Hacked Website SEO: Signs, Cleanup and Recovery in Google

Key takeaways

Check the Security issues report in Search Console first: it is Google's source of truth for hacked content and malware.
Spam pages in a site: search, unknown Search Console owners and strange redirects are classic signs.
Back up, clean everything, fix the vulnerability and change every password before asking Google for a review.
Reviews of sites hacked with spam can take several weeks; requesting one too early makes it longer.

Security problems look like SEO problems from the outside: traffic drops, odd pages in Google, a warning in the results. In technical SEO work, I treat a hack as an emergency, because every day it stays online, Google and your customers see the spam. This guide follows Google's own help for hacked sites. If you suspect a penalty rather than a hack, read Google penalty or traffic drop? first; the two are handled in different reports.

How do I know if my website has been hacked?

The clearest signs are a message in Search Console's Security issues report, a "This site may be hacked" label under your result in Google, pages in a site: search that you never created, often in Japanese or full of brand or pharmacy keywords, new Search Console owners you do not recognize, and pages that redirect visitors elsewhere.

Open Search Console, then Security and manual actions, then Security issues.
Search Google for site:yourdomain.com and scroll: look for URLs and titles you did not create.
In Search Console settings, check Users and permissions for unknown owners.
Open a suspicious URL from a Google result on your phone: hacked pages often show spam only to visitors coming from search.
Check your sitemap for URLs or sitemaps you do not recognize.
Ask your hosting company whether they have flagged malware on your account.

What does Google's "This site may be hacked" warning mean?

Google shows that label when it believes a hacker may have changed existing pages or added spam pages to your site. It warns people before they click. The label stays until you clean the site, fix the vulnerability and request a review in the Security issues section of Search Console, and Google confirms the site is clean.

That explanation is in Google Search Help on the "This site may be hacked" message. The Security issues report lists the types of problems Google detects, grouped as hacked content, malware and unwanted software, and social engineering, with sample URLs. It also explains the difference with manual actions: a manual action usually lowers or removes pages without any visible warning, while security issues can show a warning label to users.

	Security issue (hack)	Manual action
What it is	Your site was compromised or harms visitors	A reviewer found the site breaks Google's spam policies
What users see	Possible warning label or browser warning page	No visible warning; lower rankings or removed pages
Where to check	Security issues report	Manual actions report
Guide	This article	Google penalty or traffic drop?

What is the Japanese keyword hack?

The Japanese keyword hack creates pages of autogenerated Japanese text on your site, usually in randomly named folders, filled with affiliate links to stores selling fake brand goods. Google can index those pages, so they appear in your site: results. Hackers often add themselves as Search Console owners and show the spam only to search engines or search visitors.

Google's guide to fixing the Japanese keyword hack walks through it and warns that hackers try to make the page look gone or fixed, for example by showing a 404 to you while still showing spam to Google. Use the URL Inspection tool in Search Console to see what Googlebot sees. Similar hacks inject pharmacy, casino or gibberish pages; the cleanup logic is the same.

How do you fix a hacked website, step by step?

Follow this order: back up the hacked site, remove unknown Search Console owners, find and remove the hacker's files and database changes, reinstall your CMS, themes and plugins from clean sources, fix the vulnerability, change every password, make hacker-created URLs return 404, then request a review. Skipping the vulnerability step usually means getting hacked again.

Back up the current files and database before touching anything, even though they are infected.
Contact your hosting company: many have tools and support for compromised accounts.
Remove unknown owners in Search Console and delete their verification files or tokens.
Restore a clean backup if you have one, or clean the site: replace .htaccess, reinstall the CMS core, themes and plugins, and look for unfamiliar or recently modified files.
Delete unused plugins, themes and apps.
Update everything to current versions.
Change all passwords: hosting, FTP or SFTP, database, CMS admins, email linked to the site. Turn on two-step verification.
Make the spam URLs return 404 (Not Found) so they drop out of Google.
Check that real pages still work and are not blocked from Google.

Google's guide to cleaning and maintaining your site covers each case: clean recent backup, old backup or no backup. It also says the Removals tool is optional for hacker-created pages; serving a 404 works, just more slowly. Use the Removals tool only for URLs you never want in Google, never for your own pages that were only modified. For the general process, see how to remove a page from Google. If customer data may have been exposed, review your legal obligations with your counsel before deleting evidence.

How do you request a review after a hack?

When the whole site is clean and the vulnerability is fixed, open the Security issues report in Search Console, select Request a review and explain what you did for each issue. Google says reviews of sites hacked with spam can take several weeks, malware reviews a few days, and warnings are removed within 72 hours of approval.

Those timings are in Google's guide to requesting a review, which also warns that requesting one before the problem is truly fixed only extends the time your site stays flagged. Wait for a decision before resubmitting.

Will my rankings come back after a hack?

Often, but not instantly. Once the spam pages return 404 and Google recrawls the site, the spam drops out and your real pages can recover, but nothing guarantees a timeline. Recovery tends to be slower when the hack lasted months, when spam links pointed to your site or when real pages were changed or deleted.

Track it in the Search Console Performance and Page indexing reports, which I explain in Google Search Console for SEO. Keep in mind that Google's spam policies also cover hacked content, so a cleanup is not optional if you want your pages to compete.

How to prevent your site from being hacked again

Google lists the top ways sites get hacked by spammers: compromised passwords, missing security updates, insecure themes and plugins, social engineering such as phishing emails, security policy holes and data leaks. Prevention is mostly the reverse of that list.

Strong, unique passwords

One per account, in a password manager, with two-step verification on.

Updates

Keep the CMS, theme and plugins current, after a backup.

Fewer plugins

Remove what you do not use; install only from trusted sources.

Fewer admins

Give each person only the access they need, and remove ex-staff.

Automatic backups

Daily, stored off the server, and tested from time to time.

Monitoring

Search Console email alerts plus a security scanner that does not block Googlebot.

On that last point: security tools can overreach. In one case I worked on, a medical clinic's firewall was blocking Google itself, which I describe in this technical SEO case study. Protect the site, but test that Google can still read it. As an SEO consultant, I can check your Security issues report and indexing in a free diagnosis: book it here.

Frequently asked questions

Can I just delete the spam pages?

Deleting them is only part of the job. If the vulnerability stays open, the hacker usually recreates them within days.

Should I block spam URLs in robots.txt?

No. Google needs to crawl them to see they now return 404 and drop them from the index.

Does a hack mean I have a manual action?

Not necessarily. Hacks show in the Security issues report; manual actions in a separate report. Check both.

Do I need to tell my customers?

If personal data may have been exposed, there can be legal obligations. Check with your counsel.

Can a hack happen on Shopify or Wix?

Hosted platforms handle server security, but stolen passwords and risky apps can still compromise your store or account.

About the author

Juan José Giraldo is an SEO consultant in Medellín, Colombia, with 5+ years of experience. He works on technical and local SEO for 600+ US car dealerships at Reunion Marketing, an Inc. 5000 agency, and supervises the SEO of 18 US online stores with more than 3 million products at Prontomowers. Read more · LinkedIn.

Want to see these guides first? Choose JJ SEO Colombia as a preferred source on Google, and my articles are more likely to show up for you in Top Stories.

Follow on GoogleAdd as a preferred source

Hacked website SEO: how to spot it, clean it and get back in Google.