Google removes a 'This site may be hacked' warning only after three things happen. The malicious content is gone, the backdoors and entry point are closed, and you pass a review in Google Search Console. Cleanup usually takes hours to a few days, and the review adds a few days to several weeks. Doing things in the right order determines how long your traffic stays down.
The short answer
- Google clears the 'This site may be hacked' warning only after you remove the infection and its backdoors, fix the entry point, and pass a review requested in Search Console.
- Security issues and a 'Hacked content' manual action are separate reviews; file both if both appear.
- Malware reviews typically take a few days, spam-hack reviews can take several weeks, and rankings recover over weeks to months.
- Most rejections come from reinfection, cloaked spam you never saw, or blocking Googlebot during the review.