“This Site May Be Hacked” on WordPress: How to Remove Google’s Warning (Step by Step)

If Google shows “This site may be hacked” under your website in search results, it means Google found pages on your site that a hacker changed or added. To remove the warning you need to do four things in order: clean the hack completely, fix every issue listed in Google Search Console, request a review, and then lock the site down so it does not happen again. Asking Google to remove the warning before the site is clean does not work.

This guide walks you through each step in plain English, including exactly where to click in Search Console and what to write in your review request.

What does “This site may be hacked” mean?

Google adds this label when its systems find content on your site that a third party put there without your permission. Most of the time this is spam: pages selling fake medicines, counterfeit goods or gambling, often in Japanese or another language, or links that redirect visitors to other websites.

The confusing part is that your site often looks completely normal when you visit it. Many hacks show the spam only to Google’s crawler, or only to people who arrive from Google search on a phone. You may only find out when a customer tells you, or when you search for your own business.

The label tells searchers your site may not be safe, so fewer people click. Some will not visit at all.

What the warning is not

• It is not something you can ignore. It stays on your listing until Google confirms the site is clean.
• It is not fixed by changing your theme or “updating the website”. The malicious code usually lives in files, plugins or the database, not just in the design.
• It is not fixed by contacting Google first. Google will only review your site after you have cleaned it and told them what you fixed.

Step 1: Contain the damage

Before you change anything, stop the problem getting worse and protect yourself.

1. Tell your hosting company. They can see server logs, may already have flagged the account, and some will help with the cleanup.
2. Put the site in maintenance mode if it is redirecting visitors to spam or showing harmful pages. A simple maintenance-mode plugin or your host’s tools can do this.
3. Take a full backup of the hacked site: all files plus the database. It feels strange to back up a hacked site, but if something goes wrong during the cleanup you need a way back, and the backup helps you work out how the attacker got in.

Important: this backup contains the malware. Label it clearly, store it outside your website folder, and never restore it as your “clean” version.

Step 2: Clean the site properly

This is the step most people rush, and it is why the warning so often comes back. Deleting only the files a scanner flags is rarely enough. Hackers usually leave a hidden “backdoor” so they can get back in later.

Scan the site

Use a reputable security plugin or service such as Wordfence, Sucuri or MalCare to scan your files and database. Write down every file and database entry it reports. Treat the scan as a starting point, not the finished job.

Replace WordPress core files

Download a fresh copy of WordPress from wordpress.org and replace the wp-admin and wp-includes folders with clean ones. Do the same for every plugin and theme: delete them and reinstall fresh copies from the official source. Remove any plugin or theme you do not use.

Check the places hackers like to hide

• .htaccess: look for redirect rules you did not add, especially ones that check whether the visitor came from Google or is on a phone.
• wp-config.php: look for unfamiliar code at the top or bottom of the file.
• index.php in the main folder, and your theme’s header.php and functions.php: look for long strings of scrambled text or code you do not recognise.
• The wp-content/uploads folder: it should hold images and documents, not .php files.
• The database: in the wp_options table, check that siteurl and home show your own domain. Look for spam posts or pages, and for injected scripts in posts and widgets.
• Users: in WordPress go to Users and delete any administrator account you do not recognise.

Find how they got in

The most common entry points are outdated plugins or themes, weak or reused passwords, and an old PHP version. If you do not find and close the way in, the site will be hacked again, often within days. Our guide on what to do when WordPress is hacked covers the full cleanup in more detail.

Step 3: Check what Google sees

Once the site is clean, look at it the way Google does. You need access to Google Search Console for your website. If you have never set it up, add and verify your site at search.google.com/search-console first.

Find the Security issues report: click by click

1. Open Google Search Console and choose your website from the property menu at the top left.
2. In the left menu, scroll down and click Security & Manual Actions to open it.
3. Click Security issues.
4. If Google has flagged your site you will see a list of issues, for example Hacked: content injection, Hacked: code injection or Hacked: URL injection. If it says No issues detected, the warning may be from an older detection that has already cleared, or Google may not have reported it here yet.
5. Click each issue to open it. Google lists sample URLs where it found the problem. Open every sample URL and confirm it now shows clean content or a “404 not found” page.

Also check Security & Manual Actions > Manual actions. If there is a manual action for spam, it needs fixing too.

Check Google Safe Browsing

Visit Google’s Safe Browsing site status page and enter your domain. If it reports the site as unsafe, that is the more serious “This site may harm your computer” type of warning, and the same cleanup and review process applies.

Remove spam pages from Google

If Google indexed spam pages on your domain, make sure those URLs now return a 404 or 410 error. For a quicker cleanup of search results, use the Removals tool in Search Console to temporarily hide the worst ones while Google re-crawls.

Step 4: Request a review in Search Console

Only do this when every issue in the Security issues report is fixed. Google reviews the whole site, not just the pages it listed.

1. Go back to Security & Manual Actions > Security issues.
2. Tick the box that says you have fixed the issues.
3. Click Request review.
4. Describe what was wrong and exactly what you did to fix it, then submit.

What to write in the review request: an example

Keep it short, factual and specific. Google wants to know that you understood the problem and fixed the cause, not only the symptoms. For example:

Our WordPress site was hacked through an outdated plugin, which allowed spam pages and a redirect to be added. We have:
1. Removed all spam pages and the injected redirect code from .htaccess and the theme files.
2. Replaced WordPress core, all plugins and the theme with fresh copies from official sources, and deleted the outdated plugin.
3. Removed two unknown administrator accounts and reset all passwords (WordPress, hosting, FTP and database).
4. Confirmed the sample URLs in this report now return 404.
5. Added a security plugin, two-factor login and daily off-site backups.

Change the details so they match what actually happened on your site. Do not copy the example word for word.

Do not request a review too early

If Google reviews the site and still finds hacked content, the request fails and the warning stays. You then have to clean up again and submit another request. If a site keeps going back and forth between clean and infected, Google can treat it as a repeat offender and stop accepting review requests for a period of time. It is far quicker to get the cleanup right the first time.

How long does Google take?

Google says reviews for malware are usually processed within a few days, while reviews for spam-type hacks can take several weeks. You will get a message in Search Console when the review is done. There is no way to pay for a faster review, and nobody can guarantee the outcome. Once Google confirms the site is clean, the label is removed from search results.

Step 5: Harden the site so the warning does not come back

• Update everything: WordPress core, all plugins and your theme. Turn on automatic updates for minor releases.
• Update PHP to a supported version. See our guide on how to update PHP in WordPress safely.
• Reset every password: WordPress users, hosting account, FTP/SFTP and the database. Use a password manager and never reuse passwords.
• Remove unknown or unused admin accounts and give each person only the access they need.
• Turn on two-factor authentication for every administrator.
• Disable the built-in file editor by adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php, so a stolen login cannot edit your PHP files.
• Stop PHP running in the uploads folder. Your host or security plugin can block it, which stops a common type of backdoor.
• Set up automatic off-site backups and keep several days of history, so you can restore a clean version quickly.
• Add monitoring: a security plugin with file-change alerts, and a weekly look at Search Console.

For the full list, work through our WordPress security checklist.

When to get professional help

A simple hack can be a reasonable do-it-yourself job if you have a clean backup and are comfortable in your hosting panel. Get professional help if:

• You cannot log in to wp-admin, or your admin account has been removed.
• The hack keeps coming back after you clean it.
• Google has indexed hundreds or thousands of spam pages.
• You run a WooCommerce store with customer and order data.
• Your hosting company has suspended the account.

Frequently Asked Questions

Need help removing the warning?

Codixity builds and fixes WordPress websites for clients in the USA, UK and worldwide, including hacked-site cleanup. We have worked on 350+ projects over 6+ years. We find how the attacker got in, clean the site properly, prepare your Search Console review request, and secure the site so the warning does not come back. Ongoing care plans start from $49/month. Contact Codixity for a fixed quote.