Website Malware Scanner: How They Work & How to Pick One
A website malware scanner tells you whether your site is infected or exposed — but not all scanners work the same way, and the differences decide what they can actually find. This guide explains how website malware scanners work (remote vs on-disk, signatures vs heuristics) and how to pick one and scan for free.
Try one now: run a free MageArgus scan — version/CVE checks, headers, exposed files and skimmer signals in under a minute.
- Remote scanners see the storefront; on-disk scanners see the server — MageArgus
- The strongest tools combine signatures with behavioural heuristics — OWASP
Remote (black-box) scanners
These fetch your site from the outside and infer risk from what's visible: software version, headers, exposed files, and reachable malicious scripts. They're instant, need no install, and are perfect for a quick exposure check — but they can't read files or the database on the server, so cloaked or on-disk malware can hide from them.
On-disk (white-box) scanners
These run on the server (or via an installed module) and read every file plus the database. They're the only way to confirm webshells, injected templates, and database-level skimmers. Slower to set up, but definitive — essential after any suspected compromise.
Signatures vs heuristics
Signature detection matches known-bad strings and file hashes — fast and precise, but blind to novel malware. Heuristic/behavioural detection flags suspicious patterns (obfuscation, entropy spikes, code that hooks the checkout) even when it's never been seen before. Good scanners use both, so a fresh variant doesn't slip through.
How to choose
- For a fast, free exposure check: any reputable remote scanner — run one today.
- To prove a site is clean or clean up an incident: add an on-disk scan.
- For ongoing safety: schedule scans and add file-integrity monitoring (see how often to scan).
Platform-specific picks: Magento scanner tools.
Frequently asked questions
Can one scan guarantee my site is clean?
Only an on-disk scan can come close, because it reads the actual files and database. A remote scan is excellent for spotting exposure and reachable malware, but a clean remote result doesn't rule out a well-hidden backdoor — combine both for confidence.
Are free scanners trustworthy?
Reputable free remote scanners are safe — they only read your public pages and make no changes. Just avoid unknown tools that ask you to install code or hand over admin credentials without a clear reason.