How to remove the “This site may be hacked” warning from Google

Few things hurt a small business website faster than a Google warning. Click-through rates drop, customers call to ask whether it's safe to pay, and ad accounts can be suspended. The good news is that the warnings can be removed. The bad news is that there's no shortcut around cleaning the site first.

Two different warnings

It helps to know which one you're dealing with:

• "This site may be hacked" appears as a small label under your listing in search results. Google detected content that looks like it was added by a third party, typically spam pages or hidden links.
• "Deceptive site ahead" or "The site ahead contains malware" is a full-page red warning shown by the browser. It comes from Google Safe Browsing, which most major browsers rely on, and it means your site was caught phishing or distributing malware.

Both are reported in Google Search Console under Security & Manual Actions → Security issues, along with example URLs. That report is your starting point.

Step 1: Verify your site in Search Console

If you haven't already, add your site to Search Console and verify ownership. You can't see the details of the problem or request a review without it. Verify the domain property if you can, so every subdomain and protocol is covered.

Step 2: Clean the site completely

This is the step people try to skip. If you request a review while any part of the infection is still there, the review fails, and repeated failed requests can mean longer waits between reviews.

"Completely" means:

• Malicious files and injected code removed, including backdoors
• Spam pages deleted, so they return a 404 or 410 status
• Injected database content and rogue admin users removed
• The vulnerability that let the attacker in fixed

I've written about the full process in how I clean a hacked WordPress site.

Step 3: Deal with the spam URLs

For SEO spam, there may be thousands of junk URLs in Google's index. Once they return a 404 or 410, Google drops them as it recrawls them. Submitting an updated sitemap with only your real pages helps Google re-crawl the site.

The Removals tool in Search Console can hide URLs from results temporarily, which is useful for the most embarrassing ones. It doesn't fix anything, though, and the hiding expires after about six months.

Step 4: Request a review

In the Security issues report, click Request review. In the description, be specific about what you did:

Removed injected spam pages under /shop/xyz/, deleted malicious files in wp-content/uploads, removed two unauthorized administrator accounts, updated all plugins and replaced the vulnerable plugin that was used to get in.

A clear explanation shows you understood the problem rather than just deleting what you could see.

How long does it take?

Reviews for malware and phishing are usually processed within days. Reviews for hacked spam can take longer, sometimes a few weeks. Google makes the final decision, so be wary of anyone who promises the warning will disappear by a specific date.

Don't forget the other lists

Google isn't the only list. Some antivirus vendors and security services keep their own reputation databases. Free online scanners will show whether your domain is flagged elsewhere, and most vendors offer a review or false-positive form once the site is clean.

Stop it happening again

A warning that comes back a month later is worse than the first one, because it suggests the problem was never fixed. Harden the site after the cleanup: updates, strong passwords, two-factor authentication, a firewall and monitoring.

If Google is warning visitors away from your site, contact me and I'll help you clean it and request the review.