Website security scanner flagged our site as infected — real issue or false positive?

When verifying, don't just load the site from your own desktop browser. Attackers often configure redirects to trigger only for visitors coming from search engine referrers or mobile user agents. Send raw command-line requests to your server using different User-Agent and Referer headers to inspect the raw response body. That makes it way easier to spot obfuscated base64 strings or stealth external injections buried in the code.

Definitely don't just take your developer's word for it when they say "I looked and didn't see anything." Modern web attacks don't plaster hacker graphics all over your screen; they inject tiny snippets of JavaScript that run quietly in the background and skim credit card form data. If your dev doesn't specialize in security, it's super easy for them to overlook a single obfuscated line of code tucked inside a file.

We had a similar scare last year. An online scanner claimed our site was blacklisted, and we saw cleanup services quoting 800 dollars. When we dug deeper, it turned out the warning was triggered by an expired certificate on our live chat plugin. We paid a developer 40 dollars to update the script and sorted the whole thing out with zero extra costs.

The very first thing you need to do right now is log into your hosting control panel and download your backups from the past week to your local machine. Even if there is an infection, your developer could lose data while trying to clean it up. Once the backup is safe, update your CMS and all active plugins to their latest stable releases. Most of the time, patching a known vulnerability stops the injection in its tracks.

Exactly which file name or URL does the scanner report flag as malicious? Also, have you installed any new plugins, payment forms, or third-party marketing tracking scripts in the last two weeks? Those details are critical for figuring out whether it's a false positive or an actual breach.

Getting an alert from a customer is definitely stressful but dont panic. If Google Search Console isnt showing a red warning yet, your traffic wont tank immediately. Still, change your passwords without delay and comb through the files line by line with your developer. btw if you stay calm its something that can be resolved in half a day.

something similar happened to us the scanner literally mistook our analytics code for malware. don't panic and buy expensive security packages right away but check your server logs if there are no weird requests from foreign ips it's probably just a false alarm.

To sum up what's been said: without panicking, take a backup, check recently modified files, don't just rely on your developer's surface-level glance and check the server logs, and review external scripts before throwing money at expensive cleanup tools for no reason.

Following.

Sorry, but this doesn't apply in every case. If permission and scope aren't in writing, don't start that test.

If you post the result here, it will help others too.

My questions are cleared up, thanks.

Great work. The harder it is to reverse a decision, the slower you should make it.

I'm also curious if anyone does it differently.

I'm a small business, let me explain from my side. The real issue isn't the number, but what it's based on.

Don't rely on a single measure; go layer by layer.

You're right.

Here's how it went for us. An untested backup is not a backup.

If you post the result here, it will help others too.

Could you elaborate on that? I mean when making a decision, first look at what data you have on hand.

Don't rely on a single measure; go layer by layer. tbh if you post the result here, it will help others too.

i went throuhg the same thing two years ago. if permission and scope aren't in writing don't start that test.

of course, it varies if your situation is different.

Let me speak from the other side; I'm on the supplier side. The real issue isn't the number, but what it's based on.

Everything goes well for the first three months; problems arise in the fourth. That's all, sorry if I went on too long.