Someone searches for your business and, under your listing in Google, sees a line of grey text: “This site may be hacked.” Often the owner is the last to know. A customer mentions it, or enquiries go quiet, and when you open the website yourself it looks completely normal.
That last part is what confuses people, and it is also the biggest clue. Here is what the label means, how to confirm what Google has found, and how to get it removed once the site is clean.
What the label means
Google adds “This site may be hacked” to a search result when it believes someone other than the owner has changed the site’s content. Usually that means spam: pages added without your knowledge, hidden links, or redirects that send search visitors somewhere else.
It is a different warning from the full-page red screen some browsers show, which says a site is dangerous or deceptive. That screen comes from Google Safe Browsing and is about malware or phishing that could harm visitors directly. The search label is about hacked content. Both are reported in the same place in Search Console, though, and the clean-up overlaps a lot.
Why your site looks fine to you
Most hacks that trigger this label are built to hide from the owner. The injected code checks who is visiting and changes its behaviour:
- Spam shown only to Google. When Google’s crawler visits, the site serves pages full of pharmacy, gambling or counterfeit-goods keywords. When you visit, it serves your normal site. This is called cloaking.
- Redirects only for search visitors. People who click your result in Google are sent to a spam site, while anyone who types your address directly sees nothing wrong.
- Thousands of new pages you never made. Attackers create spam pages in odd folders, often in another language, and sometimes add their own sitemap so Google finds them quickly.
- Logged-in admins skipped. Some injected code stays quiet for anyone logged in to WordPress, which is exactly the person most likely to check.
So “it works on my computer” proves very little here. You need to look at the site the way Google does.
How to confirm it in Google Search Console
Search Console is Google’s free tool for site owners, at search.google.com/search-console. If you have never set it up, add your site and verify ownership. A domain property, verified with a DNS record at your domain registrar, covers every version of the site (www and non-www, http and https) in one place.
Then check three things.
1. The Security Issues report
Under Security & Manual Actions, open Security Issues. If Google has flagged the site, the issue is listed here by type, such as content injection, code injection or URL injection, with some example URLs. Treat those examples as a starting point. They are samples, not a complete list of everything affected.
2. URL Inspection
Paste one of the example URLs, or your homepage, into the URL Inspection tool and run a live test. Then view the page as Google fetched it. If the HTML Google received is full of spam text or links you have never seen, you have found the cloaking.
3. Users and permissions
In Settings, check who else has access to your Search Console property. Attackers sometimes verify themselves as an owner so they can submit their own sitemaps. Remove anyone you do not recognise, and also remove the verification file or tag they used, or they can simply verify again.
A quick search for site:yourdomain.com in Google is also worth doing. Pages with titles in a language you do not use, or about products you do not sell, show you how far the spam has spread in Google’s index.
Clean the site before you ask Google for anything
A review request only works if the site is genuinely clean, and that means finding how the attacker got in, not only deleting what you can see. We have written the full clean-up process for WordPress in how to fix a hacked WordPress website, so we will not repeat it here. A few points are specific to this label, though:
- Let the spam URLs return a “not found” error. Once the spam pages are removed, those addresses should give a 404 or 410 response. Do not redirect them all to your homepage. Google needs to see that those pages are gone.
- Do not block the spam URLs in robots.txt. It feels logical, but it stops Google from crawling them and seeing that they are gone.
- Check for conditional redirects. Look in the .htaccess file and in theme and plugin files for rules that act differently for search engines, mobile visitors or people arriving from Google.
- Remove injected sitemaps. In Search Console’s Sitemaps report, delete any sitemap you did not submit, and check your real sitemap only lists your own pages.
- Close the way back in. Change every password, remove unknown admin users, and switch on two-factor authentication for WordPress logins so a stolen password alone cannot reopen the door.
Before moving on, run URL Inspection again on the affected URLs. When Google’s live view of your pages matches what you see, you are ready.
Requesting a review
Back in the Security Issues report, confirm you have fixed the issues and choose Request Review. You will be asked to describe what you did. Be specific and honest. Something like: “Removed injected spam pages from an unused plugin folder, removed a malicious redirect rule from .htaccess, deleted admin accounts we did not create, updated all plugins and changed all passwords.” A vague “site is clean now” gives the reviewer nothing to check against.
Only request a review once you are confident. If Google still finds hacked content, the request is rejected and you start again, having lost time.
How long it takes
Google does not promise a fixed turnaround for reviews, and the time can vary from one case to the next. You will get a message in Search Console when the review is finished, telling you whether the issue has been cleared.
Two things are worth knowing while you wait. First, once the label is gone, some spam pages may still appear in results until Google recrawls those addresses and sees they no longer exist. The Removals tool in Search Console can hide specific URLs temporarily while that happens, but it is not a fix by itself. Second, if your traffic dipped while the label was showing, give it time to settle rather than making big changes to the site straight away.
If the warning comes back after being cleared, the site was reinfected, which almost always means a backdoor or the original weak point was missed. Clean it again more thoroughly before submitting another request.
Keeping it from coming back
- Keep WordPress, plugins and themes updated, and delete the ones you do not use.
- Use unique passwords and two-factor authentication for every administrator.
- Keep dated, off-site backups so you can restore a version from before any future problem.
- Check Search Console every so often, and make sure its email alerts reach an inbox someone actually reads.
The website security best practices guide covers each of these in more detail.
If you would rather hand the clean-up to someone else, our WordPress malware removal service covers the whole job, including removing the spam, closing the entry point and submitting the review request to Google. A standard cleanup is a flat ₹2,999, and badly damaged or repeatedly infected sites are reviewed and quoted before any work starts.
For hands-on help getting the warning lifted, see our Google blacklist removal service, or start with hacked website repair and emergency help.
Next in this series: Deceptive Site Ahead Warning: Causes and How to Remove It
