Moatline

“This site may be hacked” in Google: how to get the warning removed

Google has spotted pages on your site that a hacker changed or added, usually spam. The label stays until you clean the site and ask Google to check again. Here is the whole process, in order.

By the Moatline team at Next Nova Technologies · Published 15 October 2026 · 5 min read

You searched for your own business and saw “This site may be hacked” under your link. It’s alarming, but it’s fixable, and the steps are the same for almost every WordPress site.

What the warning means

Google shows this label when it believes a hacker has changed pages on your site or added new ones, almost always to show spam. Common examples are thousands of pages selling fake designer goods or pills, Japanese spam pages, or visitors from Google being redirected to spam sites.

The spam is often hidden from you. Many hacks only show it to Google, or only to visitors who arrive from a search, so your site can look perfectly normal when you type its address.

If Chrome shows a full-screen red “Deceptive site ahead” or “The site ahead contains malware” warning instead, the steps below still apply. That warning comes from Google Safe Browsing and is reviewed faster.

Step 1: Open Search Console

Google Search Console is Google’s free dashboard for site owners, and it is the only place you can ask Google to remove the label.

  1. Go to search.google.com/search-console and sign in. If your site isn’t there yet, add it and verify it. The DNS method works for the whole domain.
  2. Open Security & Manual Actions → Security issues. Google lists the problem type (for example “Hacked: content injection” or “Hacked: URL injection”) and some sample URLs.
  3. Open Settings → Users and permissions. If you see an owner you don’t recognise, an attacker may have added themselves. Remove them, and remove their verification file or DNS record so they can’t get back in.

Step 2: Find the hacked pages

  • Search Google for site:yourdomain.com and look through several pages of results for titles you didn’t write, foreign-language text or odd URLs.
  • Check the sample URLs from the Security issues report with URL inspection → Test live URL → View tested page. This shows what Google sees, which may be different from what you see.
  • Check the Pages report (Indexing → Pages) for a sudden jump in indexed pages. Thousands of new pages you didn’t create is a strong sign of spam.
  • Check your sitemaps (Indexing → Sitemaps). Delete any sitemap you didn’t add.

Step 3: Clean the site

Deleting the spam pages is not enough. The code that creates them, and the way the attacker got in, must go too, or the spam returns within days.

  1. Back up files and database before changing anything.
  2. Scan everything. Spam generators hide in fake plugins, must-use plugins, modified core files, the uploads folder and the database. The free Moatline Malware Scanner checks all of these and compares every plugin file with its official WordPress.org copy.
  3. Check .htaccess files yourself. Spam hacks often add rewrite rules that send search engines to a PHP spam generator. Moatline does not check .htaccess rules, so open each one and remove anything you didn’t add.
  4. Remove unknown admin users (see unknown admin user), update everything, change all passwords and generate new security keys.
  5. Make sure the spam URLs now return “not found”. Don’t redirect them to your home page. A 404 or 410 tells Google the pages are gone for good.

Our malware removal guide walks through each cleanup step in detail.

Step 4: Ask Google to review

  1. Back in Security issues, click Request review.
  2. In a few sentences, say what you found, what you removed and how you closed the hole. Be specific: Google wants to see that you fixed the cause, not just the symptom.
  3. Submit an up-to-date sitemap with only your real pages, then use URL inspection to Request indexing for your home page and most important pages.

If Security issues lists nothing but the label still shows, skip the review: clean the site, make sure the spam URLs return 404, and request indexing for your main pages so Google recrawls them sooner.

How long it takes

According to Google, reviews for hacked spam can take up to several weeks, malware reviews take a few days, and phishing reviews take about a day. Once Google confirms the site is clean, it removes the warnings within 72 hours. If the review fails, Google tells you why. Fix what it found and request a review again.

While you wait, keep scanning. If anything reappears, the attacker still has a way in, and a second failed review makes the next one slower.

Sources: Google’s “This site may be hacked” help page and guide to requesting a review.

Frequently asked questions

Will the warning go away by itself?
Not reliably. Google says the message is not removed until the site owner takes action. If Search Console lists a security issue, you need to clean the site and request a review. If it lists nothing, the label can clear once Google recrawls the cleaned pages, but requesting indexing of your main pages speeds that up.
Does “This site may be hacked” hurt my rankings?
It hurts clicks straight away, because many people won’t visit a site with that label, and hacked spam pages compete with your real ones. Once the site is clean and the label is gone, rankings usually recover as Google recrawls the site.
Is this the same as the red “Deceptive site ahead” screen?
No. “This site may be hacked” is a label in search results, usually for spam. The full-screen red warning in Chrome comes from Google Safe Browsing and means Google found malware or phishing. Both are fixed the same way: clean the site, then request a review in the Security Issues report.
What should I write in the review request?
Say what you found, what you removed and how the attacker got in, in a few plain sentences. For example: removed 2,400 spam pages created by a fake plugin, deleted an unknown admin account, updated the vulnerable form plugin, changed all passwords.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides

All guides →