Do Free Website Malware Scanners Really Work?

You need to know that your site is free of malware and other hacked files. But can you trust a free scanner to get it right? See my test results of the top 6 popular malware scanners and what they detected on a known hacked site.

The Test Site

During a site migration, the HackAlert service found multiple files on the site being moved.

HackAlert is a paid service used by some hosts to verify sites are clean prior to placing them on their servers.

6Scan is another such service used by hosts.

Both services, and others, are usually made available to their hosting clients for free or at a significantly reduced cost.

Free Scanners Tested

I scanned the hacked site on the following free, online scanners:

• Sucuri SiteCheck
• SiteGuarding
• Web Inspector
• Quttera

How They Performed

Sucuri

The Sucuri scanner did not detect any problems. But, they did want to sell me a firewall service, which you can see at the bottom of the list.

Site Guarding

The SiteGuarding scanner also did not detect any issues. And, they also wanted to sell me site protection services, which you can see a link for at the bottom.

Web Inspector

The WebInspector scanner also did not detect any malicious files. But, it didn’t try to sell me any services either.

Quttera

The Quettera scan detected 5 malicious files. There were actually many more. The other tabs at the top only provided another filtering of the numbers shown on this first screen.

It did not display what files were infected. It did offer to sell me its clean up service.

My Opinion

This was an informal test. And it just used free, online scanners.

Some security or other scanning plugins may give different or better results. But, I’d want to test them on a known hacked site to be sure of that.

Also note that some security scanners only check for file changes, not for actual malware. Those are two different things. I hear that some plugins are way better than others at file monitoring. Some can give you a ton of false positives to wade through daily. That’s not very helpful.

And note that some online scanners only check for site reputation, meaning they check to see if a site has ever been blacklisted. That’s not the same thing as actively checking for malware either.

I’m 100% positive that many of the paid scanning services offered at the hosting level will detect, and list more than these free scanners. Note that I said “many” and not “all”. Some of those services aren’t worth a dime either. SiteLock is one that comes to mind.

And, those host-level scanners are not fool proof either. Most of them only check a limited number of random pages.

The point is, if all you rely on are free online scanners, then your site could be infected and you’ll never know it.

How to Protect Yourself

First, keep everything on your site up to date, especially plugins. And protect your login from brute force attacks. Those are the top two ways hackers install malicious code on your site.

Second, if your hosting service offers free or inexpensive scanning solutions, take advantage of them. It’s likely you’ll need to do this manually, so set up a quarterly schedule for it.

Third, scan your site using Quttera or scanner of your choice on a quarterly basis as well. All of the scanners are going to check for different things, and different pages. Don’t rely on just one scan.

Fourth, maybe consider a file monitoring plugin or service. I haven’t tested them myself, and I hear all manner of reports on whether they are effective or a time suck. So, I invite you to do your own tests and see what you think of the service yourself.

Get a Site Audit

A manual audit is going to find all manner of junk in your site and clean it out.

It’s not fool proof for detecting all malicious files, but it will find way more than most scanners.

And, it will definitely be better than scanners at detecting the sources of the security holes and in closing them.