Google Search Console Says My Site Has Security Issues

What's happening

A Security issues notice in Google Search Console, or an email from Google with a subject like "Hacked content detected on" your site, means Google found hacked or harmful content on your website. The first safe step is to open Search Console yourself, by typing search.google.com/search-console into your browser instead of clicking the email, and read the Security issues report.

Going in directly is a good habit with any security email, and it takes you to the real report either way. Google's help page for the report groups problems into three kinds:

• Hacked content: someone added pages, links, or code to your site. You may see labels like "Hacked: Content injection", "Hacked: Code injection", or "Hacked: URL injection".
• Malware and unwanted software: your site is serving something that can harm visitors' devices.
• Social engineering: pages that trick people, such as a fake login or payment page. These show as "Deceptive pages".

Each issue comes with example pages. Treat them as a starting point, not the full list. The same problem often shows up in other places too, like a red Chrome warning for visitors or a "This site may be hacked" label in search results. They all come from the same problem, so they share one fix.

Why it happens

Usually an attacker got in through an outdated plugin, theme, or WordPress version, or a weak or reused password. Most attacks are automated bots looking for known holes, so it's rarely personal. For the bigger picture, see My WordPress site was hacked.

What you can safely try

• Write down every issue and example page in the report. Whoever cleans the site will need them.
• Check who has access to Search Console under Settings, then Users and permissions. An owner you don't recognize is important to mention.
• Change your passwords for WordPress, hosting, and email from a device you trust.
• Don't click Request Review yet. Google asks you to fix every issue on every affected page first, and to explain what you did. A request on a site that isn't clean fails.

When to call us

We work on business websites, and this notice is the kind of cleanup we do. We clean the site, close the gap the attacker used, and write the review request with you: what was wrong, what we fixed, and what we changed to keep the attacker out. That's the detail Google asks for. Clearing the notice is Google's decision, made on Google's timeline. We clean it up at a flat rate you approve before any work starts. Start with our Hacked Site Cleanup.