How to scan your site for malware

Scanning is how you turn suspicion into a specific list of files to deal with. There is no single tool that catches everything on its own, so treating scanning as several complementary checks, rather than one definitive answer, gives a far more reliable result.

Back up first, even an infected site

Before running any scan or making any change, take a full backup of the site exactly as it currently stands. This feels counterintuitive when the goal is to remove malicious content, but it matters for two reasons: it gives you a reference point to compare against as you clean, and it means a mistake made during cleanup — deleting the wrong file, breaking a working feature — is recoverable rather than compounding the original problem.

CMS-level security scanning

If your site runs on a common CMS, a reputable security plugin built for that platform is usually the most efficient starting point. These tools typically check your core files, plugins and themes against a database of known-good versions, flagging anything that has been altered, and separately scan for patterns commonly found in malicious code — obfuscated scripts, suspicious file uploads, unexpected outbound connections initiated from within the code.

Comparing against a known-clean copy

For core CMS files, download a fresh copy of the exact version you are running directly from the official source, then compare it file by file against what is actually on your server. Any difference in a file that should be identical to the stock version is worth investigating specifically — this catches code injected into an otherwise legitimate file, which is a common technique precisely because it does not look like an obviously new or out-of-place file.

# A simple recursive comparison on a machine with both copies available
diff -rq /path/to/clean-copy /path/to/live-site

This will not work cleanly for files your CMS is meant to modify during normal operation — caches, uploads, configuration — so expect some legitimate differences and focus on unexpected changes to files that should not normally change at all.

Checking modification dates

Sort your site's files by the date they were last modified, either through the file manager in your control panel or an FTP client. A cluster of files changed on a date you cannot account for is one of the most reliable signals available, and it works even for custom code that no CMS-level scanner would recognise as suspicious, because it does not rely on knowing what the files should look like — only on knowing when they changed.

Reading the results properly

Not every flagged file is malicious, and not every clean scan result means the site is genuinely clear.

• A flagged file that matches a pattern common in legitimate code — some scanners flag anything using functions that are also used maliciously, such as functions that execute dynamically generated code. Investigate rather than deleting on sight; it may be a legitimate part of a plugin you installed deliberately.
• A clean result from only one type of scan — treat this as one data point, not a conclusion. A CMS-level scan that only checks known files will not see custom code you or a developer added yourself.
• A file you genuinely cannot explain — an unfamiliar name, in a folder that should not contain executable code, with a modification date matching a suspected compromise window, is a strong candidate for removal even without fully understanding what it does.

After the scan

Once you have a confirmed list of malicious files, move to cleaning or restoring as covered in what to do first if your website is hacked. Scanning tells you what is wrong; it does not close the door that let it happen, so finding and fixing the actual cause afterwards remains the step that stops it recurring. If the site has also picked up a browser or search engine warning as a result of what the scan found, clearing a Google "deceptive site" warning covers what comes after the cleanup itself.