Free Website Malware Scanner

Find malicious and injected JavaScript on any website. We load the page in a real browser, check every script it runs, decode what is hidden and tell you which script is the problem.

https://

No credit card required • Instant results

Script reputation

Every host your page loads code from is checked against threat intelligence, including domains made to look like well-known providers.

Obfuscated and injected code

Malware hides behind encoding and loaders. We decode what the browser actually runs, including code built at runtime by another script.

Blocklist status

We check whether your domain is already listed as malicious or spammy, which is often the first sign visitors and email providers see.

Not just "malware found"

Each finding names the script, says in plain language why it is suspicious, and shows where it was loaded from, so you can remove it rather than guess.

  • Inline, external and runtime-injected scripts
  • Plain-language reason for every finding
  • File, hash and the script that loaded it
Scan results

Suspicious script

High

External script on example.com

  • Loads from a domain imitating a well-known provider.
  • Is packed with an obfuscator used almost only by malware.
Technical details
URL
https://jsdelivr-cdn.example.net/npm/jquery.min.js
SHA-256
41b07e2c…9f13ad
Size
18.4 KB
Loaded by
Inline script on /
Example finding. Site and script details are illustrative.

Run an online store?

Card skimmers are the malware most likely to cost you money. Our skimmer detection is tested against newly found skimmers continuously.

Card skimming scanner

Malware scanning questions

How do I scan my website for malware?

Enter your URL above. We load the page in a real browser, collect every script it runs (inline, external and injected at runtime), check each script host against threat intelligence, decode obfuscated code and check whether your domain is on a blocklist. Results arrive in about a minute.

What kind of malware does this find?

Malicious and injected JavaScript: scripts served from hosts flagged by threat intelligence, scripts loaded from domains imitating well-known providers, code packed with malware obfuscators, card skimmers, and blocklist listings that suggest your site is already being flagged to visitors.

Does it scan files on my server?

No. It checks what your site sends to visitors’ browsers, which is where injected JavaScript does its damage. It needs no plugin, login or server access, so it works on any platform.

My site looks normal. Can it still be infected?

Yes. Injected scripts are built to stay invisible: they run in the background, hide behind encoding, and often only activate on certain pages. A browser-based scan sees the code even when the page looks fine.

Is the malware scanner free?

Yes, a one-off scan is free with no registration. A free account rescans one site every week and emails you when a scan finds something, so a new infection is caught early.

Malware arrives after you scan

Most infections come through a plugin, a stolen admin login or a third-party script, long after you last checked. A free account rescans your site every week and emails you when a scan finds something.

  • Weekly automated scans
  • Email alerts on new findings
  • No credit card
Start free monitoring

More malware and threat tools

Card Skimming Scanner

Check your checkout for Magecart-style card skimmers.

Is My Site Compromised?

Run a full-spectrum compromise check for malware, skimmers and intrusion signs.

Blocklist Checker

Check if a domain is listed on spam, malware or phishing blocklists.

JavaScript Vulnerability Scanner

Detect outdated, vulnerable JavaScript libraries on any site, with CVE details.

Exposed Secret Scanner

Detect API keys and credentials leaking in front-end code.

Console Log Scanner

Detect JavaScript errors and security issues in the browser console.