Sneaky redirects
Visitors or people arriving from Google sent somewhere else, including redirects hidden in scripts or meta tags.
Free check
Is my website hacked?
Gmork loads your homepage as a visitor, as Googlebot, and as someone clicking from Google, and looks for the visible signs of a hack. Free, no signup, about 30 seconds.
- Public pages only, fetched like a visitor
- Not a vulnerability scan
- Cannot prove a site is clean
What the hacked check looks for
Hacked sites often look normal to their owners. These are the signs that show up for visitors and search engines instead.
Injected scripts
Scrambled or obfuscated JavaScript and scripts loaded from unfamiliar domains, the way card skimmers and malware work.
Hidden spam links
Blocks of pharmacy, casino or loan links hidden from people but visible to search engines.
Googlebot-only content
Spam words or links that appear when the page is fetched as Googlebot but not for a normal visitor.
Crypto-miners
Known in-browser mining scripts that use your visitors’ processors.
Strange frames
Invisible or off-screen iframes that load other sites inside your page.
Three views of the same page
Attackers often show their spam or redirect only to some visitors, so the owner never notices. The check requests your homepage three times and compares what comes back:
- As a visitor using a normal desktop browser.
- As Googlebot, the way Google’s crawler identifies itself.
- As a Google searcher, arriving with a Google referrer.
It also lists which recommended security headers the homepage sends. Those are hardening tips and never change the verdict. For the full header report, use the security headers checker.
What it cannot do
- It cannot see your server files, database, or admin area.
- It checks the homepage at one moment; some attacks target other pages or times.
- It does not test for vulnerabilities or try to break in.
A clean result means Gmork saw no visible warning signs. It is not a guarantee. If you have reason to worry, read how to tell if your website has been hacked for what to check next.
Hacked check questions
Is the website hacked check free?
Yes. The check at gmork.com/hacked-check is free and needs no account. To keep it fair it is limited to 5 checks per visitor every 15 minutes.
What does the hacked check look for?
It loads your homepage as a normal visitor, as Googlebot, and as someone arriving from a Google search, then looks for visible signs of a hack: sneaky or conditional redirects, injected or scrambled scripts, hidden spam links, crypto-miners, and unexpected frames. It also reports which recommended security headers are present.
Can the check prove my website is not hacked?
No. It only sees what is publicly visible on the homepage at that moment. Some attacks only show to certain visitors, on certain pages, or at certain times. A clean result means no visible warning signs were found, not that the site is guaranteed to be clean.
Does Gmork look for exposed files like .env or backups?
Only for domains that are verified in a Gmork account. Those checks report whether a sensitive file is readable, never its contents. The free public check never probes for files.
More questions? See the FAQ or everything Gmork watches.