Malware monitoring

A hacked website usually looks perfectly normal to the person who owns it. Behind the scenes it can be serving malware, spam or scam redirects to your visitors, and quietly wrecking your reputation with Google long before you notice anything is wrong. Malware monitoring checks your site against the same threat database Chrome uses, so you hear about a problem before your customers hit a red warning screen.

Why hacks stay hidden

Modern website hacks are built to go unnoticed. The attacker does not want the owner to know, so your homepage keeps looking exactly as it should while, in the background, the site quietly serves harmful content to real visitors, redirects people to scam pages, or injects spam that only search engines and outsiders ever see.

That is why owners are so often the last to find out. The first sign is usually a customer complaint, a warning label in Google's search results, or a sudden drop in visitors, by which point the damage is already done. Checking against Google's own threat list closes that gap: if Google has flagged you, you find out from us rather than from a furious customer.

How the check works

Twice a week TLDTrack checks each monitored domain against Google's threat lists and records the result. A first check also runs straight away when you switch the check on. The aim is simple: catch a flagged site soon after Google flags it, not after it has cost you rankings and reputation.

• We check the https address of your site.
• The result is a clear status: clean, or flagged with the type of threat Google found.
• If your domain becomes flagged, a critical alert fires straight away, warning that visitors may see a "deceptive site" warning in Chrome.
• If a previously flagged domain comes back clean, you get a "cleared" notice so you know the warning has lifted.

What you need before you start

• A domain added to TLDTrack. See Add your first website if you have not yet.
• The Malware check switched on for that site. It is a per-site toggle.
• Notification contacts set to hear about it, so a critical flag reaches a person quickly. See alerts and notifications.

What you will see, and what to do

On a site's Monitoring tab the malware check shows a clean status when nothing is flagged, and raises an alert when a check finds your domain on Google's list. If it flags something:

• Act quickly. A compromise gets worse and more visible the longer it sits, so treat a malware alert as urgent even if the site still looks fine to you.
• Clean the site. Get the site cleaned by your host or a specialist, then change the passwords and keys that might have leaked.
• Ask Google to review it. Once the site is clean, request a review through Google Search Console so the warning is lifted. The check will show clean again once Google agrees.
• Check your reputation. A hack and a blacklisting go hand in hand, so pair this with blacklist monitoring to see whether the compromise has already got your domain listed.

How to switch it on, step by step

1. 1
   Open the website from your Domains list.
2. 2
   Go to the Monitoring tab and switch on the Malware check.
3. 3
   Confirm your notification contacts so a critical flag reaches the right people fast.
4. 4
   That is it. A first check runs straight away and its result shows on the Monitoring tab. After that the check runs twice a week, and you only hear from it if your domain is flagged or later cleared.

For a deeper look

Malware monitoring watches for signs that a hack has already happened and been noticed by Google. If you want to find the weaknesses that let attackers in before they are exploited, run an on-demand security scan, which digs into your site's vulnerabilities in far more detail.

A hack and a blacklisting usually go hand in hand, so it is worth running blacklist monitoring alongside this check. To control where these warnings reach you, see alerts and notifications.

Where to set this up

Good to know

• The check runs twice a week against Google's threat lists, the same lists Chrome uses.
• The https version of your site is checked.
• A flag triggers a critical alert; a return to clean triggers a "cleared" notice.
• This finds a hack Google has already spotted. For the weaknesses that let one in, run a security scan.