Hacked website: how to detect it, clean it, and win back your rankings

A hacked website rarely looks different: the homepage stays the same. The warning shows up in Google, traffic collapses, and you find nothing odd when you open the page. That gap between what you see and what Google sees is the actual problem.

What follows assumes something got into your site and organises the work in four phases: confirm with evidence, clean without breaking more things, request a review at the right moment, and rebuild traffic. Every step with its official source.

Signs your website was hacked

Hacking is not visible where you usually look. It shows up in data and in the reports Google generates on its own.

Signs Google confirms

• The "This site may be hacked" label under your result, or an interstitial browser warning before visitors get in.
• An email to the verified Search Console account. The Security issues report names the category: hacked content, malware and unwanted software, or social engineering.
• A notice that someone you do not recognise verified themselves as an owner. That is a classic compromise signal: the attacker gets in to touch geotargeting, sitemaps or the verification file.

Signs you see that Google will not tell you about

• URLs you did not create: random-letter directories such as yoursite.com/ltjmnjp/341.html, Japanese paths, /cheap-drugs or /buy-now-*.
• Impressions dropping with no content change, or the reverse: impressions rising on queries that are not yours because the site started ranking for viagra, casinos or replicas.
• Redirects that only fire when the visitor arrives from Google, depending on referrer, user-agent or device.
• A sitemap listing foreign URLs, new files in the root, a modified .htaccess, users or plugins you never installed, unknown scheduled tasks.
• File modification dates you never touched: comparing against the last backup is the fastest way to spot them.

If none of this shows up, do not celebrate yet.

Why a hacked website looks normal: cloaking

The attacker serves one version to visitors and another to crawlers, or to visitors arriving from Google. It is called cloaking, and its only purpose is keeping the owner from seeing what Google sees. If you open the suspicious URL and it is empty or returns a 404, you have no proof of anything.

Verification has three fronts: search site:yourdomain.com and go through several result pages; paste the odd text in quotes into the search box; and open URL Inspection in Search Console to read the HTML Google actually fetched. To compare on your own, request the page with Googlebot's user-agent:

curl -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" \
  -s https://yourdomain.com/suspicious-page | head -c 2000

If the response does not resemble what your browser shows, you have your proof. Google's official hacked sites recovery guide repeats it: do not be fooled by what the browser displays.

How to confirm the diagnosis

1. Verify ownership in Search Console if you had not done it yet. Without access there is no report and no review.
2. Open Security issues and note the category, first detection date and sample URLs. Google repeats one detail: that list is not necessarily complete. It is a sample, not the inventory.
3. Cross-check the domain's public status in the Safe Browsing transparency report. For phishing cases, that is also where you report a mistake.
4. If you cannot reproduce the warning, do not conclude it does not exist: the report is the source of truth and warnings depend on browsing context.
5. If after all that you still believe it is a false positive, the path is the Search Central help forum.

The four types of hacking Google documents

The spam policies group hacked content into four forms. Recognising yours saves hours of cleanup.

• Code injection: malicious JavaScript or iframes inside pages that already existed.
• Page injection: new pages with spam or phishing; yours may stay intact.
• Content injection: links or text hidden with CSS or HTML, or straight cloaking.
• Redirects: code that sends some users elsewhere based on referrer, user-agent or device.

Hacks with a name of their own

• Japanese keyword hack: auto-generated Japanese pages inside random directories, monetised with affiliate links to fake brands.
• Gibberish hack and cloaked keywords: meaningless text and links only the crawler can see.
• Malware: the most serious case, the only one that triggers the Safe Browsing warning that the site may harm your computer.

Step by step: clean the site without wrecking your SEO

Order matters more than speed.

1. Full backup outside the server

Files, database and images. Keep a copy of the infected files before deleting them: Google recommends it so you can analyse them.

2. Quarantine with a 503 served from outside

Take the site down with a 503 served from outside the compromised directories: a proxy, the hosting panel or a static page on another server. The quarantine guide is clear that temporary outages during recovery should not affect future ranking. And equally clear about what does not work:

• robots.txt with Disallow only blocks crawlers: the harmful content stays visible to users.
• noindex during cleanup prevents Google from verifying your fixes afterwards.

HTTP/1.1 503 Service Unavailable
Retry-After: 3600

3. Revoke access

In Search Console Verification Details, remove unknown owners, including dynamic tokens injected through .htaccess. Change every password without exception: FTP, database, SSH, CMS, hosting and domain email. Turn on two-factor wherever possible. And delete users, plugins, themes and cron jobs you do not recognise: uninstall them, do not just deactivate them.

4. Find the vulnerability, not just the symptom

Deleting the spam without closing the door guarantees it comes back. The causes Google documents are few: weak or reused passwords, outdated software and plugins, pirated themes and plugins, configuration holes such as unvalidated uploads or over-privileged accounts, and data leaking in error messages. Compare against the backup and cross-check the server logs to locate the entry date.

5. Clean, patch and republish

Restore the good content, delete the attacker's, apply the fix and update everything. If the attacker created new, visible URLs, use URL Removal in Search Console, but they still have to return a 404. Before requesting anything, check with curl that pages are clean and crawlable: no noindex, no Disallow.

Request a review from Google: what to write and how long it takes

The review request has prerequisites: verified property, clean site, vulnerability fixed, and the site live and crawlable. The Request a review button sits inside Security issues, and the channel changes with the problem type: hacking, malware or phishing.

What to write: one line per category with the issue, the concrete action you took and the evidence. "Fixed it" on its own is not a review request. About timing, no promises: reviews for hacked sites with spam can take several weeks, and resubmitting while a request is open only makes the queue longer.

One expensive trap: sites that flip between compliant and non-compliant in a short window can be classified as a Repeat Offender, and then cannot request reviews for 30 days.

What happens to your rankings once the site is clean

Once the review is approved, the category and sample URLs disappear from the report, but that does not bring traffic back. Content has to be recrawled: request recrawling for the pages that matter and resubmit the sitemap. Spam pages that stay indexed keep polluting the profile, so cleaning them is part of the job.

Recovery is not a straight line: impressions return first, clicks later. CTR can stay depressed for a while if the snippet got associated with junk queries. What you should not do: buy links to compensate, delete half the site or switch domains out of panic.

How to keep it from happening again

• Two-factor authentication on the CMS, hosting and domain email.
• Automatic updates for core, themes and plugins, with no "I will update it when I have time".
• Remove unmaintained plugins and themes: less code means less surface.
• Least privilege; whoever does not publish does not need admin rights.
• Automatic backups outside the server and a restore you have tested.
• HTTPS across the whole site, login included.
• File change monitoring and Search Console alerts switched on.
• Basic phishing training: Google notes some campaigns reach a 45% success rate.

An SEO hack is not fixed with a label or a security plugin: it is fixed by closing the door, cleaning what got in and proving it with evidence. The order of these steps matters more than how fast you run through them.