Google says This site may be hacked

"This site may be hacked" is a line Google adds under a search result when it believes pages were changed without the owner's intent. It is not the full-screen Chrome block. Visitors can still open the site, and the line stays until Google recrawls a cleaned site, often after a review in Search Console.

What you are seeing

You search for your pages and, under the snippet, Google shows that sentence. Clicking through may load the real homepage with no other drama. The warning is about what the crawler found, which may be URLs you never open yourself.

This is different from Deceptive site ahead. That message replaces the page in Chrome and is tied to Safe Browsing. The search line is more often spam: Japanese keyword pages, pharmacy pages, casino pages, or a pile of doorway URLs. A site can have the search line, the Chrome warning, both, or a redirect with neither attached yet.

The label can also lag behind a real cleanup. Do not assume it is only a lag if you have not checked site:yourdomain.com recently.

Why it happens

Google is telling searchers the result may not be the site you think you are running. The usual evidence is content or links you did not publish, sometimes shown to Google and not to a logged-in editor. Posts, theme files, and the uploads folder are easy places to write once someone has an administrator password or a changed plugin.

The warning is a public note, not the problem itself. Removing it without removing the cause means the next crawl puts it back. Look for extra posts, a changed .htaccess, altered header.php or functions.php, and PHP in wp-content/uploads. See how WordPress sites get compromised and, after cleanup, how to remove a Google hacked warning.

A stale label after a real cleanup does happen. The test is whether the unexpected URLs, users, and files are gone.

How to check if you are affected

The scanner below is read-only. It looks at the public site. It does not open your Search Console account, and it will not clear a Google label.

Site URL Scan my site free

Read-only scan · No install · Results in about 30 seconds

1. Search for your domain and for site:yourdomain.com. Confirm the sentence is on your URLs, not on a similar name.
2. Read the other results. Titles you did not write, another language, pharmacy or gambling topics, and URLs that redirect away are the usual companions.
3. In Search Console, after you verify the property if needed, look at security issues and at indexed pages that are not yours. The review request belongs at the end.
4. View source on the homepage, logged out. Look for links and text the visible page does not show.
5. Over SFTP, compare the root .htaccess with a normal WordPress permalink block, and look for PHP in wp-content/uploads. In the admin, list users and sort posts by date.
6. If visitors instead see a full interstitial in Chrome, you are also dealing with Safe Browsing. Read Deceptive site ahead so the two warnings stay distinct.

You can see the public label without Search Console. You need Search Console, or someone who has it, to request the review.

How to fix it yourself

1. Isolate the site if spam URLs or redirects are still being served. Leaving the spam up while you only file a review will not clear the label.
2. Back up files and the database. Treat that backup as contaminated unless it predates the warning by a margin you actually remember. Do not restore last night over a cleanup.
3. Remove what Google is likely reacting to: spam posts, strange files, off-site redirects, and hidden link blocks. Deleting a homepage banner and leaving a hundred extra URLs will not do it.
4. Replace WordPress core from wordpress.org. New wp-admin, new wp-includes, and new root PHP files except wp-config.php. Clean wp-content file by file.
5. Remove unknown administrators. Check with your developer before you delete an account they still use.
6. Replace themes and plugins from clean copies, then update. Reinstalling is safer than updating a folder you no longer trust.
7. Reset administrator, SFTP, hosting, and database passwords. Keep DB_PASSWORD in wp-config.php in step with the database user. Replace salts from the WordPress secret-key service.
8. Remove PHP from wp-content/uploads and disable PHP execution there. Ask the host if you are not sure whether the server reads .htaccess.

Then request a review in Search Console. Google decides when the sentence comes off. There is no honest number of days to quote.

DIY is a bad idea if you have no backup, if the spam returns, or if the host suspended the account before you could get a file list. Repeated reviews of a site you have not inspected do not wear the label down.

When to get help

Get help when you cannot find what Google found, when every check above looks ordinary and the label remains, or when you lack both Search Console and DNS access. Also get help if a previous cleanup held only briefly. That pattern means something can still write to the site.

Emergency Cleanup is a flat $499. The 30-day reinfection guarantee means we clean again, or we refund the fee if we cannot clean it. We start only after you confirm you own the site. There is no fake deadline. Write to daniel@daniellasek.com or use the next step.

Fix it now — $499 Talk to us by email

FAQ

Is This site may be hacked the same as a red Chrome warning?

No. The hacked line sits under the Google search result. Deceptive site ahead is a full-screen Chrome block before the site loads. You can have one without the other. Both mean you should inspect the site.

I deleted the spam post. Why does Google still say the site may be hacked?

Google removes the line after it recrawls a clean site, not at the moment you edit. Confirm the spam is gone, including URLs you only see in search, then request a review in Search Console.

Can I request a review before the WordPress site is clean?

You can send the request, and Google is likely to leave the label in place if the spam is still there. Clean first, then ask for the review.

What if I cannot sign in to Search Console for this domain?

Verify the property with something you control, usually a DNS record at the host. If another person verified it and you cannot reach them, DNS access is the practical way back. You can still see the public label by searching for the site.