Enter the address of a site you own or look after. The check fetches its home page and up to three linked pages the way a browser would, fetches the home page again the way Googlebot would, and looks for:
- blocks hidden from visitors that contain casino, pharmacy, loan or similar vocabulary
- that vocabulary in the page description that search engines show
- links whose text is that vocabulary
- obfuscated scripts of the kinds planted by intruders
- a difference between what a browser and Googlebot receive (cloaking)
- a public
.gitfolder,.envfile, phpinfo page or open uploads listing
What is kept
A log line with the date, the address and the number of findings. Nothing else is stored and nothing is sent to anyone. Each address can be checked once an hour, five checks an hour per visitor.
Only check sites you own or look after
The check makes a handful of ordinary page requests to the site, the same as a visitor would, but you should only run it on sites you are responsible for. Results for a site that is not yours are not something to act on or to share; the owner may not know, and telling them privately is the right first step.
Background
The same checks were used for the survey of 37,881 old Drupal sites that found planted spam on one site in 223. The report explains how the spam hides and why it lands on Drupal 7, 8 and 9.