How to Scan a WordPress Site for Malware for Free (Sucuri SiteCheck, VirusTotal)

A free WordPress malware scan is the first thing you should run when you suspect your site has been compromised: strange redirects, spam pop-ups, or a message from Google saying the page “may harm your computer”. The good news is that you don’t need server access or any installed plugins to get a first verdict. Two external tools, Sucuri SiteCheck and VirusTotal, tell you within seconds whether something is visibly wrong.

Below I show you exactly how to use them, what the results mean, and — just as important — what they cannot detect.

Why you start with an external scan

An external scanner “sees” your site exactly like a visitor or Google’s crawler: it loads the public pages and looks for injected code, redirects, and spam links. It’s fast, needs no login, and can’t be fooled by a compromised security plugin running on the server itself.

The limit is just as clear: it only sees what’s public. A backdoor hidden in a PHP file that doesn’t run on every visit can stay invisible. That’s why an external scan is the starting point, not the conclusion.

Sucuri SiteCheck — the simplest free WordPress malware scan

Sucuri SiteCheck is a free online scanner. You visit their site, enter your address (for example https://your-site.com) and click “Scan Website”. Within seconds you get a report covering:

• Detected malware — injected code, hidden iframes, suspicious JavaScript;
• Blacklist status — whether you appear on Google Safe Browsing, McAfee, Yandex and others;
• Injected spam — links to pharmacies, casinos, or pages that aren’t yours;
• Version anomalies — flags when WordPress or its components look outdated.

A green report is a good sign, but not a guarantee. If it turns red, write down every flagged file and URL: you’ll need them for cleanup.

VirusTotal — a second opinion from dozens of engines

VirusTotal aggregates over 70 antivirus engines and reputation services. You give it the site URL, and it tells you how many engines consider it clean and how many flag it as dangerous.

The big advantage is diversity. A single scanner may miss something; when several engines flag the same page, you have a serious signal. Use VirusTotal as a cross-check for the Sucuri result — if both come back clean, you’re on much safer ground.

How to read the results correctly

Don’t panic at the first warning, and don’t relax at the first “green”. A few practical rules:

• A clean result means “nothing visible now”, not “100% safe site”.
• An isolated warning from one obscure engine may be a false positive — confirm with the second scanner.
• Redirects that appear only on mobile or only from Google are typical of malware — test under those conditions too.

Google explains in its official documentation how it detects and flags compromised sites — a useful guide if you want to understand exactly what the crawler sees.

What to do once you find something

External scanners tell you that you’re infected, but rarely what exactly and where. Real cleanup requires access to the files and database: you compare core files against the official ones on wordpress.org, look for recently modified PHP files, check for unknown admin users, and replace any injected code.

If that sounds like a lot, it is. A proper WordPress malware removal also means eliminating backdoors, not just deleting the visible code — otherwise the infection returns within days. And if you just want to know where you stand before deciding anything, a free audit gives you a clear picture of your security state.

Conclusion

Sucuri SiteCheck and VirusTotal are the fastest tools for a first free WordPress malware scan: you run them in two minutes, with nothing installed, and learn whether your site is publicly flagged. Keep in mind they scan the surface — for a complete verdict you need a file-level and database-level check. Run them regularly, even when everything looks fine: the best time to catch an infection is before your visitors and Google see it.