View page as Googlebot: find the spam and redirects only Google gets
This Googlebot simulator fetches your page as Googlebot, as a normal visitor and as a visitor arriving from Google, and shows any injected text, spam links or redirects only some of them receive.
- Free, no account
- Results in under a minute
- Any public URL
Example result:example-shop.hr
WordPress 6.8Sample shop · homepage · mobile Chrome · the same check you get for your own site
The page, fetched three ways
differences are evidence, not a verdict| Signal | Normal visitor | Googlebot | Visitor from Google |
|---|---|---|---|
| Response | 200 | 200 | 200 |
| Final URL | example-shop.hr/ | example-shop.hr/ | example-shop.hr/ |
| Visible words | 354 | 354 | 354 |
| Visible words not on the visitor page | - | 0% | 0% |
| Links | 23 | 23 | 23 |
| Links the visitor page does not have | - | 0 | 0 |
| Hidden links | 0 | 0 | 0 |
| Spam vocabulary | none | none | none |
| Text in another script | none | none | none |
| Referrer redirect script | none | none | none |
What we found
Show 6 passed checks
Fix these first
From the example above. Check your own site to get the fixes that apply to it.
Problem: Sensitive files are readable by anyone
/.env holds database passwords and API keys; /.git exposes your source code and every secret ever committed.
How to fix it: Block dotfiles at the web server (nginx: location ~ /\. { deny all; }; Apache: RedirectMatch 404 /\..*$).
What the Googlebot view compares
Three copies of the same page, compared. Differences come with evidence, never a verdict: you decide what belongs there.
Cloaked content
Compares the page as visitors and Googlebot see it, since hidden differences can signal a hack.
Spam links
Looks for spam links or links shown only to Google, a common sign that someone injected them.
Redirects only for Google
Checks that visitors arriving from Google are not sent to another site that direct visitors never see.
Hidden outbound links
Finds links hidden from visitors but visible to search engines, a pattern injections use.
Google unsafe site flag
Checks whether Google lists the site as malware or phishing, which puts a red warning in browsers.
CMS version
Compares the CMS version your page reveals with the latest release, since old versions have known holes.
Plugins closed on wordpress.org
Flags detected plugins that wordpress.org has closed, often because of a security issue.
Abandoned plugins
Flags detected plugins with no update in over 2 years, which no longer get security fixes.
Exposed .env and .git files
Checks that files holding passwords, keys or source code can't be downloaded by anyone.
Directory listings
Checks folders don't show an automatic list of every file, including backups and settings.
Show 6 more checks
Google unsafe site flag
Checks whether Google lists the site as malware or phishing, which puts a red warning in browsers.
CMS version
Compares the CMS version your page reveals with the latest release, since old versions have known holes.
Plugins closed on wordpress.org
Flags detected plugins that wordpress.org has closed, often because of a security issue.
Abandoned plugins
Flags detected plugins with no update in over 2 years, which no longer get security fixes.
Exposed .env and .git files
Checks that files holding passwords, keys or source code can't be downloaded by anyone.
Directory listings
Checks folders don't show an automatic list of every file, including backups and settings.
How the hacked site and SEO spam checker works
Fetch the page three ways
The page is fetched with our normal user agent, with Googlebot's user agent, and with a browser user agent plus a Referer from google.com.
Compare the copies
The visible text, the outbound links and the inline scripts of the three copies are compared with each other.
Show the evidence
Text only Googlebot receives, spam or bot-only links, links in hidden containers, text in an unexpected script and redirects that fire only for Google visitors are listed.
One page per run. Some injections fire only on certain pages or at certain times, so a clean result here does not clear the whole site.
Hacked site and cloaking questions
How can I view a page as Googlebot?
Enter the URL above. We fetch it with Googlebot's user agent, as a normal visitor and as a visitor arriving from Google, and compare the visible words, links and scripts of the three copies. For your own verified site, URL Inspection in Search Console shows Google's real fetch. Ours works for any URL without a login, but from our server, so cloaking keyed to Google's IP addresses does not show.
Why check a page with a Google referrer?
Because some hacks redirect only visitors who arrive from a Google search, so an owner who types the address never sees it. The checker fetches the page a third time with a browser user agent and a Referer from google.com, and lists any redirect or content that appears only then. Casino and pharma redirects often work this way.
How do I check if my website is hacked?
Run this check on your home page and a few older posts, then read the evidence. Pharma, casino or loan links you did not add, text in a language you do not publish in, or a redirect to a site you do not own are injections. A different menu for mobile user agents is not. The result says differences found, never hacked, because some sites vary content on purpose.
Is this a website malware scanner?
No. It finds what hacks do to your pages from the outside: SEO spam, cloaking, hidden links and redirects that fire only for visitors from Google. It does not scan the files or database on your server, where the malware itself lives. After a positive result, ask your host for a server-side malware scan or restore a clean backup, then update everything.
What are the pharma hack and the Japanese keyword hack?
Two common SEO spam injections. The pharma hack adds links and text for drugs such as viagra, usually visible only to Googlebot. The Japanese keyword hack creates thousands of new pages in Japanese that sell counterfeit goods, and often adds itself to your sitemap and Search Console. Both show up here as spam vocabulary, text in another script or links only bots receive.
How do I remove the "This site may be hacked" warning?
Clean the site first: remove the injected content, close the way in by updating core, plugins and theme and changing every password, and check that this tool shows no differences. Then open the Security Issues report in Google Search Console and request a review. Google usually processes it within days, and the warning disappears once the site is confirmed clean.
It found nothing, but Google shows spam for my site. Why?
Some injections fire only on certain pages, such as old posts or category pages, or at certain times. Check the pages Google lists with spam in Search Console one by one, search Google for site:yourdomain.com with spam words such as casino, and look the site up on Google's Safe Browsing site status page.
Related free tools
All 59 tools →Free, funded by the people who use it
No account, no paid plan. Donations keep it running.