How do I check whether a website is mining Monero on my device?

You can check for hidden mining by watching how much processing power a website uses, then seeing what changes when you close it. Heat, loud fans, and battery drain are warning signs, but they do not prove a site is mining Monero—video calls, games, and broken ads can cause the same symptoms.

Check the website’s processing use

On a laptop, start with your browser’s task manager, if it has one. This shows how much work each tab or extension is making your device do. In Chrome or Edge, look in the browser menu for Task Manager; on many desktop systems, Shift + Esc opens it.

Look at CPU usage. The CPU is your device’s main processor, and mining keeps it busy doing repeated calculations.

• Pause videos, animations, and other obvious activity.
• Leave the suspicious page open without touching it.
• Watch whether its CPU usage stays unusually high.
• Close that tab and check whether the load drops.

You can also use Task Manager on Windows or Activity Monitor on a Mac. These help you spot a busy browser, though the browser’s own tool is usually better for identifying a particular tab.

A repeated rise when you open one page, followed by a drop when you close it, is useful evidence. It still does not identify what the page is calculating.

On a phone or tablet, compare behavior

Mobile browsers usually do not offer a detailed, per-tab CPU display. Instead, look for a pattern:

• Your device gets warm while a simple page sits idle.
• Scrolling or switching apps becomes sluggish.
• Battery use rises during visits to that site.
• The behavior stops after you close the tab.

Check your device’s battery settings for browser usage. Android devices may also show app-level data usage. These figures cover the whole browser, not just the suspicious website, so treat them as clues rather than proof.

Keep screen brightness and other activity similar when comparing. Do not keep reopening a suspicious site if your device becomes very hot. Phones and tablets often limit background work, so a quiet device after switching apps does not rule out activity while the page was visible.

Look for stronger evidence of mining

If you are comfortable using desktop browser developer tools, inspect the page’s Network panel. It lists connections and files the page loads.

Mining code may show:

• Connections to a mining pool, a service that combines miners’ work, or an intermediary server.
• Repeated messages assigning calculation jobs and submitting results.
• Scripts mentioning mining software or mining algorithms.

A WebSocket, a persistent connection to a server, or WebAssembly, a format for running fast code in a browser, is not proof. Many legitimate websites use both.

Identifying Monero specifically is harder. Monero uses RandomX, a mining algorithm designed for CPUs. Old references to CryptoNight do not establish current Monero mining. A site could also mine something else and pay its operator in XMR. Strong confirmation requires identifiable mining code and job traffic, not just a hot processor.

The bottom line

Close a suspicious tab first. If the activity stops, avoid the site or block its JavaScript—the code that makes pages interactive—using browser settings or a trusted blocker.

If high usage continues after you fully quit the browser, check extensions, other apps, and run a reputable security scan. Avoid “mining detector” pop-ups that demand payment or downloads. Mining without your informed permission is a reason to leave, even if you cannot confirm which coin is involved.