“This Site May Be Hacked”: How to Remove Google’s Warning

You search for your own business and see a short line of text under your site in Google: “This site may be hacked.” Your pages still load, nothing looks broken, yet prospects now hesitate to click. That label means Google believes someone added content to your site without your permission, usually spam pages or links.

This guide explains what triggers the “This site may be hacked” label, how it differs from Google’s red “dangerous site” warnings, and the exact steps to clean the site, request a review in Search Console and get the label removed.

What “This site may be hacked” actually means

Google’s documentation describes hacked content as content placed on your site without your permission, through a security weakness. The label is Google’s way of telling searchers that the page they are about to visit may not be what the owner intended.

It is usually triggered by spam injected by hackers rather than by a virus targeting visitors. Typical examples on WordPress sites:

• Thousands of new pages selling counterfeit products, pharmaceuticals or gambling, often in Japanese or other languages (the so-called Japanese keyword hack)
• Hidden links inserted into your theme footer or old blog posts
• Cloaked redirects that send visitors from Google to a scam site while you see a normal page
• Modified page titles and meta descriptions in search results

“May be hacked” vs. “dangerous site”: two different problems

Business owners often confuse the two warnings, but they come from different issues and are cleared in different ways.

	“This site may be hacked”	“Dangerous site” / “This site may harm your computer”
Where it appears	As a text label in Google search results	Mostly as a red full-page warning in Chrome and other browsers (Google Safe Browsing)
Usual cause	Spam content or links added by a hacker	Malware, phishing or unwanted software
Main risk	Fewer clicks, spam indexed under your domain	Visitors blocked, browser warnings everywhere
Where to check	Search Console > Security issues	Search Console > Security issues and Google’s Safe Browsing site status

If browsers show a red screen, start with our guide to Google blacklist removal for WordPress. If you only see the gray label in search results, keep reading.

Step 1: Confirm the problem in Google Search Console

Google says verified Search Console owners may receive an email about suspected hacking, and the Security issues report lists the problem with sample URLs. If your site is not verified yet, verify it now. A Domain property, verified with a DNS record, covers every subdomain and protocol.

Then gather clues:

• Run a site:yourdomain.com search in Google and look for pages you never created.
• In Search Console, check the Pages report for a sudden jump in indexed URLs and the Sitemaps report for sitemaps you did not submit.
• Ask your host for recent access logs and a list of recently modified files.

Step 2: Contain the hack and back up the evidence

Google’s own guidance is direct: if you were hacked, take the site offline, then find, fix and clean the compromised pages, and secure the site before restoring it. In practice, on a WordPress site:

1. Put the site in maintenance mode or restrict access while you work.
2. Take a full backup of the infected site (files and database) for analysis. Don’t overwrite your older clean backups (see our guide to WordPress backups).
3. Change every password: WordPress admins, hosting panel, SFTP/SSH, database and the email accounts tied to them.
4. List all administrator accounts and delete any you don’t recognize.

If customer data may have been exposed (contact forms, orders, accounts), state data breach notification laws may apply. Our article on WordPress data breaches explains what to check.

Step 3: Clean the site thoroughly

Partial cleanups are why many sites get the label back a few weeks later. A complete cleanup includes:

• Core files: replace WordPress core with a fresh copy of the same version.
• Plugins and themes: delete anything unused or abandoned, and reinstall the rest from official sources. Nulled (pirated) premium plugins are a frequent entry point.
• Uploads folder: look for PHP files in /wp-content/uploads/, where they have no reason to be.
• Database: search posts, options and user tables for injected links, scripts and spam pages.
• Server files: check .htaccess, wp-config.php and any unknown files at the root for redirects and backdoors.
• Search Console properties: hackers sometimes verify themselves as owners. Remove any owner you did not add.

When the cleanup is complete, find and fix the entry point: an outdated plugin, a weak password, an old PHP version or a compromised account. If you skip this step, the same hole can be used again.

Step 4: Remove the spam from Google’s index

Spam pages that now return a 404 or 410 status drop out of the index over time. To speed things up:

• Make sure deleted spam URLs return 404 or 410, not a redirect to your home page.
• Use the Removals tool in Search Console for the most visible spam URLs (it hides them temporarily while Google recrawls).
• Submit a clean XML sitemap so Google recrawls your real pages first.

Step 5: Request a review in Search Console

Only request a review when the cleanup is finished. Google insists on this point: make sure the problem is fully fixed first.

1. Open Security issues in Search Console.
2. Check that you have fixed every issue type listed.
3. Select Request a review.
4. Explain what you did for each issue: which spam content was removed, which vulnerability was fixed and how you will prevent a repeat.

How long does the review take?

According to Google, reviews for malware infections take a few days, while reviews for sites hacked with spam may take up to several weeks. After approval, the warning can take a few more days to disappear from search results.

How to keep the label from coming back

• Update WordPress core, plugins and themes on a schedule, and remove what you don’t use.
• Turn on two-factor authentication for every administrator.
• Keep automated, off-site backups and test that they restore.
• Monitor Search Console alerts and the number of indexed pages every month.
• Use a web application firewall and file-integrity monitoring.

Need it fixed fast?

Référenceur cleans hacked WordPress sites, removes injected spam from Google, files the review request and hardens your site so the label stays gone. See our hacked WordPress site repair service or contact us for an urgent assessment. Once the site is clean, our SEO agency can help you recover lost rankings.

FAQ

Why does Google say “This site may be hacked” when my site looks normal?

Hackers often hide spam pages, links or redirects that only search engines or visitors coming from Google can see. Check the Security issues report in Search Console and run a site: search for pages you didn’t create.

How long does it take to remove the “This site may be hacked” label?

After you request a review, Google says spam-hack reviews can take up to several weeks. Once approved, the label may take a few more days to disappear.

Can I remove the warning without fixing the hack?

No. Google only removes the label after a successful review, and requesting a review before the site is truly clean wastes time.

Is “This site may be hacked” the same as being blacklisted?

Not exactly. The hacked label appears in search results and is usually tied to spam. The red “dangerous site” warnings come from Google Safe Browsing and are usually tied to malware or phishing.

Will my rankings come back after the label is removed?

Rankings often recover once spam is removed and Google recrawls your real pages, but there’s no guaranteed timeline. Keep monitoring Search Console after the review.

Seeing the label on your site today? Contact Référenceur for an urgent assessment.