You search for your own business, and there it is, in small grey letters under your link: "This site may be hacked." Not a nice moment. Customers see it too, and so does everyone who found you through Google.
Here is the good news: this label is a symptom, and symptoms are fixable. Here is what this site may be hacked really means, how to confirm it, how to clean up, and how to ask Google to take the label off.
What "This Site May Be Hacked" Actually Means
Google's help pages describe hacked content as content placed on your site without your permission, usually because of a security hole. When Google believes that has happened, it can mark your listing so searchers know to be careful. Google's own words are that it works to keep this content out of search results where it can, and that the warning can show up in search results or in the browser.
Think of it as a smoke alarm. The alarm is loud and annoying, and it did not start the fire. Something on your site probably did, and the label is Google telling you that its crawler found it.
The label does not mean your whole site is destroyed. It does not mean you did something wrong as a person either. WordPress sites get compromised through outdated plugins, stolen passwords and vulnerable themes, and it happens to careful people every day.
The Label in Google Versus the Red Browser Warning
People mix these up, and the difference matters for what you do next.
| Search result label | Red browser warning | |
|---|---|---|
| Where you see it | In Google results, next to your listing | Full page, when someone tries to open your site |
| What it says | "This site may be hacked" | Something like "Deceptive site ahead" |
| What it does | Warns searchers before they click | Blocks the page until the visitor chooses to continue |
| Where to check | Search Console, Security Issues report | Search Console, plus the problem page itself |
The label in results is a hint. The red warning is a wall. Some sites get one, some get both, and some get the red warning without the label. Both mean the same thing for you: something on the site is behaving in a way that could hurt visitors, and you need to find it.
Google's malware help page also notes that suspected files hosted on your site can be listed in the Security Issues report, which is why that report is your first stop either way. If you only see the red wall and not the label, the steps below still apply.
Why Google Adds the Warning
Google adds the label because sending a searcher to a hacked site is a bad experience, and a risky one. The common cases look like this:
- Spam pages. Hundreds or thousands of pages selling pills, fake designer goods or gambling, created without you knowing. The pill version is the WordPress pharma hack. We cover one famous version in the Japanese keyword hack.
- Hidden redirects. Visitors from Google get sent somewhere else, while you, typing the address directly, see a normal site.
- Injected links and scripts. Code added to your theme or plugins that points visitors to shady places.
- Malicious downloads or phishing pages. A fake login page hiding in an uploads folder, for example.
Key takeaway: the label is Google reporting a symptom. Removing the label without finding and closing the cause just invites it back.
The cruel part is that hackers want you not to notice. They hide the damage from site owners and logged-in users, and show it only to search engines and strangers. So you can click around your site for an hour and see nothing wrong.
If you want a broader list of what compromised sites look like, our guide to the signs of a hacked WordPress site walks through them.
How to Confirm It in Search Console
Search Console is Google's free tool for site owners. If you have not set it up, do it now, because Google only shows warnings in the Security Issues report to verified owners.
- Open Google Search Console and choose your site.
- In the left menu, find the Security Issues report (it sits with the manual actions reports).
- Read what it says. If Google found something, it lists the type of issue and often example URLs.
Google's help page adds a useful detail: if the report shows no warnings, the issue may have been detected algorithmically, and you can fix it without a manual review. In that case, once the site is clean and Google crawls it again, the label can fade by itself.
Write down the example URLs, and screenshot the report. They tell you where to start looking. If the examples are URLs you never created, that is your answer.
Check What Google Sees
Hackers often show different content to Google than to you. Two quick checks help:
- Search Google for
site:yourdomain.comand scan the results for titles you do not recognise. - Use the URL Inspection tool in Search Console on a suspicious URL and look at the page Google fetched, not the one your browser shows.
Clean Up the Site
This is the hard part, and the order matters. If you only delete the spam and leave the back door open, it will be back by Tuesday.
1. Put the Site in a Safe State
If visitors are being redirected or served malware, consider putting up a maintenance page while you work. Tell your host what is going on. Many hosts will help, and some run their own scan.
2. Make a Copy of the Hacked Site
It feels backwards, but take a backup of the site as it is now, files and database, before you change anything. You may need it to work out what happened. Keep it away from your live folder. Our backups page explains what a good backup holds, and it is worth doing before cleanup rather than after.
3. Find the Bad Code
Look for:
- Unfamiliar admin users in Users.
- Files in
wp-content/uploadsthat end in.php. Uploads should hold images and documents, not code. - Plugins or themes you did not install.
- Recently changed files you did not change.
- Odd entries in
.htaccessand inwp-config.php.
A malware scan does this faster than your eyes. Stack Guard's malware scanner runs signature and heuristic checks and compares every WordPress core file against the official checksums, so changed core files stand out. Manual scans with a full report are in the Free plan. For the full walkthrough of what to scan and how to read results, see our guide to scanning WordPress for malware.
4. Remove It and Replace What You Can
For WordPress core, plugins and themes, the cleanest approach is to delete them and reinstall fresh copies from wordpress.org or the vendor. That removes anything tucked inside them. Your content in the database and uploads is the part you cannot reinstall, so those need a careful look.
If you have a clean backup from before the hack, restoring it can be faster than cleanup. The catch is making sure that backup really is clean, because restoring a hacked backup just brings the hack back. Our guide to restoring WordPress from a backup covers how to check.
The step-by-step version of the whole job is in how to recover a hacked WordPress site.
5. Close the Door
This is the step people skip. Work out how they got in, and fix that:
- Update WordPress, every plugin and every theme. Delete the ones you do not use.
- Change every password: WordPress admins, hosting, SFTP, database, and your email if it was reused anywhere.
- Remove users you do not recognise.
- Regenerate the secret keys in
wp-config.php, which signs everyone out including the attacker. - Turn on two-factor sign-in for administrators.
6. Check It Is Really Gone
Search your own site again with site: queries. Scan again. Look at the Security Issues report. Only move on when you cannot find anything else. Google's own advice on this is blunt: be sure the problem is truly fixed before asking for a review.
Request a Review From Google
Once you are sure the site is clean:
- Go back to Security Issues in Search Console.
- Select Request a review.
- Explain what you found and what you did to clean it and prevent it coming back. Be specific. "Removed the spam files from the uploads folder, reinstalled all plugins, updated everything, changed all passwords and enabled two-factor sign-in" beats "fixed it."
Google's help page says to describe how the site was cleaned, so give it real details.
Pro tip: keep notes as you clean (what you found, what you removed, what you changed). They become your review request almost word for word.
Do not resubmit repeatedly. One honest request with a clear explanation does more than five rushed ones.
If the Security Issues report was empty and you had no manual action, there may be no button to press. The label can clear on its own after Google re-crawls the clean site.
How Long Does It Take
The honest answer is "it depends," and Google does not give a single number for every case. What its help page does say is:
- Reviews for sites hacked with spam may require up to several weeks to process.
- After Google confirms the site is clean, the warnings are removed within a few days after you receive your notice.
Google's malware help page gives no timing for reviews at all, so treat any promise of "24 hours" from a random website with suspicion. In the meantime you can ease the pain:
- Keep the site clean while you wait. A reinfection can send you back to the start.
- Keep Search Console open and watch for emails from Google.
- Tell customers by email or social media that you had a security problem and fixed it. A short, calm note beats silence.
What to Tell Your Customers
While the label is up, your visitors may be nervous, and some will write to ask if it is safe. A short, honest message goes a long way.
Say that Google flagged a security problem, that you are cleaning it up, and roughly when you expect to be done. Do not hide it, and do not go into technical detail. If you take payments or store customer accounts, check whether personal data could have been exposed, and tell the people affected if it could. Your host or a legal adviser can help with the rules that apply where you work.
When you see this site may be hacked under your own listing, the temptation is to hope it goes away on its own. It rarely does. The sooner you start, the sooner it is behind you.
Keep It From Happening Again
Most reinfections happen because the cleanup missed the original hole. After a hack, a few habits are worth having:
- Scan on a routine. Pro adds scheduled scans, and Free lets you scan manually whenever you like. See pricing for the plans.
- Take backups before changes. Stack Guard Free makes manual full or database-only backups that are verified before they count.
- Watch for file changes. Pro includes file change monitoring that tells you when something was added, changed or removed.
- Keep everything updated. Old plugins are the most common way in.
You can also run the free security check for a quick look at your site's outward-facing basics.
If you need a plain checklist for hardening afterwards, the WordPress hardening checklist is a good place to start.
Sources. Google's descriptions of the label, the Security Issues report and review times come from Google's help article on hacked content and its malware and unwanted software documentation. Check them for the latest wording, because Google updates these pages.