S
Stitex
Security

How to Check a Website for Malware Properly

Short answer: an online scanner only sees part of an infection from the outside — a reliable check runs on the server, across files, database and logs. Here are the signs of a compromise, where malicious code hides in WordPress and other CMS platforms, and what to do afterwards.

July 21, 20269 min readStitex Technologies

Signs your site is infected

  • Search results show someone else’s text instead of your pages — pharma, casino — or the site is flagged as dangerous,
  • Visitors get redirected elsewhere, especially on mobile,
  • Unknown files and admin accounts appear, timestamps on system files change,
  • Outbound traffic or load jumps sharply — the server is sending spam,
  • Your host emails you about malicious activity.

Where malicious code hides

LocationWhat to look for
CMS core filesmodified originals, stray .php files in system folders
Plugins and themesnulled versions, foreign code, obfuscated inserts (eval, base64)
Databasescripts inside content and options, new or unexpected administrators
Uploads directoryexecutable .php files sitting among the images
Logs and cronsuspicious requests, malicious scheduled jobs
Why an online scanner is not enough
A scanner on the outside sees symptoms — a redirect, an injection in search results — but not the malware itself inside your files and database. The infection lives on the server, which is where you have to look: file-integrity comparison, database inspection, log analysis.

How to check properly

  • Integrity comparison: diff core and plugin files against known-good versions — any difference is suspect,
  • Signature and heuristic scan: hunt for shell markers, encoded eval calls, backdoors,
  • Database check: new admins, injections in content and settings,
  • Log analysis: the entry point, attacking IPs, SQLi and RCE patterns,
  • Exposure check: readable .env and .git directories, backups left in the web root.

One frequent root cause deserves its own mention — pirated plugins. There is a separate write-up on why nulled plugins are dangerous and how to find them.

How ServerShield does it

Assembling all of this by hand is unrealistic for a business without a security team. ServerShield connects to the server over SSH in read-only mode and checks file integrity, malware, nulled plugins, rootkits, known CVEs and exposed secrets — on any CMS — then returns a report in plain language. You can run a scan from Pulse.

Frequently asked questions

Do online scanners find everything?

No. Public online scanners look at the site from outside and catch part of an infection — redirects, injections that show up in search results — but they cannot see malware sitting inside your files and database. A full check runs against the files and the database on the server itself.

Does my host’s antivirus not protect me?

Basic hosting antivirus catches known signatures but misses fresh backdoors, nulled plugins and modifications to the CMS core. That is why you need file-integrity checking and log analysis, not just a signature scan.

What should I do if the site is already hacked?

Do not wipe everything in a panic. Take a backup of the current state first for the investigation, find the entry point and every implant, clean them out, update the CMS and plugins, then rotate passwords and keys. Skip a step and the leftover backdoor gets you hacked again.

We will audit your server over SSH

ServerShield scans a server for malware, nulled plugins, rootkits, known vulnerabilities and exposed secrets — on any CMS. We will show you the report.