What the warning actually means
"This site may be hacked" is a label Google attaches to a search result when its systems have detected content on the site that the owner almost certainly did not put there. It sits under your title in the results, in grey text, and it costs you most of your clicks.
It is worth being precise about what it is not. It is not the red full-screen interstitial - that is "Deceptive site ahead", a separate and more severe Safe Browsing warning. It is also not a manual penalty in the ranking sense: your pages keep their positions. What collapses is the click-through rate, because almost nobody clicks a result that Google has flagged as compromised.
Why it appeared on your site
The label is triggered automatically when Google's crawler finds pages that look injected. The most common causes, in the order we encounter them:
- SEO spam injection. Thousands of generated pages selling counterfeit goods, pharmaceuticals or gambling. If the injected pages are in Japanese, you are looking at the Japanese keyword hack.
- Cloaked content. The page looks normal in your browser and spammy to Googlebot, because the malware checks the user agent before deciding what to serve.
- Injected links. Hidden links in the footer or in existing posts, pointing at sites the attacker is trying to promote.
- Modified titles and descriptions. Your pages are intact, but the metadata Google reads has been rewritten.
In every case the underlying event is the same: someone gained write access to your site, usually through an outdated plugin or a weak administrator password.
Confirm it before you act
Two checks, both free, both quick.
Search Console, Security Issues. This is the authoritative source. If Google flagged the site, the report names the category and lists sample URLs. If you have no Search Console property for the domain, add one now - you will need it for the recovery step regardless.
Search site:yourdomain.com. Page through the results. Injected pages are usually obvious: character sets you do not publish in, product names you do not sell, URL slugs that look machine-generated. Remember that the spam may be invisible in your browser - cloaking is the norm, not the exception.
Removing the warning
The warning disappears on its own once Google recrawls the site and finds it clean. There is no button that removes it while the problem is still there. The sequence that works:
1. Clean the site. Remove the injected content, the backdoors that let it in, and any administrator accounts you did not create. Our step-by-step walkthrough for this is how to clean a hacked WordPress site.
2. Close the entry point. Update everything, disable PHP execution in the uploads directory, enable two-factor authentication, rotate every credential including the database password. Skipping this means doing the whole process again in a fortnight.
3. Clean up the Google side. Regenerate the sitemap so it contains only real URLs. Then open Search Console's Users and Permissions and remove anyone you did not add - attackers frequently verify themselves as owners to accelerate indexing of their spam, and they retain that access after the files are cleaned. Submit removal requests for the injected URLs.
4. Request a review. In Security Issues, once you have fixed everything, click Request Review. Describe concretely what was compromised, what you removed, and what you changed to prevent recurrence. Vague submissions get rejected and cost you another review cycle.
How long it takes
Google states that reviews of hacked-site reports typically complete within a few days, though it can run longer. Two things reliably slow it down: requesting the review before the site is genuinely clean, which means a rejection and a fresh queue position, and leaving spam URLs in the index that Google then recrawls and finds still listed in your sitemap.
Once the flag is lifted, click-through rate recovers quickly - usually within the same week. Impressions on the pages that were displaced by spam take longer to return, typically several weeks.
Keeping it from happening again
Almost every reinfection we are called about comes back through the same door as the first one. The measures that matter:
- Keep WordPress, plugins and themes updated - most intrusions exploit a vulnerability patched long before the attack.
- Delete plugins you no longer use; deactivated plugins are still reachable over HTTP.
- Two-factor authentication on every administrator account.
- Backups stored off the server, tested at least once.
- Keep the Search Console property and check it - it is how you will find out about the next incident before your customers do.
The full list is in our WordPress hardening guide.
If you would rather not do this yourself
The cleanup is tedious and the Google recovery step is easy to get wrong. We handle both as a service - WordPress malware removal and hacked site cleanup - including the Search Console work and the reconsideration request. The initial check costs nothing: send us the URL and we will tell you what we find.
