How to Remove a ‘This Site May Be Hacked’ Warning in Google

Google removes a 'This site may be hacked' warning only after three things happen. The malicious content is gone, the backdoors and entry point are closed, and you pass a review in Google Search Console. Cleanup usually takes hours to a few days, and the review adds a few days to several weeks. Doing things in the right order determines how long your traffic stays down.

How do I remove the 'This site may be hacked' warning?

You remove it in three steps. First, clean every trace of the compromise. Second, close the hole the attacker used. Third, ask Google to recheck the site from the Security issues report in Google Search Console. No setting hides the warning, and scanning on your side clears nothing. Google has to crawl the site and agree it is clean.

The full sequence:

1. Read the Security issues and Manual Actions reports in Search Console and note every sample URL.
2. Take a full backup or hosting snapshot of the infected site for evidence and rollback.
3. Find how the attacker got in: a vulnerable plugin, a stolen password, an upload form or the server itself.
4. Clean the files and the database, including hidden admin users and scheduled tasks.
5. Patch or remove the vulnerable software and rotate every credential.
6. Verify with more than one scanner and check what Googlebot actually sees.
7. Request a review, once, with a specific account of what you fixed.

If you skip step 3 or step 5, expect to repeat all of this within a week.

Where does the warning appear today, and is it real?

The warning means Google’s automated systems found evidence that someone other than you controls part of your site. Those systems are the Safe Browsing classifiers and Googlebot’s crawl analysis. The evidence can be injected spam pages, hidden outbound links, cloaked redirects, malware or phishing pages. No human reviewer flagged you.

The literal ‘This site may be hacked’ label is largely historical. Google reportedly retired it from search result snippets around 2016-2017. Today the same compromise surfaces in up to three places, each with its own fix. Check all of them.

Where it appears	Who sees it	What it does	What clears it
Safe Browsing page: ‘Deceptive site ahead’ or ‘This site may harm your computer’	Visitors in Chrome, Firefox, Safari and other browsers that use Safe Browsing	Blocks the visit with a full-screen warning	Clean site, then a Security issues review
Security issues report	Verified Search Console owners	Lists the issue type (hacked content, malware, deceptive pages, unwanted software) and sample URLs	‘Request a review’ in that report
‘Hacked content’ manual action*	Verified Search Console owners	Demotes pages or removes them from results	A separate review in the Manual Actions report

*Do not confuse this with the ‘Pure spam’ manual action. Pure spam targets aggressive SEO tactics the owner chose, not an intrusion. The fix there is to stop those tactics.

‘Deceptive site ahead’ points to phishing or social engineering, such as fake login or tech-support pages. ‘This site may harm your computer’ means malware or unwanted software. Spam injection usually appears as hacked content in Search Console. Examples include the Japanese keyword hack and pharmaceutical, casino or payday-loan pages.

The damage goes past SEO. Google Ads can disapprove ads that point to a compromised site, and your domain can land on email and reputation blocklists. Bing Webmaster Tools, Norton Safe Web, McAfee and Spamhaus flag sites independently. Check each one and file a separate request once you are clean.

Could it be a false positive?

Assume it is real until you prove otherwise. False positives are rare, and the sample URLs usually settle the question within minutes.

Open each sample URL in a private window, then on a phone over mobile data. Run a site:yourdomain.com search and look for titles in languages or topics you never published. Then run the URL Inspection live test in Search Console to see the HTML Googlebot actually received.

That last check matters because of cloaking. With cloaking, the spam or redirect fires only for Googlebot’s user agent, mobile visitors or people arriving from search. If you are logged in as admin on a desktop, you see a normal site.

Two situations look like false positives but are not:

• Shared hosting cross-contamination. Another site on the same hosting account was infected first, and the attacker wrote files into yours. Clean every site on the account, or move yours to an isolated account, before you request a review.
• A compromised third-party script. A chat widget, tracker or ad tag loaded from someone else’s server started serving malicious code. Remove the tag and confirm the vendor has fixed the problem before you add it back.

How do I find and clean the hack on a WordPress site?

Start from Google’s sample URLs. Then check the places attackers reliably use on WordPress:

• .htaccess in the root and every subfolder: rewrite rules keyed on user agents or referrers.
• Root index.php and wp-config.php: extra lines at the top or bottom, or code pushed far right after hundreds of spaces.
• wp-content/uploads: no PHP file belongs here.
• wp-content/mu-plugins: must-use plugins load automatically and never appear in the plugin list.
• The active theme: functions.php, header.php and footer.php.

WP-CLI finds modified files fastest. The commands wp core verify-checksums and wp plugin verify-checksums --all compare your files against the WordPress.org originals. Then search for obfuscation such as base64_decode, eval, gzinflate and long hex strings.

Spam often lives only in the database. Look for injected rows in wp_posts, autoloaded scripts in wp_options, unknown accounts in wp_users and admin rights granted in wp_usermeta. On Joomla, check templates, media folders, configuration.php and the users table.

Next, find the entry point. Compare file modification dates with your access logs. Look for POST requests to unusual PHP files, a plugin with a known vulnerability, or a login from an unfamiliar IP. The usual culprits are outdated or nulled plugins, stolen admin passwords, upload forms and stale FTP accounts.

Replace, do not repair

Hand-editing an infected file leaves fragments behind. Reinstalling clean copies does not.

1. Snapshot first. Keep the infected copy and its logs so you can trace the entry point and meet any incident-response duties.
2. Reinstall core, plugins and themes from official sources. Delete nulled or pirated builds outright.
3. Remove every PHP file from uploads and anything in mu-plugins you did not put there.
4. Clean the database: remove spam posts, malicious options, unknown admins, and WP-Cron jobs that rewrite files.
5. Delete the spam pages so their URLs return 404 or 410. Do not 301-redirect them to the homepage. Google treats that as a soft 404, and the cleanup drags on.
6. Rotate every credential: hosting panel, FTP, SFTP, SSH, database users, every WordPress admin, API keys, and payment or email integrations.
7. Regenerate the salts in wp-config.php. This logs out every session, including one an attacker hijacked with a stolen cookie.
8. Close re-entry paths outside WordPress: extra FTP or panel users, server cron jobs, unknown subdomains, and Search Console users you don’t recognize.
9. Harden: enable two-factor authentication, set DISALLOW_FILE_EDIT to true, and disable XML-RPC if nothing uses it.

Sometimes the server itself was compromised, for example through PHP exploitation that plants webshells. In that case, cleaning the site files is not enough. Your host has to fix the server, or you move to a clean one.

Restoring a backup works only if the backup predates the compromise. Even then, you still have to patch the entry point and rotate credentials. Attackers often wait for weeks before injecting spam. Pick a backup older than the earliest suspicious file you found, not just older than the day Google flagged you.

If the site handled payments or personal data, treat the hack as a possible breach. Under GDPR Article 33, a reportable breach must go to the supervisory authority within 72 hours of becoming aware of it. PCI DSS sets incident-response duties for card data.

Where do I request a review in Google Search Console?

Open Search Console and go to Security & Manual Actions, then Security issues. Confirm every listed issue is fixed and click ‘Request a review’. If the Manual Actions report also shows a ‘Hacked content’ action, file a separate request there. The two reports use separate queues, and approval in one does not clear the other.

Before you click, make sure Google can fetch the site. Three things commonly get in the way: a leftover 503 maintenance page, a Disallow: / line in robots.txt, or a sitewide noindex tag. Each one either blocks Googlebot from verifying the fix or leaves the review stuck in the pending queue. Short maintenance windows during cleanup are fine.

Also confirm you still have Search Console access. Attackers sometimes delete the verification file. A DNS TXT record is the most durable verification method.

Write the request for a reviewer who has never seen your site. Explain what was infected, what you removed, how the attacker got in and what you changed. For example:

“About 1,800 Japanese spam pages were created through an outdated form plugin. We removed the plugin and deleted the pages, which now return 410. We also removed two PHP backdoors from uploads and a rogue admin account. Core and all plugins were reinstalled, all passwords and salts were rotated, and 2FA is now on.”

Submit once. Sending more requests while one is pending does not move you up the queue.

How long does Google take to remove the warning after cleanup?

Plan on days for a simple infection and several weeks for a large spam hack. Malware and phishing reviews usually finish within a few days. Reviews for hacked spam or a manual action can take several weeks because they may involve manual investigation. These are estimates, not guarantees:

Stage	Typical range	What drives it
Cleanup	A few hours to several days	Number of backdoors, database spam, server-level compromise
Review: malware or phishing	A few days	Whether Googlebot can crawl the fixed pages
Review: hacked spam or manual action	Several days to several weeks	Volume of spam URLs, manual investigation
Warning disappears after approval	Hours to a few days	Recrawl and Safe Browsing list updates in browsers
Rankings and traffic recover	Weeks to months	How long the spam was indexed, downtime, lost links

Removing the warning restores your ability to rank, but your rankings will not return overnight. Two things can speed up the cleanup of search results: submit an updated sitemap, and use the Removals tool for spam URLs that linger.

Why was my review rejected, or why is the warning still showing?

The most common reason is reinfection. The backdoor or the vulnerable plugin was still in place, and the site was compromised again before Google checked. The other recurring causes:

• Cloaking you never saw. The site looked clean on your desktop but served spam to Googlebot or redirected mobile users. Run the URL Inspection live test again.
• Symptoms-only cleanup. The spam pages are gone, but injected options, rogue admins or cron jobs stayed.
• Googlebot blocked by robots.txt, noindex or a maintenance page.
• Missed subdomains or sibling sites on the same hosting account that reinfect the main site.
• A vague request that does not say what was found or fixed.
• Only one review filed when both a security issue and a manual action exist.

Before you resubmit, rescan with at least two independent scanners, then rescan again 48 to 72 hours later. Reinfection usually shows up inside that window.

How do I keep the warning from coming back?

Close the paths that led to the hack, and set up alerts so you learn about problems before Google does. A 30-minute monthly routine covers most of it:

• Update core, plugins and themes. Remove anything unused or abandoned.
• Review accounts in WordPress, the hosting panel and FTP. Give administrator rights to as few people as possible.
• Confirm offsite backups exist and test one restore.
• Check Search Console for new security issues and run a site: search for unfamiliar pages.

Between those checks, a web application firewall blocks exploit attempts against known plugin flaws. File integrity monitoring alerts you as soon as a PHP file appears in uploads. Antivirus website protection combines scanning and alerts, so you hear about an infection from your own tools first. If the cleanup is beyond your team, our malware removal cases show what a full recovery involves, including the review request.

FAQ

How do I get rid of the 'This site may be hacked' message?

Remove all malicious content and backdoors. Fix the vulnerability or stolen credential that let the attacker in. Then request a review in the Security issues report in Google Search Console. The warning clears after Google verifies the site is clean.

How long does it take Google to remove a hacked site warning?

Malware and phishing reviews usually take a few days, while spam-injection reviews and manual actions can take several weeks. After approval, the warning typically disappears within hours to a few days.

Why does my site look clean but Google still says it's hacked?

The attacker is probably using cloaking, which shows spam or redirects only to Googlebot, mobile users or search visitors. Run the URL Inspection live test in Search Console, and check the site on a phone over mobile data.

Will restoring a backup remove the warning?

Only if the backup predates the compromise, and you still need to patch the entry point and change every password. A backup taken after the infection brings the backdoor back.

Should I block Google with robots.txt while I clean my site?

No. Google must crawl the site to verify your fix. A robots.txt block, a noindex tag or a lingering 503 maintenance page will stall the review.

What is the difference between 'Deceptive site ahead' and 'This site may harm your computer'?

'Deceptive site ahead' flags phishing or social-engineering pages. 'This site may harm your computer' flags malware or unwanted software. Both clear through the same Security issues review once the site is clean.

If Google has flagged your site and you want it cleaned, hardened and ready for review without guesswork, pick a website protection package and our team will take it from there.