Guide

Google says "this site may be hacked". Here's how the warning actually comes off.

by Ken Armitt, Founder · updated 30 July 2026

The warning is removed by fixing the hack first, then requesting a review in Google Search Console (Security Issues → Request Review). Google re-checks your site and typically clears legitimate requests within 72 hours. Requesting review before the site is genuinely clean is the trap: failed reviews slow every later attempt.

Do this now

Clean the infection completely — including backdoors, not just visible spam
Verify your site in Google Search Console and read Security Issues for Google's own evidence
Request review only when genuinely clean; failed requests cost you days

What the warning actually means

Google shows "this site may be hacked" in search results when its crawlers find injected spam content, cloaked pages or malicious redirects on your site. The harsher full-page red screen ("Deceptive site ahead") comes from Safe Browsing and means malware or phishing was detected. Different systems, similar cure: the site must actually be clean before Google will look again.

Step by step

See what Google saw. Verify the site in Search Console. Security Issues lists detected URLs and the category (hacked content, malware, deceptive pages) — this is your evidence trail, use it before cleaning.
Clean the actual infection. Injected pages, modified templates, database spam, and — critically — the backdoors that let attackers put it back. If you only delete the spam pages, the warning returns because the access does.
Close the entry point. Google re-flagging a "cleaned" site days later almost always means the vulnerability or stolen credential was never addressed.
Request review. Security Issues → Request Review, with a short honest description of what was cleaned and how. Most legitimate reviews clear in 24–72 hours.
Watch for a week. Re-crawls continue after clearance. Any surviving cloaked content brings the flag straight back.

The traps

Requesting review too early. Each failed review makes the next one slower. One clean, one request.
Cloaked spam. Many hacks show spam only to Googlebot, not to you. Use Search Console's URL Inspection → View crawled page to see your site as Google does.
Cleaning the site but not the sitemap. Thousands of injected URLs may sit in the index. 404/410 them properly so rankings can recover.

When you want it handled

A senior engineer responds within the hour, 24×7, at a fixed published price — and you get the evidence pack at the end.

Start my rescue Free scan first