# "This site may be hacked": why Google shows it and how to remove it > "This site may be hacked" is a label Google adds under a search result when it believes someone changed the site or added spam pages. It goes away once the site is clean and Google has checked it. Here is how to confirm the cause, clean up and ask for the review. Updated 2026-09-26 · Security · HTML version: https://getreport.app/guides/this-site-may-be-hacked "This site may be hacked" is a line Google adds under a search result when its systems believe a third party has changed the site's pages or added new spam pages. It usually means spam text, links or pages were injected, often hidden from the owner, and Google found them while crawling. The label goes away once the site is clean and Google has checked it again, which you speed up with a review request in Search Console. This guide explains what triggers the label, how to find the cause, and the exact steps to have it removed. It is part of the [hacked website guide](https://getreport.app/guides/is-my-website-hacked), which covers the full cleanup. ## Quick answer - **The label means Google found hacked content**, such as injected spam, generated pages or redirects. Visitors can still click the result, but many will not. - **Look in Search Console** → Security & Manual Actions → Security issues for the hack type and sample URLs. - **Confirm it** with a `site:` search, URL Inspection and the [hacked site checker](https://getreport.app/tools/hacked-site-checker); many hacks only show to Googlebot. - **Clean everything:** the spam, the code that adds it, the backdoor and the way in. Then change every password. - **Request a review** in the Security issues report. If the report shows no issue, there is nothing to request: the label goes after Google recrawls the clean site. - **Expect days to weeks.** Google's guidance says reviews of spam hacks can take several weeks. ## If you are a visitor The label is a warning from Google, not proof that the site is dangerous. It is about spam that someone added, which is usually a risk to the site's reputation more than to you. Still, be careful: do not log in, download files or enter payment details on the site until the label is gone, and if a result sends you somewhere unexpected, close the page. If you know the owner, tell them; they are often the last to know. ## What the label means, and what it does not Google shows "This site may be hacked" when it believes the content on the site was changed by someone other than the owner. That covers three kinds of hack: | Hack type | What the attacker did | How it usually shows | | --- | --- | --- | | Content injection | Added spam text or links to existing pages | Pharma, casino or loan links, often visible only to Googlebot | | URL injection | Created new pages on your domain | Thousands of spam URLs, often in Japanese, sometimes added to your sitemap | | Code injection | Added code that redirects or loads spam | Visitors from Google sent to another site | It is different from the other warnings Google and browsers show: - **"This site may harm your computer"** under a result, and Chrome's full-page red warnings such as **"Deceptive site ahead"** or **"Dangerous site"**, come from Google Safe Browsing and mean malware, phishing or harmful downloads. Those block visitors before the page loads. [Flagged by Google Safe Browsing](https://getreport.app/guides/google-safe-browsing-flag-what-to-do) covers them. - **A manual action** such as "Cloaking and/or sneaky redirects" or "Pure spam" is a penalty for spam the owner is responsible for. It appears under Manual actions, not Security issues. The label hurts even though visitors can click: a result marked as hacked gets far fewer clicks, and Google may also rank the spam pages or the site lower. ## Why your site got the label Most hacked sites were not targeted. A bot found an outdated plugin, a guessed password or an exposed file, and used it to add spam that makes money for someone else: links that help other sites rank, pages that sell counterfeit goods, or redirects to scams. Owners rarely see it, because the spam is built to hide. It is served only to Googlebot, only to visitors who arrive from a Google result, or only to people who are not logged in. [What is cloaking in SEO?](https://getreport.app/guides/what-is-cloaking-in-seo) explains how that works. So the label is often the first sign. ## How to find what triggered it ### 1. Search Console's Security issues report Verify the site in Google Search Console if you have not. Then open **Security & Manual Actions → Security issues**. - If Google lists an issue, it names the type (for example "Hacked: content injection" or "Hacked: URL injection") and shows sample URLs. Open each sample: they tell you where to look. - If the report says no issues were detected, the label may come from automatic detection that is not listed there. You still need to find and fix the hack; you just will not request a review for it. While you are in Search Console, open **Settings → Users and permissions**. An owner you do not recognise is a strong sign of the Japanese keyword hack, where attackers verify themselves to submit their spam pages. Remove them and the verification token they used (an HTML file, meta tag or DNS record). ### 2. See what Google sees Use **URL Inspection** on the sample URLs and on your home page: Test live URL, then View tested page → HTML. That is the page as Googlebot fetches it from Google's own addresses, so it shows spam hidden from everyone else. Search the HTML for words and domains that are not yours. Then search Google itself: ```text site:example.com site:example.com viagra site:example.com casino site:example.com inurl:.html ``` Pages you never created, titles in a language you do not publish in, or spam words in the titles are injected content. ### 3. Compare the copies > **Free tool:** [View a page as Googlebot: hacked site checker](https://getreport.app/tools/hacked-site-checker): View your page as Googlebot and as a visitor from Google, side by side, to find cloaking, pharma and casino spam links and hidden redirects. Free, no sign-up. The hacked site checker fetches a page three times, as a normal visitor, with Googlebot's user agent and as a visitor arriving from Google, and lists text, links and redirects that only some of them receive. Run it on the sample URLs from Search Console and a few older posts, not only the home page. > **Check: Visitors and Googlebot see the same page text.** The page was fetched as a normal visitor, as Googlebot and as a visitor arriving from Google. The bot or Google-referrer copies contain text that visitors never see. That is the pattern of a hacked site that hides spam from its owner, and Google treats cloaking as a violation. Some sites vary content by user agent on purpose; check the evidence. > > 1. Open the page as Googlebot (Search Console URL Inspection → View crawled page, or curl with a Googlebot user agent) and compare it with a normal visit. > 2. If the extra content is not yours: change every password, update WordPress, themes and plugins, scan the file system for modified core files and unknown PHP files (wp-content/uploads, mu-plugins), restore from a clean backup if in doubt, then request a review in Search Console under Security Issues. > **Check: No spam links and no links served only to bots.** Links with pharma, gambling, loan or replica vocabulary, or links that only Googlebot and Google visitors receive, are the fingerprint of an injection: someone is using your domain's reputation to rank their pages. Google demotes sites that carry them. > > 1. Search the database and theme files for the linked domains (wp_posts, wp_options, header.php, footer.php, functions.php) and remove the injection; look for an unknown plugin or a modified core file that re-adds it. > 2. Update everything, rotate passwords and keys, then request a review in Search Console. > **Check: No redirect that fires only for Googlebot or Google visitors.** The page sends visitors who come from Google, or Googlebot itself, to another site, while direct visitors see the normal page. Owners rarely notice because they never arrive from Google. Search results show the spam target and the site loses its rankings. > > 1. Look for the redirect in .htaccess or the nginx config, in wp-config.php and index.php, in theme header and footer files, in the database (wp_options siteurl/home and injected scripts in posts), and in inline scripts that read document.referrer. > 2. Remove it, update and clean the site, rotate passwords, and request a review in Search Console. > **Check: No hidden outbound links.** Links inside containers with display:none, visibility:hidden, zero font size or an off-screen position are invisible to visitors but counted by search engines. Legitimate pages rarely need them; injections use them constantly. > > 1. Find the hidden container in the page source (search for the linked domain) and remove it. If it comes from a plugin or theme, that is the compromised or spammy component. > 2. If the links are yours and intentional (a collapsed menu, a screen-reader-only list), keep them; the finding is a warning, not a penalty. The checker fetches from getReport's servers and does not run JavaScript, so spam keyed to Google's IP addresses or added by a script can pass it. Trust Search Console where they disagree. ## How to remove "This site may be hacked" The label only goes when the site is really clean. A review request for a half-cleaned site fails, and the next one takes longer. ### Step 1: clean the site completely Follow the order in [the hacked website guide](https://getreport.app/guides/is-my-website-hacked): save a copy of the hacked state, update everything, find the injected content and the backdoor that adds it, reinstall core, plugins and theme from clean sources, and change every password and key. On WordPress, [recovering a hacked WordPress site](https://getreport.app/guides/recovering-a-hacked-wordpress-site-step-by-step) has the command-line walkthrough. The guides to [pharma and casino spam](https://getreport.app/guides/pharma-and-casino-spam-injections-how-they-hide), the [Japanese keyword hack](https://getreport.app/guides/japanese-keyword-hack-symptoms-and-recovery) and [redirect hacks](https://getreport.app/guides/hacked-website-redirects) show where each kind hides. ### Step 2: deal with the spam URLs Pages the attacker created should now return **404** or **410**, not redirect to your home page and not show an empty 200 page. Remove them from any sitemap and resubmit the clean sitemap in Search Console. For a few pages that must disappear from results quickly, the Removals tool in Search Console hides them for about six months while Google recrawls; it does not replace fixing them. ### Step 3: check that it is clean - The hacked site checker shows no differences on the sample URLs. - URL Inspection's live HTML contains none of the spam. - `site:` searches show no new spam pages after Google recrawls (old ones take longer to drop). - A week later, run the checks again. Spam that returns means a backdoor survived. ### Step 4: request a review In Search Console → Security & Manual Actions → Security issues, confirm that you have fixed the issues and click **Request review**. In the text box, say briefly and specifically what you found and did: which files or database entries contained the spam, how the attacker got in, what you removed and reinstalled, and what you changed to stop it happening again. Google's guidance says reviews for malware take a few days, while reviews for sites hacked with spam can take up to several weeks because they may involve manual checks. You get a message in Search Console with the result. If the review is approved, the issue disappears from the report and the label is removed from results as Google processes the site. If the Security issues report showed no issue, there is no review to request. Once the site is clean, Google detects the fix the next time it crawls the affected pages and removes the label. Requesting indexing for the key URLs in URL Inspection can help it look sooner. ### If the review is rejected The message usually includes example URLs that still show the problem. Test those exact URLs as Googlebot, look for the part you missed (often a second backdoor, a cron job or a hidden plugin in `wp-content/mu-plugins/`), clean again and request a new review with the details. ## After the label is gone Rankings return as Google recrawls and reprocesses the clean pages, which can take weeks for a large site. Keep the site updated, give every administrator two-factor login, and check the hacked site checker and Search Console's Security issues report monthly for a while. The [WordPress security checklist](https://getreport.app/guides/wordpress-security-basics-without-a-plugin) covers the hardening. ## Common mistakes - **Requesting a review after deleting only the visible spam.** The backdoor re-adds it, the review fails, and the next one waits longer. - **Redirecting spam URLs to the home page.** Google may treat them as soft 404s and keep them around. Return 404 or 410. - **Forgetting the attacker's Search Console access.** An unknown owner can keep submitting spam sitemaps. Remove them and their verification token. - **Checking only while logged in.** Many injections skip logged-in users. Use URL Inspection and a private window. - **Waiting for the label to vanish on its own when a review is available.** If Security issues lists the hack, the review is what triggers the recheck. ## Questions people ask ### How do I remove "This site may be hacked" from Google? Clean the site completely first: remove the injected content and the backdoor that added it, update everything, and change every password and key. Then, in Search Console → Security & Manual Actions → Security issues, confirm you fixed the issues and request a review, describing what you removed. The label disappears after Google verifies the site, which Google says can take from a few days to a few weeks. ### Why does Google say my site may be hacked when it looks fine? Because the hack hides from you. Injected spam is often served only to Googlebot, only to visitors who arrive from a Google result, or only to people who are not logged in, so the owner sees a normal page. Use URL Inspection in Search Console to see the HTML Googlebot receives, search `site:yourdomain.com` for pages you never created, and compare fetches with the hacked site checker. ### How long does it take for the hacked label to go away? After an approved review, usually days; the review itself can take from a few days for malware to several weeks for spam hacks, according to Google. If Search Console lists no security issue, the label goes when Google recrawls the clean pages, which depends on how often it crawls your site. Rankings for the affected pages can take longer to recover. ### What if the Security issues report in Search Console is empty? Then the hack was probably detected automatically and there is no review to request. You still have to find and remove it: check URL Inspection's HTML, `site:` searches and the hacked site checker, then clean the site. Google removes the label when it recrawls the affected pages and finds them clean; requesting indexing for key URLs can speed that up. ### Is "This site may be hacked" the same as a Google blacklist? No. The hacked label is a line under the search result, and visitors can still click through. What people call the Google blacklist is usually Safe Browsing, which shows a red full-page warning such as "Deceptive site ahead" in Chrome and other browsers before the page loads. Both need a clean site and a review in Search Console's Security issues report.