'This Site May Be Hacked' Warning on Google: How to Find the Cause and Remove It

What Does 'This Site May Be Hacked' Mean?

When Google detects that a third party has added content to your site without your permission, it can show the label "This site may be hacked" under your listing in search results. The most common cause on small business sites is spam: hundreds or thousands of pages about medicines, gambling or counterfeit goods, often in Japanese or other languages, created inside your site so they borrow its reputation. Sometimes attackers add hidden links to existing pages or redirect visitors from Google to other sites. Customers who see the label often do not click, so enquiries drop.

This guide focuses on the Google warning and how to get it removed. If your site is visibly broken or defaced, start with our guide on what to do when a website is hacked.

How Do You Find What Google Found?

1. Open Google Search Console for your site. If you do not have it, add and verify the site first.
2. Go to Security and Manual Actions, then Security issues.
3. Read the issue type, such as hacked content, URL injection or content injection, and open the sample URLs.
4. Search Google for site:yourdomain.pk and look for pages you never created, especially in other languages.
5. Check the Pages report and your sitemap for unfamiliar URLs.

Common Hack Types and What They Look Like

Cleaning the Site Properly

Take a full backup of the current site first, even though it is infected, so nothing is lost. Then clean in this order:

• Change every password: hosting, admin users, database, FTP and email.
• Remove unknown admin users.
• Update the platform, theme and every plugin, and delete those you do not use.
• Replace core files with fresh copies and scan theme and plugin files for added code.
• Delete the spam pages and database entries, and remove unknown files from the server.
• Check the robots.txt file, sitemap and server configuration for changes.

If you have a clean backup from before the hack, restoring it and then updating everything can be faster, but the security hole must still be closed. Make the spam URLs return a "not found" or "gone" response once removed.

How Do You Request a Review From Google?

When the site is clean and the hole is closed, return to the Security Issues report, confirm you have fixed the issues and click Request review. Describe briefly what was found, what you removed and how you secured the site. Google reviews these requests, usually within days but sometimes longer. If the request is rejected, Google has found remaining problems; check again carefully before resubmitting.

What Happens to Rankings After the Warning Is Removed?

Once the label is removed, clicks usually recover as customers stop seeing the warning. The spam URLs will drop out of Google over time as they return "not found". If the attack lasted a long time, some rankings may take weeks to recover. Keep an eye on the Pages report for any spam URLs that reappear, which would mean the site was not fully cleaned.

How Can You Stop It Happening Again?

Most small business hacks come from outdated plugins and weak passwords. Keep everything updated, use strong unique passwords with two-factor login, remove unused plugins and themes, take regular off-site backups and use a security service such as a firewall. Our website security checklist lists the essentials.

Getting the Warning Removed With Our Help

We clean hacked sites, close the entry point and handle the Google review request. Ongoing updates, backups and monitoring are covered by our maintenance plan from Rs 7,200 a month; see our published prices, or contact us with your domain and the warning you see.

Frequently Asked Questions