Remove Google's "This site may be hacked" warning

To remove Google's "This site may be hacked" or "Deceptive site ahead" warning, clean your site, then request a review in Google Search Console.

Google shows these warnings in search results and in Chrome when it finds malware, spam pages or phishing on a site. Only Google can remove them, and only after the problem is gone. Requesting a review before the site is clean wastes time: Google checks again and keeps the warning.

1. Clean the site first

• Follow Your website was hacked: what to do first.
• Repair WordPress's own files with Check WordPress Integrity (see Remove malware from index.php).
• Check Imunify360's results in cPanel (see Scan your website for malware with Imunify360).
• Delete spam pages and posts the attacker created, and update everything.

Don't want to do this yourself? ElySpace's Website Security and Hack Recovery service removes malware and recovers hacked websites. You can order it in the client area under Website Security and Hack Recovery.

2. Add your site to Google Search Console

1. Go to search.google.com/search-console and sign in with your Google account.

2. Add a property. You have two choices:

   • Domain: covers all addresses of your domain. Google gives you a TXT record; add it in cPanel's Zone Editor (see Edit DNS records in cPanel (A, CNAME, TXT)).
   • URL prefix: covers one address, for example https://yourdomain.com. One way to verify is to upload the HTML file Google gives you to public_html with File Manager (see Upload files with the cPanel File Manager).

3. Click Verify in Search Console. DNS changes can take a while to be visible; if verification fails at first, try again later.

3. Request a review

1. In Search Console, open Security & Manual Actions > Security issues. The page lists what Google found, often with example addresses.

2. Check that each example address is clean now or returns "not found".

3. Click Request Review and describe what you did: which files you cleaned, what you updated, and which passwords you changed.

Google reviews the site and reports the result in Search Console. This can take from a day to several days. When the review succeeds, the warning disappears from search results and browsers.

Common problems

Google rejected the review

Google still found something. Read the reason in Search Console, check the listed addresses again (also on your phone, because some malware only shows to mobile visitors or visitors coming from Google) and request a new review when it's clean.

The warning came back

The site was infected again, so the way in is still open. Update everything, change all passwords and remove unknown users and plugins. See Secure your WordPress site from cPanel.

Your email goes to spam too

A hacked site can be used to send spam, which hurts your domain's reputation. Set up SPF, DKIM and DMARC (see Fix email going to spam: SPF, DKIM and DMARC).

Related articles

• Your website was hacked: what to do first
• Remove malware from index.php
• Scan your website for malware with Imunify360

Still stuck? Open a ticket in Website Security: Open a support ticket and we'll help.