The hack is cleaned up. The spam pages are deleted, the redirect is gone and the security plugin shows green. Yet search traffic is still a fraction of what it was, the pages that used to bring enquiries have slipped down the results, and Google still shows odd titles for your site when you search for it.
That gap between a clean site and a recovered site is normal, and frustrating. Search engines do not notice a cleanup the moment it happens. This post walks through what usually damages rankings during a hack, what you can do to help Google see the site as it really is again, and what to expect along the way. Nobody can promise when, or whether, every ranking returns, but there is a lot you can do to give the site its best chance.
Why a hack hurts search visibility
A hack rarely damages rankings in just one way. Several things tend to happen at once, and each needs its own fix.
- Warnings in the results. Google may label your listing “This site may be hacked” or block it with a full-page browser warning. Either one drives clicks away even if your position does not change. Our guide to clearing the hacked-site label in Google covers that specific warning.
- A flood of junk URLs. Spam hacks often create thousands of pages. Google spends its crawling time on them instead of on your real pages, and your site starts to look, to an algorithm, like a site about something else entirely.
- Changed real pages. Some hacks alter your own titles, descriptions or content, or add hidden links to them. Pages that ranked for your services may now look like spam to a crawler, even though they look normal to you.
- Manual actions. If a person at Google reviewed the site and found spam, there may be a manual action recorded against it, which needs its own reconsideration request.
- Downtime and errors. A suspended hosting account, a broken cleanup or a long maintenance page means crawlers found errors where your pages used to be.
Recovery means undoing each of these. Fixing only the most visible one is a common reason the traffic never comes back. If the site is not yet clean, start with the steps on our hacked website repair and emergency help page and come back to this once the infection is gone.
Step 1: make sure the site is actually clean
This sounds obvious, but SEO work on a site that is still infected is wasted. Many hacks show spam only to search engine crawlers and serve the normal site to everyone else, so a site that looks clean in your browser may still be feeding junk to Google.
Use the URL Inspection tool in Google Search Console on your homepage and a few important pages, and look at the crawled page Google sees, including the HTML. Compare it with what you see. Then search Google for site:yourdomain.com and scroll. Pages in another language, or titles about pharmacy, casinos, replica goods or loans, mean either old spam that has not been dropped yet or spam that is still being generated. Check each example URL. If it now returns your normal site or an error, it is old. If it still shows spam, the hack is not finished.
If you are dealing with the large-scale Japanese or pharmacy variety, our post on finding and removing the Japanese keyword hack explains where that spam usually hides.
Step 2: clear Search Console of the attacker’s traces
Attackers who run spam campaigns often add themselves to your Search Console property. Being a verified owner lets them submit their own sitemaps, request indexing of their spam pages, and see how the campaign is performing.
In Search Console, open Settings, then Users and permissions. Remove any owner or user you do not recognise. A verified owner keeps access as long as their verification method is still in place, so also look for the verification token they used. That is usually an HTML file in your site’s root folder with a name starting with “google” followed by a string of characters, or a meta tag in your theme’s header. Remove the ones that are not yours, then check the list of users again.
While you are there, open the Sitemaps report. Delete any sitemap you did not submit, and resubmit your own.
Step 3: resolve security issues and manual actions
Search Console has two separate reports that matter here: Security issues and Manual actions. Both sit under the Security and Manual Actions section. If either shows a problem, the warning will not be lifted until you fix it and request a review.
A good review request explains what happened, what you removed, how the attacker got in, and what you changed to stop it happening again. Short and factual is better than long and apologetic. We go through both reports, and how to read them, in our guide to the Search Console security issues report.
If the warning comes from Google Safe Browsing, which shows red pages in browsers, or if other services have blocklisted the site, that review process is handled separately and can need more than one round. Our Google blacklist removal service deals with that side.
Step 4: deal with the spam URLs properly
Once spam pages are gone, the URLs that used to hold them should return a 404 (not found) or 410 (gone) status. Both tell Google the page no longer exists. Over time, as Google recrawls them, they drop out of the index.
Three mistakes slow this down:
- Redirecting every spam URL to the homepage. It is tempting, but Google tends to treat mass redirects of unrelated pages to the homepage as soft 404s anyway, and you lose a clean signal that the pages are gone.
- Blocking the spam folders in robots.txt. If Google cannot crawl a URL, it cannot see that the page is gone, so it may keep the old listing for longer.
- Serving a 200 “page not found” message. Some themes and caching setups show an error message but send a success status. Check the real status code with an HTTP header checker rather than trusting what the page says.
For the most embarrassing URLs, the ones that show up when people search your brand, the Removals tool in Search Console can hide results temporarily while Google catches up. It is a short-term measure, not a fix, and the URL must also return 404 or 410 so it stays gone. The full process for clearing these leftover listings is covered on our page about removing hacked pages from Google.
Step 5: repair your own pages
This is the step most people skip. Go through your important pages one by one, starting with the ones that brought the most traffic before the hack. In Search Console’s Performance report, you can compare a date range from before the hack with the period since, and sort pages by clicks lost.
For each important page, check:
- The title and meta description in your SEO plugin, which may have been edited.
- The page content, including anything hidden off-screen or in the same colour as the background.
- Outgoing links you did not add, particularly in the footer or at the bottom of posts.
- The canonical tag, which some hacks change to point to another site.
- Any noindex setting, either in the SEO plugin or in Settings, Reading, where “Discourage search engines” may have been ticked during or after the cleanup.
Then use URL Inspection on each fixed page and request indexing. It will not force a quick recrawl, but it tells Google the page is worth looking at again.
Step 6: check the technical basics
A hasty cleanup can leave the site technically worse than before. Look for:
- A robots.txt you did not write. Attackers sometimes replace it to allow their spam folders or point to their sitemap.
- A broken XML sitemap from your SEO plugin, or one that now lists spam URLs.
- Missing pages. If clean-up deleted real pages or images by mistake, restore them. Any genuine URLs that changed need proper redirects, as you would after a redesign. A crawl of the site before and after the cleanup shows which addresses disappeared.
- HTTPS problems, such as an expired certificate or mixed content warnings caused by a changed setting.
- Speed. Leftover malware, a heavy security plugin or disabled caching can slow the site noticeably.
Step 7: look at your backlinks
Spam campaigns often point links at the pages they create on hacked sites. Once those pages return 404, the links lead nowhere and generally stop mattering. Google has said many times that it is good at ignoring spammy links, and for most small sites the disavow tool is not needed. Use it only if you have a manual action for unnatural links, or a strong reason to think the links are harming you.
More useful is the reverse: check your own site is not still linking out to spam. Search Console only shows links coming into your site, so to find spam links your own pages still point to, crawl the site or search the database for the spam domains.
What to expect, honestly
Some recovery comes quickly. When a warning is lifted after a successful review, click-through can improve as soon as the label disappears. Pages you fixed and resubmitted may be recrawled within days.
Other parts are slower. Thousands of spam URLs drop out gradually as Google recrawls them, which can take weeks or longer on a large spam hack. Rankings that fell because Google’s understanding of your site changed may take longer still to settle, and some may come back lower than before, especially if competitors gained ground while your site was compromised.
Keep an eye on a few signals rather than checking rankings every hour:
- The count of indexed pages in Search Console’s page indexing report, which should fall towards your real number of pages.
- Impressions and clicks for your brand name, which usually recover first.
- Impressions and clicks for your main service pages, compared with the same period before the hack.
- Any new unknown URLs appearing in the index, which would mean reinfection.
Things that do not help
Changing domain to escape the hack throws away everything the old domain had built and rarely solves anything. Publishing a burst of new content before the old problems are fixed adds pages to a site Google is still unsure about. Buying links to “make up” for lost rankings risks a new problem on top of the old one. Patience combined with steady, careful repair beats all three.
If your site is clean but Google keeps showing spam results for your domain weeks later, that is usually the leftover-URL problem rather than a new hack. Our service for clearing hacked URLs out of Google starts with checking which of the two you are dealing with, and you can reach us on WhatsApp by starting your message with the word HACKED.
Next in this series: PHP Files in WordPress Uploads: Why It Is a Red Flag
