Purlock
Free tool · Website malware check

Was your website hacked?

Hacks often hide from the owner, showing spam only to search engines, or redirects only to phones arriving from Google. We read your page all three ways and compare them.

Try:

Free, with no account needed.

What it checks

What you get from the website malware check

  • Three views

    A visitor, a search engine and a phone from Google. Hacks often only show themselves to the last two.

  • Hidden spam

    Links people can't see but search engines can, and casino or pharmacy spam added to your pages.

  • Injected scripts

    Crypto miners, code written to hide what it does, and scripts from listed sites.

  • Secret redirects

    Visitors from Google sent somewhere else, while you see your site as normal.

  • Your blocklist status

    Whether your own domain is on the phishing lists we use.

  • New script alerts

    A monitor lists every outside script, and tells you the day a new one appears.

For developers

Three lines from your own code

Every tool is also an API, with one simple answer format. Keep your key on your server.

JavaScript

const res = await fetch("https://www.purlock.com/v1/tools/website-malware-check?target=example.com", {
  headers: { authorization: `Bearer ${process.env.PURLOCK_API_KEY}` },
});
const report = await res.json();

Prompt for Cursor or Lovable

Add a call to the Purlock Website malware check API on the server side of this app. Send GET https://www.purlock.com/v1/tools/website-malware-check?target=VALUE with the header "Authorization: Bearer" and the PURLOCK_API_KEY environment variable. The JSON answer has status ("good", "attention" or "bad"), headline, checks (each with level, title, detail, fix) and data. If the call fails or times out after 3 seconds, carry on as if it wasn't there. Never put the API key in client code.

Free plan: 100 calls a month. Individual: 5,000. Business: 25,000.

FAQ

Questions, answered

How can I tell if my website has been hacked?
Common signs are spam in your Google results, redirects you can't reproduce, hosting warnings and unknown scripts. This check looks for those from the outside. Hacks can hide from checks like this, so finding nothing isn't proof your site is clean.
Why can't I see the hack on my own site?
Many hacks only show themselves to search engines or to people clicking through from Google. When you type your own address, everything looks fine. That's why we look all three ways.
Do you scan my server's files?
No. We only read what your site sends out, the same way anyone can. To scan files on your server, you'd need a tool installed on it, or your host's help.
What do I do if it finds something?
Change your hosting and admin passwords, update your software and plugins, and look for files and accounts you don't recognize. If you can, restore a clean backup. Your host can often help.

More free tools

Use it from your own code

Get a free API key with 100 calls a month. No card needed.

Get your API key