"This Site May Be Hacked" Label in Google Results: How to Remove It

On this page

1. How it differs from browser warnings
2. Why it appears
3. Step 1: Verify your site in Search Console
4. Step 2: Check for rogue owners
5. Step 3: Find the hacked content
6. Step 4: Clean the site completely
7. Step 5: Request a review
8. If the label came without a Security issues report
9. Recover your traffic

Seeing "This site may be hacked" under your website in Google's search results is alarming, and it makes searchers much less likely to click. Google shows this label when it believes a third party may have changed pages on your site or added spam. Here's how to get rid of it.

How it differs from browser warnings

• "This site may be hacked": a label in search results, usually for spam content added by hackers
• "Deceptive site ahead" / "Dangerous site": a full-page browser warning, usually for phishing or malware; see fixing browser warnings

Both mean the site needs cleaning, but the label often relates to SEO spam.

Why it appears

• Spam pages added to your site, often in other languages
• Hidden spam links injected into your pages
• Changed titles and descriptions showing spam keywords in results
• Redirects sending search visitors elsewhere

Step 1: Verify your site in Search Console

If you haven't already, verify ownership in Google Search Console; see setting up Search Console. Check the Security issues report for details and sample URLs.

Step 2: Check for rogue owners

In Settings → Users and permissions, remove anyone you don't recognise. Attackers often add themselves to submit spam sitemaps.

Step 3: Find the hacked content

• Search site:yourdomain.com for unfamiliar pages
• Inspect sample URLs from Search Console with URL Inspection
• Look for cloaked content that only Googlebot sees

See fixing SEO spam hacks.

Step 4: Clean the site completely

Remove spam pages and injected code, then find and close the entry point and remove backdoors. See removing malware step by step.

Step 5: Request a review

In the Security issues report, confirm you've fixed the issues and request a review, describing what you found and how you fixed it. Once Google confirms the site is clean, the label is removed from results.

If the label came without a Security issues report

Sometimes the label appears without detailed information. Clean the site anyway, make sure spam URLs return 404 or 410, submit your clean sitemap and monitor results as Google recrawls.

Recover your traffic

After the label goes, check your important pages are indexed and ranking; see recovering rankings after a hack.

Need it cleaned quickly? See WordPress malware removal.