Think Your WordPress
Site Has Been Hacked?

Our free scanner checks every single file in your webspace against 14 years of real-world attack data. Find out exactly what's wrong, and where, in minutes.

Scan Your Site Now

No credit cardResults in minutesFile-level scanning

Hacked right now? See the whole plan, from the free audit to cleaning it yourself

90,000+

sites monitored

Since 2012

building threat data

1,000,000+

audits completed

Warning signs your WordPress site is hacked

Attackers work hard to stay hidden. Many hacked sites look and work perfectly for the owner while doing damage in the background.

Warning signs of a hacked WordPress site, where you see each, and what is happening
Sign	Where you see it	What is happening
Visitors are being redirected	Visitor reports, while the site opens fine for you	Logged-out visitors sent to spam, pharma or porn sites
Google shows a warning page	Search Console or Safe Browsing	Google has flagged your site
Unknown admin accounts appeared	Your WordPress users	Attackers keeping persistent access
Your site is sending spam	A host suspension, or spam reaching your contacts	A backdoor script sending bulk mail from your server
Strange content in search results	Google results for pages you never created	SEO spam injection
Your host suspended your account	A notice from your host, perhaps listing infected files	Your host found malware and took the site offline

The redirects only hit logged-out visitors because the hackers detect admin cookies. Google's warning reads "This site may be hacked" or "Deceptive site ahead", and on its own it can wipe out your organic traffic overnight. The extra admin accounts keep attackers in even after you update passwords. The search-result junk is Japanese keywords, pharmacy links or casino text, a classic SEO spam injection that does serious damage to your rankings. And if your host has sent a list of infected files, cleaning those without knowing the entry point means you will be reinfected within days.

The longer malware sits on your server, the more damage it does to your SEO, reputation, and users.

Scan Your Site Now

How mySites.guru detects hacks other scanners miss

Most online "malware scanners" visit your homepage and check public-facing pages for obvious signs. That catches a fraction of real threats. Attackers don't leave malware on your homepage - they hide it in inactive plugin directories, uploaded files, and modified core files deep inside your /wp-content/ folder.

Our scanner connects directly to your server through a lightweight plugin and reads every single file, not just what visitors see. Each file is checked against a threat database refined over 14 years and more than a million real-world audits.

File-level scanning of your entire webspace, including hidden and inactive directories
Signature matching against known malware families, webshells, and backdoors
Heuristic detection of obfuscated PHP designed to evade simple scanners
WordPress-aware: knows exactly which files should and shouldn't exist
14 years of threat intelligence from monitoring real sites under attack

Surface scanners

Check your homepage URL for Google blocklist status and obvious malware snippets in HTML. Miss everything hidden in files.

mySites.guru

Reads every file on your server, including files in inactive plugins, uploaded media, and obscure temp directories attackers rely on for hiding backdoors.

"I'd run two other scanners that found nothing. mySites.guru found a backdoor sitting in a directory from a plugin I'd deleted three years ago."

- Agency owner, UK

How it works

From sign-up to scan results in under five minutes. No technical knowledge needed.

Connect your site

Sign up free and install the lightweight connector plugin on your WordPress site. No FTP, no server access, no configuration. Just install and click Connect.

We scan every file

Our engine reads every file in your webspace and checks each one against our threat database: malware signatures, known backdoor patterns, obfuscated code, and file integrity checks.

See what was found

Results appear in your dashboard in real time. Every infected or suspicious file is listed with an explanation of the threat, the file path, and tools to investigate further.

Scan Your Site Now

One free audit of one site · no card · about 2 minutes to connect

What the scan looks for

Every layer of your site's security, including the things surface scanners miss.

Malware and backdoors are webshells, file uploaders, remote-execution scripts and obfuscated PHP that give attackers persistent server access.
SEO spam injections are hidden links, Japanese keyword attacks, pharma hacks and casino spam buried in your pages, wrecking your search rankings with no visible sign.
Modified core files are WordPress core files altered to add malicious code; they pass a visual inspection but contain injections that run on every page load.
Redirect scripts send visitors to malicious sites based on referrer, user agent or login status, invisible to you and damaging to everyone else.
Vulnerable plugins and themes are how most WordPress sites get hacked, because outdated software has known CVEs, so we check every plugin and theme version against the vulnerability database.
Unauthorised files have no business being on your server: uploaded PHP scripts in your media directory, leftover attack tools, and files placed by attackers between visits.

Why cleaned sites keep getting reinfected

The single biggest mistake after a WordPress hack is to remove the files your host flagged and assume the problem is solved. It isn't.

Attackers usually leave several backdoors, in different locations, with different names, often encoded to evade basic scanners. And the vulnerability that let them in (an outdated plugin, a weak password, an exposed configuration file) is still sitting there waiting to be used again.

A proper recovery means finding every infected file, identifying the entry point, and closing it. That's what mySites.guru helps you do, starting with a complete file-level scan that shows you the full picture.

Common reasons sites get reinfected

Entry point (vulnerable plugin or theme) was never patched
Secondary backdoors left in place after partial clean
Compromised hosting account password not changed
Malware in a backup restored during the clean
Another site on the same hosting account left infected

What a full scan gives you

Every infected file listed with the exact threat detected
Vulnerable software versions flagged with CVE references
File integrity check across all WordPress core files
Unexpected files in sensitive directories highlighted
Configuration issues that leave your site exposed

See exactly what's on your server.

One free audit of one site · no card · about 2 minutes to connect

Scan Your Site Now

Common questions

How long does the security scan take?

Setup takes about two minutes: install a lightweight connector plugin and connect your site to the dashboard. The first scan typically completes within a few minutes. Larger sites with tens of thousands of files may take a little longer, but you'll see results appearing in real time.

What happens if a hack is found?

You get full access to the audit results in our dashboard, which shows exactly which files are infected, what threat was detected, and where. From there you can use our hundreds of diagnostic tools to investigate further. For ongoing monitoring and cleanup assistance, paid plans start from £19.99/month. If you'd rather hand it off entirely, fix.mysites.guru offers same-day expert remediation at a flat rate.

Do I need technical knowledge to use mySites.guru?

No. You install a plugin (the same way you install any WordPress plugin), click Connect, and the scan runs automatically. You don't need FTP access, server knowledge, or coding skills. The results are presented clearly with explanations of what each finding means.

Is the scan really free? What's the catch?

The scan is free. No credit card, no trial period that auto-charges, no catch. You get full access to the audit results and the complete toolset for your first site at no cost. If you want ongoing automated monitoring across multiple sites, that's where paid plans come in.

My host already cleaned the site. Do I still need a scan?

Yes. Hosting companies remove the files they find, but they rarely identify how the attacker got in. Without closing the entry point (an outdated plugin, a compromised password, a misconfigured permission), you will be reinfected. Our scan checks for both the malware and the vulnerabilities that allowed access.

Will the scan affect my live site or slow it down?

No. The scanner reads files server-side through the connector plugin and does not modify anything on your site. Your visitors will not notice any difference. The connector is designed to run with minimal server load.

Learn more

Is my site actually hacked?

How to tell the difference between a hack and a false alarm.

Free site audit

Run a full security audit on your WordPress or Joomla site for free.

All features

See everything mySites.guru can do beyond the initial scan.

Pricing

Ongoing monitoring plans for agencies, freelancers, and site owners.

What our users say about security

“I love both the mass component update feature and the individual site diagnostics and the fact that with the zero day hacks that have been coming at us this week Phil has been on top of his game with directions and fixes! Without mysites I don't know where we would have been - Thanks Phil”

Lindy WinemanAbadata Computer Corporation

“Phil is amazing! Had a real issue migrating a multisite WordPress website. [I] lost the data in the process of removing the multisite - [Phil] restored and ready for migration within a few hours. Honestly cannot recommend Phil enough - you're an absolute life saver! Thank you!”