“This site may be hacked”: how to get Google’s warning removed

Which warning is it?

• “This site may be hacked” under your result in Google: Google found content or links added by someone else, often pages selling pills, replica goods or gambling.
• A red full-page warning in Chrome (deceptive site ahead, or dangerous site): Google Safe Browsing found phishing or malware. This blocks most visitors entirely.

Find what Google found

1. Open Search Console’s Security issues reportIt lists the type of problem and sample pages. If you don’t have Search Console set up, set it up now; you need it to request a review.
2. Search Google for your sitesite:yourbusiness.com with words like viagra, casino or replica. Hacked sites often have thousands of pages that only search engines see.
3. Check what Google seesSpam is often shown only to Googlebot or to visitors arriving from Google, so the site looks fine when you visit directly. URL Inspection in Search Console shows the page as Google sees it.

Clean it properly

• Take a full backup first, for evidence and in case cleaning breaks something.
• Remove the spam pages and injected code, and find the backdoor that let them in. Removing the spam without closing the way in means it comes back within days.
• Update the platform, every plugin and theme, and the server software.
• Change every password: hosting, site admin, database, FTP, and the email tied to them.
• Remove any Search Console owners or site admin users you don’t recognize.

Request the review

In the Security issues report, choose Request review and describe what you fixed. Google says reviews for hacked sites can take several days, and reviews for malware or phishing can be faster. If the review fails, Google lists what it still found.