How to remove the "This site may be hacked" warning from Google

A warning in your search listing costs you almost every click. People do not weigh the risk; they pick the next result. The good news is that the process for removing it is well defined, and Google is usually quick once the site is genuinely clean.

The order matters, though. Requesting a review before the site is actually fixed will fail, and repeated failed reviews slow everything down.

First, work out which warning you have

They are different problems with different fixes.

"This site may be hacked" appears in the search results under your listing. Google has found content it believes was injected — usually spam pages. The site still loads normally.

"Deceptive site ahead" is the full red interstitial before the page. That is Safe Browsing, and it means Google believes the site is actively distributing malware or phishing. More serious, and more urgent.

"This site may harm your computer" is also Safe Browsing, specifically for malware.

Find out what Google actually saw

Open Google Search Console → Security & Manual Actions → Security Issues. If you do not have Search Console set up, do that first; it takes about ten minutes and you cannot request a review without it.

Google will name the category — usually one of hacked content, malware, or social engineering — and often give sample URLs. Those samples are the fastest route to the injected code, because they show you exactly what the crawler found.

Also run the domain through Sucuri SiteCheck and Google's own Safe Browsing site status page. They sometimes surface things Search Console does not.

Clean it properly, not partially

This is where most failed reviews come from. Deleting the spam pages you can see does not help if the code generating them is still on the server — they simply reappear before Google re-crawls.

Working order:

1. Back up the infected site first, as evidence and as a rollback point
2. Replace core, plugins and themes with fresh copies from official sources rather than editing files
3. Search the database for injected content — wp_options and wp_posts are the usual hiding places
4. Remove unknown admin users and any scheduled tasks you did not create
5. Check wp-config.php and .htaccess for modifications
6. Rotate every credential, including the security salts, which logs the attacker out
7. Close the entry point — usually an outdated plugin, sometimes a weak password

The full sequence is in our recovery guide.

Verify before you request

Check all of these before touching the review button:

• site:yourdomain.com in Google no longer shows pages you did not write
• Sucuri SiteCheck comes back clean
• The site loads correctly in a private window, on a phone, on mobile data
• No PHP files exist in wp-content/uploads
• Your host's malware scan is clear

If any of those still fail, the cleanup is not finished.

Request the review

For "This site may be hacked" — Search Console → Security Issues → Request Review. You will be asked what you did to fix it. Be specific and factual: name the vulnerable plugin, say you replaced core and plugins with clean copies, list the credentials rotated, state the entry point you closed. Vague answers get slower reviews.

For "Deceptive site ahead" or malware warnings — same place, but Safe Browsing reviews are handled separately and typically take a little longer.

Timing: hacked-content reviews are often done within 72 hours. Safe Browsing reviews are usually one to three days. Neither is instant, and there is no way to expedite it.

While you wait

The warning stays visible until the review completes, so:

• Tell customers directly if you rely on repeat business — a short, honest email beats them discovering it in Google
• Do not keep resubmitting; it does not speed anything up
• Do not make further changes to the site during the review unless you find something new
• Check that your other properties are clean, since sites sharing a hosting account are frequently infected together

After it is lifted

The warning goes, but the recovery is not finished. Injected spam pages may remain indexed for weeks — request removal in Search Console for the worst of them. Rankings often dip and take a few weeks to recover.

And the underlying question remains: the site was running something vulnerable. If nothing changes about how it is maintained, you will be back here.

That is what a care plan is for — weekly updates applied and checked, vulnerability monitoring against a live database, and free cleanup if it ever happens again. If you need the cleanup itself handled now, ours is $249 and includes the Search Console review request.