How to Recover Google Rankings After Your Website Was Hacked

On this page

1. Why rankings drop after a hack
2. Step 1: Make sure the site is truly clean
3. Step 2: Remove warnings
4. Step 3: Deal with spam URLs
5. Step 4: Check for SEO sabotage
6. Step 5: Restore lost content
7. Step 6: Request recrawling
8. Step 7: Monitor recovery
9. Prevent a repeat

A hack can damage rankings through spam pages, warnings, redirects and lost content. The good news is that rankings usually recover once the site is truly clean and Google has recrawled it. Here's how to speed that up.

Why rankings drop after a hack

• Warnings in results or browsers reduce clicks
• Spam pages dilute and damage your site's quality signals
• Redirects send visitors and Googlebot elsewhere
• Attackers change titles, add noindex tags or edit robots.txt
• Real pages get deleted or broken during the hack or clean-up

Step 1: Make sure the site is truly clean

Recovery can't start while spam or redirects remain. Follow the full clean-up process and close the entry point.

Step 2: Remove warnings

Request reviews for any Security issues or manual actions in Search Console. See removing "This site may be hacked".

Step 3: Deal with spam URLs

• Make spam URLs return 404 or 410
• Don't block them in robots.txt
• Remove spam sitemaps and submit your real sitemap
• Use the Removals tool for the most damaging URLs

See fixing SEO spam hacks.

Step 4: Check for SEO sabotage

• robots.txt: is anything important blocked?
• Noindex tags on important pages
• Changed canonical tags pointing elsewhere
• Changed titles and meta descriptions
• WordPress's "Discourage search engines" setting

See robots.txt explained and canonical tags explained.

Step 5: Restore lost content

Compare your page list with a pre-hack backup or sitemap. Restore deleted pages at their original URLs, and fix broken internal links.

Step 6: Request recrawling

Use URL Inspection to request indexing for your most important pages, and resubmit your sitemap.

Step 7: Monitor recovery

• Search Console Performance: impressions and clicks for key pages
• Page indexing report: spam URLs dropping, real pages indexed
• site: searches for leftover spam

Recovery often takes a few weeks, depending on how long the hack was live and how big it was.

Prevent a repeat

A second hack sets recovery back. Keep the site updated, protected and monitored; see why WordPress sites get hacked and WordPress maintenance.