Daniel Lasek · Last reviewed 2026-11-01

Is My Site Hacked?

A free Laskyr scan is a read-only look at the public URL you submit. It fetches pages over normal web ports and reports signs it can actually see, such as a redirect or spam on the homepage. It does not log in, and it does not see the database or unlinked files. A quiet result is not a certificate that the site is clean.

What does "is my site hacked" mean here?

It means the public site is doing something you did not intend. Visitors land on a spam page. A phone is redirected and a desktop is not. Google shows "This site may be hacked" or "Deceptive site ahead." The host suspends the account. A new administrator exists. Casino, pharma, or Japanese-keyword pages appear under your domain. Those are symptoms. The scan looks for the ones that show up in a public response. It does not name a person, and it does not prove which mistake let them in.

Common symptom notes, if you want the longer description of what you are seeing:

What does the free scan actually do?

You submit a URL. LaskyrScanner/1.0 requests it with a normal GET, on port 80 or 443 only. The user agent is identifiable on purpose. The bot does not pretend to be a browser, does not log in, does not post a form, and does not try exploits. Details for hosts are on the scanner page.

The report says what that public fetch showed. It can include a verdict banner and the findings that support it. A worked example of the layout, using the made-up host northwind-example.test, is the sample report. That example is fiction.

Read-only scan · No install · Results in about 30 seconds

What can an outside scan not see?

Anything that is not in the response. The database. Unlinked files. A PHP file sitting in uploads that no page loads. Server logs. Whether an SSH key you do not recognize is still installed. Whether a password was reused. Content that is shown only to some countries, only to phones, or only to Google's crawler and not to this bot. A blacklist state, when that check is even available, is a separate question and still not a full audit. See the blacklist checker.

So a scan can miss a real hack, and it can flag a public page that you then need to confirm before you delete anything. Do not treat the verdict as a reason to wipe the site. Take a backup first. The order of a real cleanup is in How to clean a hacked WordPress site.

What should you do with the result?

If the public page is clearly wrong, preserve a backup, change the email, host, and registrar passwords from a computer you trust, and do not delete random PHP. The first-hour kit is the short version of that.

If you want the repair done as one job, Emergency Cleanup is $499. You send one intake form and confirm you are allowed to authorize the work. You get the cleanup, a plain-English report of the cause we can support, hardening done during the job, a Google warning walkthrough, re-scans on day 1, day 7, and day 30, and the first month of Protection after the site is clean. If the same issue returns within 30 days, we clean it again at no charge. If we cannot clean it, the cleanup fee is refunded. "Hack-free in 24 hours" is a target once we have access, not a measured promise.

Protection is $19 a month or $190 a year per site. It is not the right product for a site that is already hacked. Buy the cleanup first. That rule is stated here so it is not a surprise at checkout.

Fix it now — $499 Talk to us by email

Questions

Does the free scan change my site?

No. It is a read-only fetch. It uses GET requests on ports 80 and 443, it does not log in, and it does not submit forms or send exploit payloads. The bot identifies itself as LaskyrScanner/1.0.

Can the result say nothing was found while the site is still hacked?

Yes. The scan only sees public responses. A compromise in the database, in a file nothing links to, or on a page that only some visitors are sent to can be invisible from the outside. Treat a quiet result as incomplete, not as a clean bill of health.

Do I need an account or an email?

You can submit a URL without turning that into a marketing subscription. An email is stored only if you choose to submit one. Scanning a URL is not consent to marketing email.

What should I do if the scan is not clean?

Do not delete the site or random PHP files before you have a backup. Use the emergency kit, or buy Emergency Cleanup for $499. Protection is not available as a substitute while the site is still hacked.