Website redirecting to spam or 'This site may be hacked'? How to confirm it and clean up

Which warning are you seeing?

The wording tells you what Google found. All of these are driven by the same systems and are fixed through the same report in Search Console.

• 'This site may be hacked' under your result in Google Search: Google suspects altered pages or added spam pages. This is the classic spam hack.
• 'This site may harm your computer' in Google Search: Google has detected malware.
• 'Deceptive site ahead' as a full red page in Chrome: Google Safe Browsing has flagged content that tricks visitors into doing something dangerous, such as entering passwords or downloading software. Google calls this social engineering.
• No warning yet, but visitors are being redirected: you may have caught it before Google did. Clean up now, using the same steps.

Confirm it: why the site may look fine to you

Owners often open their homepage, see nothing wrong and assume the customer is mistaken. That is exactly what the hack is designed to do. Google's guidance says hackers often create conditional redirects based on the user-agent, the time of day or the referrer, and that some malware is only activated when users come from Google Search results. Hacked pages can also be cloaked: they show spam to Google's crawler and a normal page, or even a 404, to you.

Google also advises against opening suspicious pages in your browser, since malware can exploit browser weaknesses. Use these checks instead:

• Open Google Search Console and go to the 'Security Issues' report. It lists the problem Google found and example URLs. Check the 'Manual actions' report while you are there.
• Search Google for site: followed by your domain, for example site:yourbusiness.com. Look for pages you never made, often in another language or full of product names.
• Paste a suspect URL into the 'URL Inspection' tool in Search Console to see the page the way Google sees it, which exposes cloaked content.
• Fetch a page as a searcher would with curl and a Google referrer: curl -v --referer 'http://www.google.com' followed by your page address. If the response is a redirect to another domain, you have found the conditional redirect.
• Open your .htaccess file (and httpd.conf if you run your own Apache server) in your host's file manager with hidden files shown. Google's example of a malicious rule is a RewriteCond that checks for google in the referrer followed by a RewriteRule pointing to an outside site.
• Google notes attackers commonly inject scripts into files such as index.php, wp-load.php, 404.php and view.php, and give their own PHP files innocent-sounding names.

Step 1: Stop the damage and lock the doors

Google's recovery guide starts with quarantine, before any cleaning. A site that keeps serving spam or malware while you work keeps hurting visitors and your reputation.

• Take the site offline. Google suggests stopping the web server or pointing DNS to a static page elsewhere, and serving a 503 'temporarily unavailable' status from outside the compromised server.
• Contact your hosting company. They can see things you can't, and if their systems were affected too, your report helps them.
• Review user accounts in your CMS and hosting panel. Note any account the hacker created, then delete it.
• Change every password related to the site. Google lists FTP logins, database access, system administrator accounts and CMS accounts. Do this from a device you trust.
• Before you change any files, make two backups of the site as it is now, infected. They are evidence for working out how the attacker got in, and a fallback if cleaning goes wrong.

Step 2: Clean the site, then close the hole

If you have a backup from before the hack, restoring it is usually the quickest way back to clean files. Be careful: the attacker may have been inside for weeks before anyone noticed, and a restored site still has whatever weakness let them in. Google's guidance is blunt that if you don't fix the vulnerability, the site will likely be reinfected.

• Restore a backup you are confident predates the hack, or rebuild. Google recommends a clean installation of your software, not just an upgrade, because upgrades can leave files from a previous version behind.
• Install every available software upgrade, update and patch, for the CMS, the theme and every plugin.
• Remove applications and plugins you don't use. Each one is something that can be attacked.
• Check .htaccess and other server configuration files again after restoring, and remove any redirect you didn't add.
• Make sure spam pages the hacker created return a 404. If any are showing in Google, the 'Removals' tool in Search Console can hide them, but Google says to use it only for pages you never want in results, never for your real pages.
• When the site is clean, change all the passwords one last time, as Google recommends, then bring the site back online.

Step 3: Ask Google to remove the warning

Only do this when the whole site is clean. Google's help says to fix the issue on all pages, not just some, fix every issue listed, and test your fixes. Requesting a review too early can slow down the next review or get you marked as a repeat offender. Under Google's Safe Browsing policy, repeat offender status lasts 30 days, and you can't request reviews in Search Console during that time.

In Search Console, open 'Security Issues' and click 'Request Review'. Google says a good request explains the exact problem, describes the steps you took to fix it and documents the outcome. For a spam hack, give a short explanation for each category, for example: removed the injected spam pages, deleted the unknown admin account, updated the outdated plugin that was used to get in.

• Malware reviews need a few days, according to Google's hacked-site guide.
• Spam hack reviews can take up to several weeks, because they may involve manual investigation.
• Deceptive site reviews can take several days.
• You get an email when the request is received and another when the review is complete. Don't resubmit while a request is pending.
• If the review fails, the report may show new sample URLs. Clean those and request again only when you are sure.

If Chrome says 'Deceptive site ahead' but you weren't hacked

Sometimes the problem isn't a hacker at all. Google's guidance says embedded social engineering content is a policy violation for the host page, so a deceptive ad, a fake download button or a third-party widget can get your whole page flagged. It also notes that ad networks rotate ads, so the bad one may only appear now and then. Check every ad slot, embed and script on the flagged URLs, remove the source, and request a review the same way. After a review clears, check search results and the browser warning again over the next few days, because updates can be delayed.

Prevent it next time

Almost every hack of a small business site comes through something left out of date or a password that was reused. Google's maintenance advice is short and worth following.

• Keep the CMS, theme and plugins updated, and delete anything you no longer use.
• Make regular, automated backups, and keep some copies off the server.
• Use a unique password for hosting, FTP, the database and every admin account, and remove accounts for people who no longer work on the site.
• Keep the site verified in Google Search Console so its security alerts reach your email, not a customer's screenshot.

If you'd rather not look after a website at all

The steps above are what to do right now, and they will get the warning removed. If the hack has left you wanting to stop maintaining WordPress yourself, OneSol's Max plan ($1 for the first month, then $29/month) builds a small-business website with you on your own domain, with CRM and SEO set up, and we keep it running, so there are no plugins for you to update.