Here are some sites online where you can scan your WordPress output for malware (not a vulnerability scan) to see if there is any malicious code mixed in with the HTML of your site.
Sucuri SiteCheck
Sucuri SiteCheck is a fairly old site that allows online malware scanning.
You can scan any page by entering its URL.
The site pretends to be accessed from Google and scans for malware, so it can detect malware that only appears in Google search results.
Quttera
https://quttera.com/website-malware-scanner
Like Sucuri SiteCheck, Quttera allows you to scan for malware by entering the URL of any page. However, free malware scans are queued and performed in order, so it may take some time for the scan to complete.
WP Doctor Online Malware Scanner
https://malware-scan.website-malware-removal.com/
WP Doctor Online Malware Scanner is an online malware scanning site with malware detection patterns we have collected from over 1 million malware files.
You can scan for malware by file code, file upload, or URL.
Limitations of Online Malware Scanning
Online malware scans can only scan HTML and JAVASCRIPT code that is output as a site page. However, more than 99% of the malware that infects WordPress resides on the server as PHP programs that run on the server.
It is therefore important to note that online malware scans can only scan the results of malicious code generated by such malware.
Disadvantages of Online Malware Scanning
Since the malware itself is not scanned, even if it is detected, it is often not known where the malware itself is located.
Malware detection is limited (spam-sending malware and backdoors, which are malware that hackers use to gain entry into your computer, cannot be detected).
・Malware with various malicious code expression conditions, such as only when accessing a smartphone, or when accessing a site via a search engine, or when a site is accessed by a browser, are often undetectable.
Because of the above disadvantages, we believe that the detection accuracy of online malware scanners is strong against redirect hacks, etc., but is quite poor in detecting malware that infects servers as a whole.
For more accurate malware scanning, we recommend using a plug-in type malware scanner that can scan the WordPress program itself comprehensively from the inside.
Free WordPress:Malware Scanning & Security Plug-in [Malware & Virus Detection and Removal].
