Free site security scanners gave three different results — which one should we trust?

The JavaScript alert flagged by the second tool is probably a conditional redirect mechanism. Malicious code usually stays hidden from logged-in admins and only triggers for visitors with a Google referer header. Pull the page source from the terminal using curl with different User-Agent and Referer values. Search the file for suspicious functions like eval, base64_decode, or document.write.

Before you panic, check two things right away: First log in to your Google Search Console dashboard and check the Security Issues tab; if Google detected a threat it will be clearly listed there. Second, check the date of your website's last clean backup. If the issue started a few days ago, diffing against a backup is the fastest way to spot it.

We ignored a similar warning last year because two scanners said it was clean. 48 hours later, our site got hit with a red screen block by the search engine. Our ads stopped running, and we lost about 4,200 dollars in revenue that week. External scanners giving a clean bill of health create a false sense of security; always prioritize the report that flags an infection.

The third scanner marking it as high risk just because of HTTP headers is a typical marketing gimmick. Many free tools blow missing security headers out of proportion making it look like your server is infected just to push their paid plugin. Don't confuse a missing configuration with an active malware infection.

edit: fixed a few typos.

definitely don't skip the external script warning imo. it's usually old forgotten hit counters or third-party chat pixels that get compromised and start injecting redirects. check between the head tags in the source code, any foreign domain will stick out like a sore thumb.

Is your site built on WordPress, or is it custom-coded from scratch? Also, is that suspicious JavaScript file hosted on your own server, or is it being pulled from an external host? If you can share these two details, it’ll be much easier to guide you.

To clear up the conflicting reports, follow these steps: 1) Save the full URL of the script file that the second scanner flagged. 2) Open the file's source code on the server and check for unauthorized redirect code. 3) Check its last modified date via FTP or your server control panel. 4) Leave the third tool's certificate and header warnings for later.

Don't let it get you down, false alarms or minor script injections happen on live e-commerce sites all the time. If you're hesitant to touch the code yourself, just open a ticket with your hosting provider's support team and share the log from the second scanner; they will run an internal server antivirus scan for free.

I went through the same thing two years ago. Start with a small trial; don't commit to everything at once.

I'm also curious if anyone does it differently.

i think it's hard to be that definitive about free site security scanner. people defend habits, not processes. resistance coems from there.

Do you think this works at any scale? Your time to detect an issue directly determines its cost.

Good luck with that.

We got stuck at the same point for a while. When you try to change everything at once, nothing settles.

Start with a small trial; don't commit to everything at once. This is my opinion, I'm not claiming it's absolute truth.

trhee different views emerged, they all complement each other. like if permission and scope arent in writing dont start that test.

if I were you I'd go this route.

Correct. The answer varies greatly by industry; there is no one-size-fits-all rule.

I'm also curious if anyone does it differently.

I completely agree. Forgotten test environments are more often the entry point than live systems.

I'm also curious if anyone does it differently.

I agree and I'd like to emphasize that. People defend habits not processes. Resistance comes from there.

Proven by experience.

My question might sound amateurish, sorry about that. Your time to detect an issue directly determines its cost.

When making decisions, write down the worst-case scenario too, not just the best. Just leaving this note, it might be useful.

I'm writing this so you don't make the same mistake. Don't hesitate to ask; those who don't ask always pay more.

That's all, sorry if I went on too long.