What Sucuri SiteCheck measures
The scanner loads your pages, looks for known malware signatures, injected spam links, defacement and suspicious redirects, checks your blocklist status with several vendors, and notes outdated software it can detect from the page.
How to read your result
A clean result is good news but not proof, because SiteCheck can only see what is publicly visible. Malware hiding in server files or in the database will not appear here. Blocklist warnings matter most, because they are what stops visitors and email from getting through.
What to change first
If anything is flagged, change every password before you start cleaning: hosting, database, admin users and FTP. Cleaning files while an attacker still holds a valid login just gets you reinfected.
Common questions
- Is Sucuri SiteCheck free?
- The remote scan is free. Deeper server side scanning and cleanup are paid services.
- My site scans clean but behaves strangely. What now?
- A remote scan only sees public pages. Check file modification dates, admin accounts and scheduled tasks on the server itself.
Related tests
Run this alongside every other test in Website Security Checks, or start from the full list of website testing tools.