By Hridoy Ahmed | Last updated: October 2026 | 6 min read
Short answer: To remove the “This site may be hacked” warning, first clean your site completely and fix how the attacker got in. Then open the Security issues report in Google Search Console and request a review. Google checks your site and removes the warning if it is clean.
In this guide: What it means | Step 1 to 5 | How long it takes | Common mistakes | FAQ
This label appears under your result in Google when it finds signs that someone added content or code to your site without permission. It can cost you clicks and trust, so fix it quickly.
If you want an expert to clean the site and request the review, see my WordPress security and malware removal service.
What the warning means
Google found hacked content such as spam pages or injected links. This is different from a browser warning like “Deceptive site ahead”, which comes from Safe Browsing. Check both in Search Console. If you are not sure the site is hacked, start with the signs of a hacked WordPress site.
Step 1: Open the Security issues report
In Google Search Console, open Security & Manual Actions, then Security issues. It shows the type of issue and example URLs. If you have not verified your site, do that first.
Step 2: Back up and clean the site
Take a backup. Remove injected pages, code and links from files and the database. Remove unknown admin users. Do not stop at the example URLs, because more infected pages may exist.
Step 3: Fix the cause
Update WordPress, plugins and themes. Remove software you do not use. Change all passwords. Closing the way in is what prevents the warning from coming back. My WordPress security checklist lists the steps.
Step 4: Return correct responses for spam URLs
If spam pages are gone, they should return a 404 or 410 status. Remove them from your sitemap.
Step 5: Request a review
Open the Security issues report and choose the option to request a review. Explain briefly what you cleaned and what you fixed. Do this only when the site is fully clean. A failed review can delay things.
How long does it take?
Google does not give a fixed time. It can take several days. Check the report for the status.
Common mistakes
- Requesting a review before the site is clean
- Removing only the pages Google listed
- Leaving the vulnerable plugin in place
- Forgetting to check the database
FAQ
Will the warning hurt my rankings?
It can reduce clicks, and hacked spam content can hurt your visibility. Cleaning the site quickly limits the damage.
Do I need Search Console?
Yes. It is the main way to see the issue and request a review.
Can the warning return?
Yes, if the attacker still has access or the weakness is not fixed.
Need it done right? I clean the site, fix the cause and handle the review request. See my malware removal service.
About the author: Hridoy Ahmed is an SEO specialist and WordPress security expert based in Dhaka, Bangladesh. He has 8+ years of experience and works with clients worldwide.