guide includes a template.
Frequently asked questions
Can I get a virus just by visiting a website?
It is rare with an updated browser, but malicious sites can still trick you into downloading files or entering data.
Are free website scanners reliable?
They are a good first check but cannot see server-side files. Use several and combine them with manual checks.
How often should I scan my own website?
At least weekly, or continuously with automated monitoring.
Why does one scanner say clean and another says malicious?
Each vendor uses different data and models. Look at which vendor flags the site and whether its label matches what you find.