Free hacked check · no email
Does your site act differently for Google?
Some hacks hide from the owner. You type your address and the site looks fine, but people who click through from Google land on a casino or a pill shop. Paste your address and we'll visit your homepage the way they do.
- 01
Typed in
A normal browser, no referrer. Roughly what you see.
- 02
From Google
Same browser, arriving from a Google search. Where the redirects usually live.
- 03
As Googlebot
Google's crawler. Spam pages often show up here first.
Pop your email in and we'll run the full scan on this site as well. It covers plugins, SSL, speed and email records, and the report shows up in your inbox in about a minute.
Want to look yourself first? Read why sites redirect to spam only from Google and how to remove malware from WordPress.
What we flag
Three things the hack can't fully hide.
Each finding comes with the evidence, so you can check it yourself.
A different destination
The Google or Googlebot visit ends up on another domain, or takes an off-site redirect your own visit didn't. We list every hop.
Words you never wrote
Think pill names or slot sites, fake watches or payday loans, maybe a wall of Japanese text. We flag them when only Google sees them, or when they've crept into your homepage title.
Extra JavaScript
Scripts from outside hosts that only the Google versions load. Sometimes that's a harmless ad tool. Sometimes it's the thing doing the redirect.
What a clean result means
It means these three homepage visits matched and nothing on our list showed up. It doesn't prove there's no malware. Hacks can target phones, certain countries, deeper pages or one visit per person, and nothing on your server is visible from out here.
Questions
How do I check if my site redirects to spam only from Google?
Paste your address above. We load your homepage three times: typed in directly, as a click from a Google search, and as Googlebot. If the Google versions land somewhere else, show spam words or load extra scripts, you'll see it with the evidence. Doing it by hand means a phone off Wi-Fi, a private tab and tapping your own Google result.
Why does my site look fine to me but redirect for customers?
Because the code is built that way. It checks where each visitor came from, and only sends people from Google (or phones, or first-time visitors) to the spam site. You type the address in and you're logged in, so it leaves you alone.
Does a clean result mean my site isn't hacked?
No. It means these three homepage visits looked the same and showed nothing from our spam list. Some hacks only hit phones, certain countries, deeper pages or one visit per person. If Google or a customer says something's off, keep digging.
What should I do if the check finds something?
Don't start deleting things yet. Take screenshots, change your WordPress and hosting passwords, and find where the code lives before you clean it. Our guide to removing malware from WordPress walks through it, or run the full scan and we'll take a look.
More free checks: WordPress plugin check, check all pages and the rest on the free tools page.