Google Says 'This Site May Be Hacked' Under My Website

What's happening

"This site may be hacked" under your listing in Google means Google believes someone changed some of your pages or added new spam pages to your site. The first safe step is to open Google Search Console and check its Security issues report, which shows what Google found and which pages are affected.

The label is a warning to searchers, not a ban. Your site still appears, and people can still click through, but Google tells them to avoid it until the message is gone. Google's own help page says only the site owner can clear it, by fixing the site and asking for a review in Search Console.

If your site isn't set up in Search Console yet, that comes first. It's the only place Google shows the details, and the only place to ask for a review.

Why it happens

Most often, an attacker got in through an outdated plugin or theme, or a reused password, and started using your site for their own ends. Common signs are hundreds of new pages selling pills, knock-off goods, or gambling, sometimes in another language. Another is a hidden redirect that sends visitors from Google to a scam site. You may not see any of it when you visit your own site, because these hacks often show themselves only to search engines and new visitors. For more on what a hack looks like, see My WordPress site was hacked.

What you can safely try

• Search Google for site:yourdomain.com, using your real web address. Page titles you never wrote are a strong clue.
• Open the Security issues report in Search Console and note the example pages it lists. Here's what that report means.
• Change your passwords for WordPress, hosting, and email from a device you trust. Look for admin users you don't recognize, and mention them to whoever cleans the site.
• Don't request a review until the whole site is clean. A review on a half-cleaned site fails, and the label stays.

When to call us

We work on business websites, and this label is the kind of cleanup we do. We remove the spam pages and hidden code, close the gap the attacker used, and help you send Google a clear review request through Search Console. If Search Console isn't set up, we set it up with you. Removing the label is Google's decision, made on Google's timeline, so our job is to make sure the site is genuinely clean when you ask. We clean it up at a flat rate you approve before any work starts. Start with our Hacked Site Cleanup.