Hacked Site Recovery

Hacked site recovery is the process of finding and removing malicious code, spam pages or unauthorised access from a compromised website, then restoring its standing in search. It covers the security clean-up itself and the SEO steps needed to remove warnings and spam URLs from Google.

Written by Paul Hoda, SEO consultant since 2005. Last updated 8 November 2026.

What a hack looks like

Many hacks are designed to stay hidden from the site owner. Attackers often use your domain’s authority to rank their own spam. Common signs include:

  • Thousands of new spam URLs in search results, often in Japanese or selling pharmaceuticals.
  • Pages that show different content to Googlebot than to visitors, a form of cloaking.
  • Redirects that send mobile or search visitors to other sites.
  • A “This site may be hacked” label beside your listing, or a browser warning such as “Deceptive site ahead”.
  • New users, admin accounts or files you did not create.

Why it matters for SEO

A hack can wipe out organic traffic quickly, and the damage often lasts longer than the attack itself. The main risks are:

  • Browser warnings that stop visitors reaching the site at all, which also hurts trust and conversions.
  • Spam pages that break Google’s spam policies, even though you did not create them.
  • A flag in Google Search Console under the Security Issues report.
  • In some cases, manual actions for hacked content or spam created by third parties.
  • Index bloat from thousands of junk URLs, which wastes crawling on pages you never wanted.

How to recover a hacked site

  1. Contain it. Take the site offline or into maintenance mode if needed, and tell your host.
  2. Change every password. Hosting, FTP, database, CMS admin and email accounts.
  3. Find the entry point. Outdated plugins, themes and core files are the usual cause, especially on WordPress.
  4. Clean or restore. Restore a clean backup from before the hack, or remove injected code and files by hand. Then update all software.
  5. Remove spam URLs. Let hacked pages return a 410 Gone or 404 status so Google drops them.
  6. Check what Google sees. Use the URL Inspection tool to confirm cleaned pages render normally.
  7. Request a review. In Search Console’s Security Issues report, confirm the problems are fixed and explain what you did.

Common mistakes

  • Deleting visible spam but leaving the backdoor that let attackers in, so the hack returns.
  • Requesting a review before the site is fully clean.
  • Blocking spam URLs in robots.txt, which stops Google seeing that they are gone.
  • Forgetting to remove sitemaps the attacker added or submitted.

Preventing a repeat

Keep the CMS, plugins and themes updated, remove anything unused, use strong unique passwords with two-factor login, and keep regular off-site backups. Verifying your site in Search Console means Google can email you if it detects a problem. It also helps to watch for sudden jumps in indexed pages or unfamiliar queries in your performance reports, as these are often the first visible sign that something is wrong. A web application firewall and file-change monitoring from your host or a security plugin add another layer of protection.

Key Takeaways

  • Hacks often hide from owners and target search visitors with spam or redirects.
  • Search Console’s Security Issues report shows what Google has detected.
  • Close the entry point and change all passwords, not just the visible spam.
  • Let hacked URLs return 404 or 410 so they drop out of the index.
  • Request a review only once the whole site is clean.

Related Terms

Curious how this applies to your website? Request a free SEO check-up, or keep learning in the SEO Encyclopedia.