# Removing the Google warning “This site may be hacked” > Remove the Google warning for a hacked website: find the cause, clean up spam and malicious code, check Search Console and request the review. Source: https://phpsos.de/en/ratgeber/google-warnung-entfernen/ As of: 25/10/2026 Provider: PHP SOS, PHP emergency help and server security. Immediate help via WhatsApp: https://wa.me/491736494914?text=Hello%20PHP%20SOS%2C%20we%20need%20help%20with%20our%20PHP%20server.%20Company%3A%20%E2%80%A6%20Website%3A%20%E2%80%A6 **In short:** To remove the Google warning for a hacked website, you must first close the cause and remove all harmful content. Only then do you request the review in Google Search Console. Anyone who requests too early or deletes only the visible traces risks a rejection, because backdoors and hidden spam pages usually remain. ## Which warnings Google shows and why Google warns about compromised websites in two ways. In the search results, a note may appear under your listing saying the website may have been hacked. For more serious findings, such as malware or phishing, browsers show a red warning page via Google Safe Browsing before the website is even loaded. The cause is almost always content that attackers have planted: numerous spam pages for medicines, gambling or counterfeit brand goods, redirects to foreign sites, malicious code aimed at visitors, or fake login pages. For your company this means fewer visitors, unsettled customers and, in a shop, direct loss of revenue. Which problems Google has found is shown in Google Search Console under **Security & Manual Actions**, in the **Security issues** report. Example URLs are often named there, which give a first pointer. ## Clean up first, then request the review The order is decisive. The Google warning is a symptom; as long as the vulnerability is open and a backdoor is present, the content comes back, often shortly after deletion. > **Important:** > A CMS update alone does not close every vulnerability. With PHP2Shell the weakness lies in PHP itself, and a patch does not remove malware that has already been planted. Check the PHP version, patch status and files before asking Google for a review. For the cleanup, it makes sense to put the website into maintenance mode temporarily or take it offline. That protects visitors while you work and stops the attacker from adding further content. A maintenance mode should deliver the status code 503, so that search engines recognise the interruption as temporary. ## Removing the Google warning for a hacked website: step by step 1. **Preserve evidence:** Secure logs, a copy of the files and the database before you delete anything. 2. **Check Search Console:** Read the security issues report, note the example URLs and look under **Settings**, **Users and permissions** for unknown owners. 3. **Close the vulnerability:** Update PHP, CMS, themes and extensions, remove unused extensions, restart the PHP workers after the update. 4. **Remove malicious code:** Replace the CMS core files from a clean source, search upload and cache directories for PHP files, check `.htaccess` and the server configuration for foreign redirects. 5. **Clean the database:** Remove spam posts, planted scripts in content and options, and unknown admin accounts. 6. **Renew credentials:** Change passwords for CMS, hosting, database, FTP and SSH, regenerate the CMS security keys. 7. **Check the result:** Test the example URLs with URL inspection and open your own website the way Google sees it. 8. **Request the review:** In the security issues report, request the review and briefly describe what was found and fixed. ## Hidden traces: spam pages, cloaking and foreign owners Many hacks are built so that operators do not notice them. The spam content appears only for Googlebot or for visitors who come from search. Logged-in admins see the normal website. The URL inspection in Search Console, by contrast, shows the fetch from Google's point of view. Another pointer is a search with `site:yourdomain.com` combined with typical spam terms. If pages appear there that you never created, that is a clear sign. Also check submitted sitemaps: attackers sometimes create their own sitemaps to get their spam pages indexed faster. On the server, simple, read-only checks help in the search for modified files: ```bash # PHP and HTML files modified in the last 14 days find /var/www/ihre-website -type f \( -name '*.php' -o -name '*.html' \) -mtime -14 | sort # PHP files in upload directories (there should normally be none) find /var/www/ihre-website -path '*uploads*' -name '*.php' # Redirect rules in .htaccess files grep -rn --include='.htaccess' -iE 'RewriteCond.*(HTTP_REFERER|HTTP_USER_AGENT)' /var/www/ihre-website ``` Rules that redirect differently depending on referrer or user agent are a typical feature of cloaking. With WordPress, also proceed specifically according to the notes in the guide [Finding backdoors in WordPress](https://phpsos.de/en/ratgeber/backdoor-wordpress-finden/). ## What happens after the request Google checks the website again and communicates the result in Search Console. If the request is accepted, the warnings disappear. If it is rejected, Google usually names further example URLs. You then search specifically for the remaining content and request again only after cleanup. Spam URLs that Google already knows should return a 404 or 410 status after the cleanup so that they drop out of the index. Do not redirect them wholesale to the home page. Keep watching Search Console in the weeks afterwards, because spam reappearing points to an overlooked backdoor. A full follow-up is described in our [checklist after a hack](https://phpsos.de/en/ratgeber/checkliste-nach-dem-hack/). So that the warning does not recur, a few things should be settled permanently after the cleanup: - Updates for PHP, CMS, themes and extensions are applied promptly, and someone is responsible for it. - Unused extensions, old test installations and forgotten subdirectories are removed. - Admin access is personal and protected with a second factor. - File monitoring reports new PHP files in upload and cache directories. - Search Console's email notifications reach an address that is read regularly. In the case of longer outages or affected customer data, also inform your customers factually about the status. Open, calm communication usually protects trust better than silence. ## How does PHP SOS help? - We first secure the traces and clarify through which vulnerability the attacker got in. - We clean files, database and server configuration as part of [malware removal](https://phpsos.de/en/leistungen/malware-entfernung/) and close the cause. - We check the website from Google's point of view, remove foreign Search Console owners and prepare the review request with you. - In an acute infestation, our [emergency help for hacked websites](https://phpsos.de/en/leistungen/website-gehackt-notfallhilfe/) takes over containment until the incident is closed and documented. ## Frequently asked questions **How long does it take for Google to remove the warning?** That cannot be predicted reliably. The review begins only when you request it in Search Console, and it depends on the type and scope of the problem. You can see the status in the security issues report. **What happens if I request the review too early?** If Google still finds harmful content during the check, the request is rejected and the warning stays. Repeated rejections can delay the next review. Therefore request the review only after complete cleanup. **Why can't I see the spam pages myself?** Many hacks show spam only to search engines or to visitors coming from Google, and show logged-in admins the normal page. This technique is called cloaking. With the URL inspection in Search Console you see what Google actually fetches. **Do I have to rebuild my rankings after the cleanup?** After the warning is removed, visibility often recovers, but not necessarily to the old level. What matters is that spam URLs disappear from the index and the actual content remains reachable unchanged. ## Sources - [Google Search Console Help](https://support.google.com/webmasters/) - [BSI: notes for website operators](https://www.bsi.bund.de/) - [WordPress](https://wordpress.org/)