A hacked website loses rankings through a clear chain: attackers inject spam or malware, Google detects it, Google shows warning labels and suppresses your trust, and your traffic falls. The good news is that this is detectable and recoverable if you act fast. This pillar guide covers the common hack types that hit rankings, how Google detects hacks, what happens to your traffic, how to read the Security Issues report, and how to check if your site is hacked right now.
The common hack types that hit rankings
Several hack types specifically damage SEO, each with a recognizable signature. Knowing what they look like helps you spot them.
- Japanese keyword hack: Auto generated spam pages with Japanese titles appear in your search results, even though your site is in English. In a site search you see Japanese listings that you never created.
- Pharma spam injection: Hidden pages or content promoting pharmaceuticals get injected, often invisible to you but shown to Google. Your pages start ranking for drug terms you never targeted.
- Cloaked spam pages: The site shows normal content to you but spam to search engines, so you may not notice while Google sees a spam site.
- Redirect malware: Visitors, especially from search or mobile, get redirected to scam or malware sites, which Google detects and flags.
- Defacement: Your pages are visibly altered with the attacker’s message, an obvious but serious signal that damages trust immediately.
Each of these shows up either in your search results, in the Google Search Console reports, or in visitor complaints, so watching those places is how you catch them early.
How Google detects hacked sites
Google has several systems that catch hacked sites, often before you notice. Its Safe Browsing system scans the web for malware and deceptive content, and if it finds your site compromised, it can flag it in search and in browsers.
Crawl signals also reveal hacks, since Google notices sudden new spam pages, unusual redirects, and content that does not match your site’s normal pattern. When Google is confident a site is hacked, it can apply a hacked content manual action, an explicit penalty you see in Search Console.
Between automated Safe Browsing and manual review, Google is often aware of a hack quickly, which is why the warning can appear before you have even logged in to check.
What happens to rankings and traffic
The damage from a hack unfolds in a few ways, usually fast. Warning labels are the most visible: Google may add a this site may be hacked note under your listing, or browsers may show a full red warning page, both of which scare away almost all clicks.
SERP annotations and deindexing follow, as Google may remove the spam URLs, and sometimes clean pages too, from its index, cutting your visibility. Trust suppression is the quieter damage, where Google reduces confidence in your whole site, so even unaffected pages can slip. Timelines vary: warnings can appear within days of a hack, and while cleanup can be quick, the recovery of trust and rankings often takes weeks to months.
The sooner you detect and fix a hack, the less lasting the damage tends to be.
The Security Issues report
Google Search Console has a Security Issues report that is your main window into a hack, and learning to read it matters. Screenshot placeholders here would show each issue type. The report lists any security problems Google has found, such as hacked content, malware, or deceptive pages, with a short description of each.
If it shows hacked content, Google believes pages were added or altered by an attacker. If it shows malware or unwanted software, visitors may be at risk. If it shows social engineering or deceptive content, Google thinks your site is tricking users, sometimes due to rogue ads or scripts rather than a full hack.
A clean report says no issues detected. Checking this report regularly, and immediately if you suspect a problem, is the fastest official way to know your security standing and to request a review once you have cleaned up.
The three warnings, and why they are not the same problem
Google can flag a compromised site in three different ways, and they get lumped together constantly. They are not equivalent. Knowing which one you have tells you how bad the situation is and roughly what was found.
1. “This site may be hacked” under your listing. A line of text in the search results, nothing more. Your site still loads normally when someone clicks. It means Google believes a third party has altered your pages or added spam, and it is the label that usually accompanies SEO spam injections such as the Japanese keyword hack. Damaging to your click through rate, survivable, and the most common of the three.
2. “Deceptive site ahead”, the full red page in the browser. This is Safe Browsing, not Search, and it is a different order of problem. Visitors get a full screen red interstitial they must click through, and most will not. It appears when a site is serving malware, hosting phishing content, or redirecting people somewhere harmful.
If you have this one, you are not dealing with spam pages, you are dealing with something actively dangerous to visitors, and it needs fixing today rather than this week.
3. The Security Issues report in Search Console. Not a public warning at all, this is Google telling you privately what it found. It is also the only one of the three that names the category, which is what you actually need in order to fix it. The categories are hacked content, broken into spam injection, content injection and URL injection; malware and unwanted software; social engineering, meaning phishing or deceptive content; and harmful downloads.
How to read them together. The Security Issues report is your diagnosis. The search label means the damage has reached your listings. The red interstitial means it has reached your visitors. You can have the first without the other two, and if you only ever check your rankings you will discover a problem at stage two that Search Console was telling you about at stage one.
Which is the practical point of this whole page: verify Search Console and turn its emails on. It is the only one of the three that reaches you before your traffic does.
How to check if your site is hacked right now
You can run five quick checks in about ten minutes to see if your site is compromised. First, use a site search operator, searching your domain in Google, and scroll for any pages, especially spammy or foreign language ones, that you did not create.
Second, open Google Search Console and check the Security Issues report and the coverage of indexed pages for anything unexpected. Third, do an incognito or different device check, since some hacks show spam only to certain visitors or user agents, so viewing your site as a stranger or from mobile can reveal redirects. Fourth, check your file dates on the server, looking for recently modified core files you did not touch.
Fifth, review your users, both in your site admin and in Search Console, for unknown accounts that attackers add to keep access. If any check turns up something suspicious, treat it as a likely hack and move to cleanup fast.
What to do next
If you find a hack, act quickly and in order. First, contain and clean the site, removing the malicious files and content and closing the entry point the attacker used, since an unpatched hole leads straight to reinfection. Then handle the Google side, requesting a review in Search Console once the site is clean so the warnings and any manual action can be removed.
Our step by step guide on SEO recovery after a hack walks through the full process, and for the specific and common case, see our Japanese keyword hack fix. To prevent it happening again, our guide to WordPress security settings covers the protections that matter, and the broader picture sits in our post on cybersecurity for small businesses.
Why cleaned sites get hacked again a week later
“Close the entry point the attacker used” is the step everyone nods along to and almost nobody completes. It is also the step that decides whether you do this once or every fortnight, so it is worth being specific about what is usually still open after a cleanup that looked finished.
The backdoor is a separate thing from the spam. Removing the injected pages and the spam links deals with what Google saw. It does not touch the small file the attacker left behind so they can walk back in, which is the actual reason sites get reinfected.
Backdoors are put where nobody looks: inside the uploads folder, in a plugin folder with a plausible name that you never installed, appended to the bottom of a legitimate theme file, or written into the site’s configuration file. If your rankings recover and the spam returns three weeks later, this is what happened.
Assume every credential is known to the attacker. Anyone who had file access had access to the database password and the site’s configuration file. Changing the one admin password you use is not enough. The set that needs rotating is every administrator login, the database user, the FTP or SFTP account, and the hosting control panel.
On WordPress, also replace the security keys in the configuration file, because that invalidates every logged in session on the site at once, including any the attacker still holds. Without that step you can change passwords and leave them signed in.
Look for accounts and scheduled jobs, not only files. Two things survive a file cleanup. The first is a new administrator user, often with an unremarkable name, sitting in your user list. The second is a scheduled task that reinjects the spam on a timer, which is why some sites come back dirty overnight with no new intrusion at all.
Check the user list for anyone you cannot account for, and check scheduled tasks for entries you did not create.
Be careful which backup you restore. Restoring is often the fastest route to a clean site, but only if the backup predates the hack rather than the discovery. Most hacks sit quietly for a while before they surface, so the recent backup that feels safe frequently already contains the backdoor, and restoring it puts you back where you started with a clean conscience.
If you can, restore from a point before the first symptom you can date, then apply the pending updates immediately, because the unpatched component that let them in is in that backup too.
On timing, Google publishes what to expect. Its guidance is that reviews of sites infected with malware take a few days, while sites hacked with spam can take up to several weeks, since those reviews may involve manual investigation or reprocessing the affected pages. The reply arrives in your Search Console messages.
Requesting a review before the site is genuinely clean restarts that clock, which is the main reason to finish the work above before submitting rather than after.
Why attackers target your site for SEO spam
Understanding why hacks happen helps you take them seriously before one hits. Many hacks are not personal or aimed at stealing your data; they are after your domain’s SEO value. Your site has something attackers want: a real domain that search engines already trust and index.
By injecting spam pages or hidden links onto your trusted site, attackers borrow that trust to rank their own scams, sell counterfeit goods, or push malware, all under the cover of your reputation. This is why even small, low traffic sites get hacked, since any indexed domain is useful for this purpose.
It also explains why the spam is often invisible to you but shown to search engines, because the goal is to exploit your rankings, not to be noticed by you.
Seeing your site as a target for its SEO value, rather than assuming you are too small to be attacked, is the mindset that leads to taking prevention seriously. Automated attacks scan the web constantly for vulnerable sites, so the question is less whether you will be probed and more whether your site will be secure enough to withstand it when it is.
The cost of a hack beyond rankings
The ranking loss is only part of the damage a hack causes. There is the direct cost of cleanup, whether your time or a professional’s fee, and the lost revenue during the period your traffic is suppressed and visitors are scared off by warnings. There is reputational harm too, since customers who see a warning on your site or get redirected to a scam may not return, and trust is hard to rebuild.
For businesses, a hack can mean lost sales, lost leads, and lost confidence all at once. There can also be knock on effects, like your email being flagged as spam if your domain’s reputation drops, or your hosting account being suspended for serving malware. Weighing these full costs against the modest effort of prevention makes the case clear: securing your site is far cheaper than recovering from a hack, which is exactly why security deserves attention before anything goes wrong.
What to take from this
A hacked website loses rankings because Google detects the compromise, warns users away, and suppresses trust, but the damage is usually recoverable if you catch it early. Learn the common hack signatures, watch your Security Issues report and search results, and run the five minute checks regularly so you spot a problem before Google’s warnings cost you your traffic.
If you are hacked, clean the site, close the entry point, and request a Google review promptly. Speed is everything, since the faster you detect and fix a hack, the faster and fuller your recovery. Security, in the end, is ranking insurance worth taking seriously before you ever need it.
Frequently asked questions
Does getting hacked hurt SEO permanently?
Getting hacked does not usually hurt SEO permanently if you clean up and recover promptly. Rankings often drop during the hack due to warnings and trust suppression, but they generally return once the site is clean, the entry point is closed, and Google has reviewed and cleared it. The longer a hack goes unnoticed and unfixed, the more lasting the damage can be, so fast action is what keeps the harm temporary.
How does Google know a site is hacked?
Google knows a site is hacked through its Safe Browsing system, which scans for malware and deceptive content, and through crawl signals that reveal sudden spam pages, unusual redirects, and content that does not fit your site. It may also apply a hacked content manual action after review. Between automated detection and manual review, Google often identifies a hack quickly, sometimes before the site owner does.
Why do hacked pages show in Japanese?
Hacked pages often show in Japanese because of a common attack called the Japanese keyword hack, where attackers inject auto generated Japanese spam pages to sell counterfeit goods, exploiting the trust and reach of your domain. Japanese is used because of the profitable spam niches involved, but the hack can appear in other languages too. Seeing unexpected Japanese pages in your search results is a strong sign of this specific hack.
How long does ranking recovery take after a hack?
Ranking recovery after a hack varies. Cleanup and getting warnings removed can happen within days to a couple of weeks once you fix the site and request a review. Full ranking and trust recovery, however, often takes several weeks to a few months, as Google rebuilds confidence in your site. Acting fast and closing the entry point to prevent reinfection are what shorten the recovery timeline the most.
Can a hack happen without me noticing?
Yes, many hacks are designed to stay hidden, showing spam only to search engines or certain visitors while looking normal to you. Cloaked spam and injected pages can run for weeks unnoticed, quietly damaging your rankings. This is why regular checks, using site search operators, the Security Issues report, and incognito views, matter, since a hack you cannot see is still costing you traffic and trust until you find and fix it.
What is the difference between this site may be hacked and deceptive site ahead?
They are different severities from different systems. “This site may be hacked” is a line of text under your search listing, usually attached to SEO spam injections, and the site still loads normally. “Deceptive site ahead” is a full screen red interstitial from Google Safe Browsing shown when a site serves malware, hosts phishing or redirects somewhere harmful. The first costs you clicks; the second stops nearly all visitors reaching you at all.
Where does Google tell me what it actually found?
The Security Issues report in Search Console. Unlike the public warnings it is private, and it is the only one that names the category, which is what you need to fix it. Categories include hacked content split into spam, content and URL injection, malware and unwanted software, social engineering such as phishing, and harmful downloads. Turn on Search Console emails, since this is the one signal that reaches you before your traffic drops.
Why did my site get hacked again after I cleaned it?
Almost always because the backdoor was left behind. Removing the spam pages deals with what Google saw, but not with the file the attacker planted so they can return, which is usually hidden in the uploads folder, in a plugin folder you never installed, appended to a legitimate theme file, or in the site configuration.
A rogue administrator account or a scheduled task that reinjects the spam on a timer will also survive a file only cleanup.
Which passwords should I change after a hack?
All of them, on the assumption that anyone with file access read the configuration file. That means every administrator login, the database user, the FTP or SFTP account, and the hosting control panel. On WordPress also replace the security keys in wp-config.php, because that invalidates every active session on the site, including any the attacker still has open. Changing passwords alone can leave them signed in.
How long does a Google security review take?
Google’s guidance is that reviews of sites infected with malware take a few days, while sites hacked with spam can take up to several weeks, because those may need manual investigation or a reprocessing of the affected pages. The response appears in your Search Console messages. Submitting before the site is fully clean restarts the process, so finish the cleanup first.