Security issue recovery

Hacked Site - Google Security Issue Recovery

Google has found content on your site that somebody else put there, and whether it's showing in the Security issues report or as a warning in the search results, we clean the site, close the way in and get it reviewed.

Free recovery brief · Written diagnostic · Fixed quote before booking

Is this the message in your Search Console?

Google’s Manual Actions report ↗

Search Console / Report example

Security issues

Hacked content (Security issues report)

WHAT DOES IT MEAN WHEN GOOGLE SAYS YOUR SITE IS HACKED?

It means Google has detected pages or code on your site that appear to have been placed there by a third party without your permission, and strictly speaking this is now handled in the Security issues report in Search Console and not in the Manual actions report, although plenty of people still describe it as a Google hacked site penalty because the effect on traffic feels exactly the same. The Security issues report covers hacked content along with behaviour that could harm a visitor, such as phishing or malware.

WHAT DOES IT DO TO YOUR SITE?

Pages with a security issue can appear in the search results with a warning label, or a browser can show a full-screen warning when somebody tries to visit, and as you'd expect, very few people click past a message telling them the site may harm their computer. Hacks are also behind a lot of the other manual actions on this site, because injected redirects lead to cloaking and sneaky redirect actions and injected pages lead to spam actions.

Scope: Compromised pages and files
Typical clean-up time: Estimated after diagnosis
Review time: Depends on the security issue

WHY DID GOOGLE FLAG IT?

An attacker has created hundreds or thousands of new pages on your domain selling pharmaceuticals, counterfeit goods or gambling, which you only find when you run a site: search

Hidden links or text have been injected into your existing pages to pass ranking signals to the attacker's sites

Code has been added that redirects visitors arriving from Google to another site while you see your normal pages when you visit directly

Malicious code has been inserted that attempts to install software on visitors' devices or collect their details

An outdated CMS, plugin or theme, or a weak or reused password, gave the attacker their way in

HOW DO WE FIX IT?

We review the Security issues report and the example URLs and work out the type and extent of the hack
Security report inventory
Evidence log · Hacked site
Affected URL or template
Action taken
Verification date
We find everything the attacker added or changed, including files, database content, user accounts, scheduled tasks and server configuration
Compromise assessment
Evidence log · Hacked site
Affected URL or template
Action taken
Verification date
We clean the site or restore it from a known clean backup, and return a 404 or 410 for the spam URLs the attacker created so they drop out of the index
Clean-up log
Evidence log · Hacked site
Affected URL or template
Action taken
Verification date
We identify and close the vulnerability, update the software, reset every credential and remove any backdoors, because a site that's cleaned without closing the hole is usually hacked again within days
Vulnerability remediation
Evidence log · Hacked site
Affected URL or template
Action taken
Verification date
We request a review through the Security issues report, and deal with any related manual action at the same time
Security review record
Evidence log · Hacked site
Affected URL or template
Action taken
Verification date

WHAT GOES INTO THE REVIEW REQUEST?

The request explains what was found, how the attacker got in, what was removed and what has been done to secure the site, and it confirms that the example URLs Google listed are now clean or gone.

Reconsideration request service →

Questions about recovery

Is being hacked a manual action?

Hacked content is reported under Security issues in Search Console, however the things a hacker does to your site, such as injecting spam pages or cloaked redirects, can result in a manual action as well, so we always check both reports.

How do I get rid of the thousands of spam pages in Google?

Once the pages are deleted and returning a 404 or 410 they drop out of the index as Google recrawls them, and we can speed that up for the worst of them.

How long does recovery take?

Your diagnostic will include a clean-up estimate, and security review timing depends on the issue.

Start your recovery brief