Check Site For Malware
Check any site for malware, phishing and unwanted software using the Google Safe Browsing list. Instant result, no signup.
By Deepak Shukla — Founder & CEO, Pearl Lemon
What This Tool Checks
- Whether the URL is flagged for MALWARE by Google Safe Browsing
- Whether the URL is flagged for SOCIAL_ENGINEERING (phishing)
- Whether the URL is flagged for UNWANTED_SOFTWARE
- Whether the URL is flagged for POTENTIALLY_HARMFUL_APPLICATION
- Heuristic flags (non-HTTPS, suspicious hostname patterns, punycode)
Why This Matters
A Google Safe Browsing flag is the fastest way to lose 100% of your organic traffic. Chrome, Safari, Firefox, and most enterprise filters all consume the same Safe Browsing feed — once you're flagged, every visitor sees a full-page red warning before the site even loads. Most sites get flagged from compromised plugins, injected scripts, or one bad ad on a long-tail page. Checking proactively catches it before Search Console emails you 48 hours after the damage is done.
How to Fix Issues
- 1.If flagged: immediately scan the site for injected JavaScript, suspicious files in /wp-content/uploads/, and recently modified files
- 2.Remove all malicious code, then submit a review request via Google Search Console > Security Issues
- 3.Audit every third-party script (analytics, ads, chat widgets, A/B test tools) — most malware reaches sites through compromised dependencies
- 4.Use a WAF (Cloudflare, Sucuri, Wordfence) to prevent re-infection while you clean up
- 5.After cleanup, change every admin password and rotate every API key on the affected site
Getting flagged by Google Safe Browsing is the closest thing to instant business death on the modern web. It takes minutes to happen and weeks to recover from. This tool is the early-warning system.
What Safe Browsing actually flags
Google Safe Browsing maintains constantly-updated lists of URLs that fall into four categories:
- MALWARE: pages hosting or distributing malware (drive-by downloads, exploit kits, malicious JS)
- SOCIAL_ENGINEERING: phishing pages trying to steal credentials or trick users (fake login forms, fake payment pages)
- UNWANTED_SOFTWARE: pages pushing software the user didn't consent to (toolbars, hijackers, deceptive installers)
- POTENTIALLY_HARMFUL_APPLICATION: usually Android-app-specific, but URLs that distribute these get flagged
When Chrome, Safari, or Firefox sees a flagged URL, the browser interrupts navigation with a full-page red warning. The vast majority of users click "Back to safety." Conversion goes to zero. Organic traffic goes to zero. Email links break. Slack/Discord previews say "this link may be malicious." The site might as well be offline.
How sites get flagged when they didn't do anything wrong
Most flagged sites aren't malicious — they're compromised. The compromise vectors, in order of 2025 frequency:
- Vulnerable WordPress plugin — attacker injects JS that loads a malicious payload from a third-party CDN. The site's own code is clean; the injected
<script>is what trips Safe Browsing. - Compromised ad network — a single bad creative in a long-tail ad chain serves malware once, gets reported, taints the publisher's domain.
- Compromised npm/composer dependency — supply-chain attack injects exfiltration code into your build.
- Stolen admin credentials — attacker logs in, uploads a backdoor PHP file, hosts a phishing kit at
yoursite.com/secure-login/. - Vulnerable form — attacker hosts file uploads via your contact form, links to them from phishing campaigns. Safe Browsing flags your domain.
Why this tool exists
Google Safe Browsing has a free real-time API. Almost no one uses it proactively because most people don't know it exists. This tool is a friendly wrapper: paste a URL, hit check, see the result instantly. Run it on your own sites weekly. Run it on competitor sites you cite. Run it on inbound links before you publish them.
Recovery if you're already flagged
- Identify and remove the malicious code (often a script tag injected into header/footer, or a base64-encoded payload in a PHP file).
- Audit and rotate everything: admin passwords, API keys, SSH keys, database credentials.
- Audit recent file modifications (
find . -mtime -7 -type f). - Patch the original entry point (update WordPress, update the compromised plugin, close the file-upload hole).
- Request review via Google Search Console > Security Issues. Reviews usually complete in 24-72 hours if the site is genuinely cleaned.
- While you wait, put a WAF in front (Cloudflare WAF, Sucuri) to prevent re-infection.
What this tool does NOT do
We check Google Safe Browsing only — we do not run deep file scanning, do not check Sucuri's blocklist, do not check Norton/McAfee blocklists. For a multi-source check, combine this with Sucuri SiteCheck and VirusTotal. We also do not scan for in-page malicious behaviour (we don't execute JS in a sandbox) — we only check whether the URL is already on the Safe Browsing blocklist.
Methodology
We normalise the input to an HTTPS URL and submit it to the Google Safe Browsing v4 API (threatMatches:find endpoint) checking against four threat types (MALWARE, SOCIAL_ENGINEERING, UNWANTED_SOFTWARE, POTENTIALLY_HARMFUL_APPLICATION) on the ANY_PLATFORM target. Requests have an 8-second timeout. The API returns zero matches (=safe) or a list of threat objects (=flagged). We surface each threat with its type, the platform it applies to, and the matched URL. Independently, we run three local heuristic checks: HTTPS presence, @-in-hostname (a phishing red flag), and punycode (xn--) hostnames (a homograph-attack red flag). Heuristic flags are surfaced separately from Safe Browsing flags. If the Safe Browsing API key is not configured server-side, we still run heuristics and surface that the API key is missing — never silently skipping the check.
Frequently Asked Questions
This tool also answers
How do I check if a website is safe to visit?
Enter the URL above. The scan checks the site against public blocklists and inspects the live page for injected scripts, suspicious redirects and known malware signatures, then explains what each finding means in plain terms.
How do I check a site for malware for free?
Paste the address into the box above and run the check. It queries the Google Safe Browsing list — the same list Chrome, Safari and Firefox use — and returns malware, phishing and unwanted-software flags in a few seconds. No signup, no card, no limit on how often you check.
How do I know if my website has been hacked?
Three signals catch most hacks: a Safe Browsing flag (check it above), unexpected new files or recently modified PHP files on the server, and script tags loading from domains you do not recognise. If any of those are true, treat the site as compromised and rotate every credential.
Is this website safe? How can I tell before I click?
Run the URL through the checker before visiting. A clean result means Google has not flagged the address for malware or phishing. Also look for HTTPS, a hostname with no stray "@" character, and no "xn--" punycode — all three are flagged here automatically.
How often should I scan my website for malware?
Weekly is enough for a small brochure site. Scan daily if you run WordPress with third-party plugins, accept file uploads, or serve ads — those are the three most common infection routes. Continuous checks with alerting are what LemWatch monitoring adds on top.
Related Free Tools
Exposed Services
See which ports and services your domain exposes to the public internet. Spot critical risks like open SSH, MySQL, Redis, or RDP before attackers do.
SSL Checker
Check if your SSL/TLS certificate is valid, properly configured, and when it expires. Get instant results for any URL.
WordPress Detector
Detect if a site runs WordPress. Identify the WordPress version, active theme, and visible plugins from the public HTML — no login required.
HTTP Status Code Reference
Understanding HTTP status codes helps you diagnose issues found by this tool: