Malware and blocklist checks

Malware & blacklist works on the website picked in the header switcher. Open Dashboard → Malware & blacklist to see the blocklist status, the script inventory, open findings and the scan history.

Blocklist checks

• The domain and the IPv4 addresses it resolves to are looked up on public reputation lists that allow automated lookups, over DNS.
• Safe-browsing and malware URL checks are added where they are available.
• Each list shows listed, not listed or couldn't check. A list that can't be reached keeps its previous answer and never opens or closes a listing on its own.
• A listing closes on the next scan that gets a clean answer from that list, and a delisting alert is sent.

Script inventory

Each scan fetches your home page and the pages it links to (up to your plan's page allowance) with the SerpfullAuditor user agent, respecting robots.txt, and records every script: external scripts by address with a fingerprint of their contents, and inline scripts by fingerprint. Your opening scan becomes the baseline.

Findings

• New script domain: a script from a domain the site has never loaded before. It stays open until you approve or ignore the script.
• Obfuscated script: code built from long encoded strings, eval or Function chains and similar patterns. Minified code can trip this, so check before acting.
• Crypto-miner signature: code or addresses known from in-browser mining.
• Hidden iframe: an iframe from another site with no size or hidden by its styles.
• Script contents changed: a third-party script kept its address but its contents changed since the last scan.

Approve and ignore

Approve trusts a script and every script from the same domain, so new scripts from it no longer raise alerts. Ignore stops all alerts for that one script. Reset puts it back in the baseline.

Schedule and manual scans

Each website is scanned weekly by default. Choose daily (from Growth), weekly or off on the Malware & blacklist page, and press Scan now after a change. Manual scans have a daily allowance and a 15-minute pause between them.

Limits

• Pages scanned for scripts per scan: Starter 5, Growth 15, Scale 40, Pro 150, Enterprise 500.
• Manual scans per day: 1, 3, 6, 12 and 24.
• Scan history and resolved findings kept: 30, 90, 180, 365 and 730 days.

Alerts and webhooks

malware.scan.completed (every finished scan, with counts), malware.issue.new (new findings, with up to 50 of them) and malware.listing.cleared (lists that no longer list the site). Use them as Workflow triggers or add them in Integrations → Webhooks. New findings and delistings also reach the notification bell unless you switch alerts off for the site.