Hacked-site symptom checker
Answer four questions. Get the files, tables and commands to check first.
Tell the checker what the site is doing, where it runs, how many sites share the account, and whether it has been cleaned before. It returns the places that symptom usually comes from, the read-only checks for each, and an honest estimate of how large the cleanup is likely to be.
Never send credentials, private keys, backup archives, or confidential source code through this website.
- Time
- About a minute
- Privacy
- Runs in your browser; your answers are not sent
- Output
- Where to look, read-only checks, and the likely scope
- Limits
- Points at the likely layers; only a review with access confirms them
What is the site doing?
How it works
Symptoms point at layers, not at files
The same visible symptom can come from very different places. A spam redirect can live in .htaccess, in an autoloaded database option, in a PHP startup directive, or in a plugin nobody installed. The checker maps each symptom you choose to the layers it most often comes from, in the order they are usually worth checking, with the read-only command or query for each.
The other three answers change the scope rather than the places to look. Several sites in one hosting account are one incident, because they share a filesystem identity. A server with root access can be checked above the web root, where the backdoors that survive site cleanups usually sit. And an infection that has come back once already means something persisted that the last cleanup did not reach.
Before you start
Three things to do before changing anything
- 01
Copy before you delete
Take a full copy of the files and the database, or ask the host for a snapshot. The first reaction to a hacked site often destroys the evidence that explains how it happened.
- 02
Change passwords from a clean device
Hosting panel, SFTP, database and WordPress administrators — from a computer that is not part of the problem, once you are ready to act on the cleanup.
- 03
Do not paste commands the site shows you
If the site asked you or a visitor to paste something into Run, a terminal or PowerShell, that is the attack. Do not run it.
Common questions
Questions about the symptom checker
Does the checker scan my site?
No. It works only from your answers and never contacts your site or any other server. It tells you where to look and what to run; the looking happens on your own hosting account or server.
Are the commands safe to run?
The checks it lists only read: they list files, print configuration and query the database without changing it. Removal steps are in the linked guides, after the step that preserves the evidence.
Why does the number of sites change the answer?
Sites under one hosting account run as the same system user, so a compromise of one can read and write the others. Cleaning one site while its neighbours stay infected is the most common reason a cleanup does not hold.
What does the scope estimate mean?
It is the kind of engagement the answers usually lead to — a single-site cleanup, a multi-site or server incident, or a persistence-led investigation — with the published price range where there is one. A written proposal after triage fixes the actual fee.