Google shows “This site may be hacked” when it believes someone has changed your pages or added spam pages to your site. To remove it, you have to find and clean every hacked page, close the hole the attacker used, then request a review in Google Search Console. Google lifts the warning once it confirms the site is clean, which usually takes a few days to a few weeks.
Key takeaways
- The warning won’t go away on its own. Google removes it only after you fix the site and ask for a review.
- Clean the whole site, not just the sample pages Google lists. Partial clean-ups fail review.
- Find the way in (an old plugin, a stolen password) or the hack will come back.
- Request the review once, when everything is fixed. Early or repeated requests slow things down.
What does “This site may be hacked” mean?
It’s a label Google adds under your listing in search results. According to Google Search Help, it appears when Google believes a hacker has changed existing pages on the site or added new spam pages. Google also warns that visitors could be redirected to spam or malware.
The effect on your business is immediate. Most people won’t click a result that says it may be hacked, so traffic and enquiries drop the day the label appears.
Is it the same as the red “Deceptive site ahead” screen?
No. The red full-screen warning comes from Google Safe Browsing, which flags malware and phishing. Safe Browsing protects “over five billion devices every day” (Google Safe Browsing). The “may be hacked” label usually means spam content instead. Both are fixed the same way: clean up, then request a review.
Why did Google flag my site?
Most often, an attacker got in through an out-of-date plugin, theme or WordPress install, or through a reused password. They then add pages selling pills, fake designer goods or gambling, or inject links into your existing pages. A common version is the Japanese keyword hack, which fills Google with thousands of spam pages under your domain.
These hacks are often hidden from you. Many show the spam only to Googlebot or to visitors who arrive from a search, so your home page looks normal when you type the address in. That’s why owners are often the last to know. Other hacks use your server to send email, which is covered in our guide to a website sending spam emails.
How do I remove the “This site may be hacked” warning?
Work through these steps in order. Skipping ahead to the review request is the most common mistake.
- Take a backup first. Copy the site’s files and database as they are now, even though they’re infected. It gives you evidence and a fallback if the clean-up goes wrong.
- Open the Security Issues report. Verify your site in Google Search Console if you haven’t, then open Security & Manual Actions, then Security issues. It lists the issue type and sample affected URLs.
- Change every password. That means WordPress admin users, hosting, FTP or SFTP, the database and your email. Delete any admin users you don’t recognise.
- Clean the whole site. Remove spam pages, injected code, unknown files and backdoors. Replace WordPress core, plugins and themes with fresh copies from trusted sources.
- Close the way in. Update or remove the vulnerable plugin or theme, and remove anything you don’t use.
- Check what Google sees. Search site:yourdomain.com.au for spam titles, and use URL Inspection in Search Console on the sample URLs.
- Request a review. In the Security issues report, select Request Review and explain what happened and what you fixed.
Why do so many clean-ups fail?
Because the visible spam is only part of the hack. Sucuri found backdoors on 49% of compromised sites, and malicious admin users in 55% of infected databases (Sucuri). Delete the spam pages but miss the backdoor, and the attacker puts them back within days. Our article on what a proper malware removal service includes explains what cheap clean-ups skip.
Google’s own report makes the same point. It says the sample URLs may not be the full list, and that fixing only some pages won’t restore your search visibility (Search Console Help).
What should I write in the review request?
Keep it factual. Google asks you to explain the exact issue, describe the steps you took to fix it and document the outcome. A good request covers:
- what was wrong (for example, spam pages added under /shop/ and a hidden admin user)
- how the attacker got in, if you found it (for example, an out-of-date form plugin)
- what you removed, updated and changed, including passwords
- what you’ve put in place so it doesn’t happen again
Google emails you when it receives the request and again when the review is finished.
How long does it take Google to remove the warning?
Google says a review “can take from a few days to a few weeks to complete”, according to its Security issues report help. Once the review passes, Google removes the label. Old spam pages can still show in results for a while, until Google recrawls them and drops them.
Don’t send a second request while one is pending. Google warns that asking before the issue is fixed can slow your next review or get you marked as a repeat offender. Under Google’s Safe Browsing repeat offenders policy, that blocks further review requests for 30 days.
How do I stop it happening again?
These hacks usually follow months of skipped updates. To keep the site clean:
- apply plugin, theme and WordPress updates promptly, especially security fixes
- use strong, unique passwords and two-factor login for every admin
- remove plugins and themes you don’t use
- keep off-site backups so a clean copy is always available
- scan for malware daily so a hack is caught before Google finds it
Hosting matters too. Secure web hosting with a firewall, account isolation and malware scanning blocks many attacks before they reach WordPress.
That’s the job our website maintenance plans do every day. If your site is already compromised, we start with our hacked website repair, then keep it protected. On Maintain & Protect, the one-off setup fee doubles for a site that’s already hacked (for example, $240 + GST instead of $120 on Essentials), because it includes the full clean-up. After that, the site is covered by our hack-free or we fix it free promise.
Frequently asked questions
Will the “This site may be hacked” warning go away by itself?
No. Google keeps the label until the site owner cleans the site and requests a review in Search Console. Even after you clean up, it stays until Google confirms the fix. If you don’t have Search Console set up, verifying your site is the first job.
Does the hacked warning hurt my SEO?
Yes, mainly through lost clicks. Few people will click a result labelled as hacked. Spam pages can also compete with your real pages in results. Once the site is clean and the label is lifted, rankings generally recover as Google recrawls the site.
Can I just restore an old backup?
Sometimes, if you can prove the backup predates the hack. But the hole the attacker used will still be there, so you must update or remove the vulnerable software and change passwords too. Otherwise the site is likely to be reinfected quickly.
Google says my site is hacked, but it looks fine. Is it a mistake?
Rarely. Many hacks show spam only to Googlebot or to visitors arriving from search. Check the sample URLs in Search Console, search site:yourdomain.com.au and use URL Inspection to see the page as Google sees it.
What if my review request is rejected?
Google found hacked content that’s still there. Check the report again for new sample URLs, look for backdoors and hidden admin users, and clean again. Only request another review when you’re confident the whole site is clean.
Sources
- “This site may be hacked” message, Google Search Help
- Security issues report, Search Console Help, Google
- Google Safe Browsing Repeat Offenders Policy, Google Search Central
- Google Safe Browsing, Google
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024