Is your website hacked? Know before Google, or your client, does.
IsHacked checks your sites from the outside, the way visitors and Google see them: cloaked spam, sneaky redirects, malware, PHP errors, expiring SSL and broken email. Try it free on any site, then monitor every client site daily.
Free, no sign-up, about a minute. Daily monitoring from $3/month for 10 sites: start monitoring.
What gets checked
Built from real hacked-WordPress cleanups: spam shown only to Google, ad loaders hidden from logged-in admins, a blank index.html served instead of the homepage. Plus the everyday failures that hurt just as much.
Hacks and malware
- Redirects only phones, Google visitors or one country see
- Malware signatures: NDSW, Balada, SocGholish, pop-under loaders, obfuscated eval
- New script, iframe and form domains
- Rogue WordPress users and hex-named fake plugins
- A dropped index.html replacing WordPress
- Exposed database dumps, wp-config backups, .env and .git
SEO spam and indexing
- Cloaking: what Googlebot sees versus visitors
- Casino, pharma and Japanese keyword spam
- Hidden links and spam anchors
- Injected or foreign sitemaps, sudden URL growth
- robots.txt tampering and surprise noindex
Uptime and errors
- Reachability from Germany, the US and the UK
- HTTP 5xx, PHP fatal errors and WordPress critical-error screens
- Database connection errors and stuck maintenance mode
- Suspended-account and default server pages
- Slow homepage responses
SSL, domain and DNS
- Certificate validity and expiry (alerts at 14 and 7 days)
- Domain registration expiry via RDAP
- Nameserver and MX changes (hijack signs)
- http to https redirect
Email deliverability
- SPF: present, single, within 10 lookups, no +all
- SPF and DKIM match the mailbox provider (Google Workspace, Microsoft 365, Zoho…)
- DMARC present and enforced
- Spamhaus domain and IP blocklists
Security hygiene
- Outdated WordPress core and end-of-life PHP
- Mixed content on https pages
- Version leaks, username enumeration, XML-RPC
- HSTS and clickjacking headers
Built for how you work
One account covers every client site, with the right level of detail for whoever reads the report.
Developers and freelancers
Raw response headers, HTML as Googlebot and as a phone, redirect chains, DNS, SPF and DMARC records, and the full JSON snapshot of every scan. A REST API and webhooks for your own tooling.
Agencies
Paste hundreds of URLs with client labels, see problems first, export to CSV, and route alerts to Slack, Discord or a shared inbox. Re-check every site after a deploy with one click.
Marketers and SEO
Know when Google is being served spam, the sitemap fills with junk URLs, robots.txt blocks crawlers, or a page goes noindex, before rankings drop.
Site owners
Plain-English alerts saying what's wrong and what to do next, an all-clear email when it's fixed, and a checklist of everything that passed.
How it works
- Enter your email and confirm it.
- Pick a plan and pay with Stripe.
- Paste your clients' URLs, one per line, with an optional label.
- The first report arrives in about a minute. After that you hear from us only when something changes.
Made for developers
Everything in the dashboard is available as JSON. Trigger checks from CI after a deploy, pull status into your own dashboard, or send alerts to Slack.
curl -X POST https://ishacked.com/api/v1/check-all \ -H "Authorization: Bearer ih_…" curl https://ishacked.com/api/v1/sites/<id> \ -H "Authorization: Bearer ih_…" | jq '.checks[] | select(.status != "pass")'
Priced at cost
Run by a Codeable expert. The plans cover the servers, VPN exits, email and card fees, plus a small margin. Every plan gets every check. Cancel any time.
Solo
- Up to 10 sites
- Every check, daily, from 3 countries
- 20 on-demand checks a day
- Email, Slack and webhook alerts
- API, raw data and CSV export
Pro Most popular
- Up to 50 sites
- Every check, daily, from 3 countries
- 60 on-demand checks a day
- Email, Slack and webhook alerts
- API, raw data and CSV export
Agency
- Up to 200 sites
- Every check, daily, from 3 countries
- 150 on-demand checks a day
- Email, Slack and webhook alerts
- API, raw data and CSV export
Questions
How do I know if my website is hacked?
Most hacked sites look normal to their owners. Compare what Googlebot sees with what you see, load the site as a phone visitor arriving from Google, search site:yourdomain.com for spam titles, and check the sitemap. IsHacked runs these checks for you, free once or daily with monitoring.
Do you need access to the site?
No. Everything is checked over public HTTP and DNS, as a visitor or search engine would see it. No plugin, no login, nothing to install.
Can it prove a site is clean?
No external scanner can. A backdoor that shows nothing to the public stays invisible from outside; in one recent cleanup a well-known external scanner reported a compromised site as clean. IsHacked catches the symptoms visitors and Google see. Pair it with a server-side scan of files and the database.
How much traffic does monitoring send?
About 50 requests per site per day: a few homepage loads, robots.txt, sitemaps, the WordPress REST index and a short list of files that should never be public, plus DNS lookups.
Can I run a check right away?
Yes, per site or for all sites at once. Each site can be checked on demand once every 10 minutes, within a daily allowance of 20, 60 or 150 checks depending on the plan. The daily checks don't count against it.
What if a firewall blocks the checks?
IsHacked falls back to its US and UK locations automatically. You can also allow the server IP 46.224.160.47 in the firewall.
What about false alarms?
The first scan learns what is normal for each site: its script sources, users and plugins. After that only changes are reported, and anything you mark as expected is never flagged again.
Who gets the alerts?
You, plus up to 5 extra addresses per account (a client, a colleague, a shared inbox), and optionally a Slack, Discord or custom webhook.
Guides from real cleanups
What hacks look like from outside, and how to find and remove them.
How to check if your website is hacked
12 practical tests to tell if a website or WordPress site is hacked: cloaked spam, mobile-only redirects, injected scripts and exposed files.
The Japanese keyword hack: detect it, remove it, keep it out
Google shows Japanese titles for your site? How the Japanese keyword hack works, how to confirm it, and how to clean WordPress and Search Console.
WordPress redirect hack: when only some visitors get sent to spam
Your WordPress site redirects visitors to spam, but not you? How mobile-only and Google-referrer redirects work and where the code hides.
SEO spam and cloaking: casino and pharma links only Google can see
Casino, slot or pharma titles in Google for your site? How SEO spam cloaking works, how to see what Googlebot sees, and how to clean it up.
SPF, DKIM and DMARC for WordPress sites: why your emails land in spam
Contact form emails landing in spam? SPF and the 10-lookup limit, DKIM for Google Workspace and Microsoft 365, and DMARC, with records to copy.
"There has been a critical error on this website": find the cause and fix it
What the WordPress critical error means, and how to find the plugin or theme behind it with recovery mode and the debug log. Plus related errors.
Start monitoring today
Enter your email and we'll send a link to confirm it. Then pick a plan and paste your sites.