Website security and Google warnings

If Google shows "This site may be hacked" under your business name, it has found pages or code on your site that you did not put there. The warning stays until the site is cleaned and you tell Google it is fixed through Search Console. It is fixable, usually in days rather than weeks, but only if you remove the cause and not just the symptom.

The two warnings, and what each one means

Google uses two very different warnings, and it helps to know which one you have.

"This site may be hacked" appears as a small grey line under your listing in the search results. Your site still opens when someone clicks. Google is telling searchers that something on the site looks like it was added by a stranger: usually spam pages, hidden links or redirects. Customers who see it often go back and pick the next business.

"Deceptive site ahead" or "Dangerous site" is a full red screen in Chrome and other browsers, before your page loads. This comes from Google Safe Browsing and means Google believes the site is trying to trick visitors or install harmful software. Almost nobody clicks past it. If you see the red screen, treat it as urgent: your site is actively hurting visitors, even if you never see the bad part yourself.

Both warnings are about your site, not about Google punishing you. They are there to protect people, and they come off once the problem is gone.

How to confirm what Google found

Do not guess. Google tells the site owner exactly what it saw, in a free tool called Search Console. If you have never used it, Google Search Console for small business owners walks through adding your site.

Once your site is in Search Console:

1. In the left menu, open Security & Manual Actions, then Security issues.
2. Read the issue type. Common ones are "Hacked: URL injection" (spam pages added), "Hacked: code injection" (bad code added to your real pages), "Hacked: content injection" (spam text slipped into your pages) and "Malware" or "Social engineering" (the red-screen kind).
3. Note the sample addresses Google lists. They tell you where to look.

If the list is empty but you still see the warning, wait a day and check again: the report and the search results do not always update at the same moment.

Cleaning the site properly

The mistake owners make is deleting the spam pages they can see and asking Google to review. The hacker's way in is still open, the pages come back within a week, and the second review is slower. A proper clean has four parts.

1. Lock the doors first

Change every password connected to the site, in this order: your hosting or builder account, the site's admin login (for WordPress, every admin user), the database password if your host shows one, and the email account those logins reset to. Turn on two-step sign-in wherever it is offered. In WordPress, open Users and delete any administrator you do not recognize.

2. Find how they got in

On small business sites the usual causes are an outdated WordPress, an old plugin or theme that nobody updated, a reused password, or a forgotten copy of the site in a folder on the same hosting. If your site runs on WordPress, update everything, then delete every plugin and theme you are not using. Unused ones still run code.

3. Remove what they added

You have three options, from best to worst:

• Restore a clean backup from before the hack, then apply the updates from step 2 straight away. Ask your host how far back their backups go.
• Ask your host or a security service to clean it. Many hosts offer a cleanup for a fee. Ask what they will check, and whether they will tell you how the site was broken into.
• Clean it by hand, only if you know your way around the site's files. Hacked code is often hidden in files with ordinary names.

4. Check that it is really gone

Search Google for site:yourdomain.com and scroll through the results. Look for pages in other languages, pages about casinos, pills, loans or fake designer goods. If you find them, the cleanup is not finished. Spammy pages on a hacked website covers that kind of hack in more detail, including how to get the spam addresses out of Google.

Asking Google to remove the warning

When the site is clean:

1. Go back to Security issues in Search Console.
2. Tick the box that says you have fixed the issues and click Request review.
3. Describe what you did in plain words: what was wrong, how you removed it, and what you changed to stop it happening again. "Restored a clean backup from March, updated WordPress and all plugins, removed two unknown admin users, changed all passwords" is the kind of note that helps.

Reviews for malware and deceptive-site warnings are often done within a few days. Reviews for hacked spam can take longer. If the review fails, Search Console says so and usually gives examples of what is still there. Fix those and request again.

What a hack costs you while it lasts

The visible warning is the obvious cost. Two others are easy to miss:

• Your email. Hacked sites are often used to send spam. If your business email lives on the same hosting, your real messages can start landing in customers' spam folders. Why your business emails go to spam shows what to check.
• Your place in search. While spam pages sit on your domain, Google has to sort out which pages are really yours. After the cleanup things usually settle back, but nobody can promise exactly when or how far.

Keeping it from happening again

Most small business hacks are not personal. Automated tools scan the internet for old software and weak passwords and break into whatever they find. So the defense is mostly routine:

• Keep the site's software updated, or use a setup where there is no software for you to update. Simple static sites, which are just finished pages with no admin login or plugins, have very little for these tools to break into.
• Use a unique password for the hosting account and the site admin, and turn on two-step sign-in.
• Remove old admin users when a designer or employee leaves.
• Know where your backups are and how to restore one.
• Keep Search Console set up, so Google emails you the day it finds a problem rather than you hearing it from a customer.

What to do this week

• Search your business name on Google and look under your listing for any warning.
• Add your site to Search Console if it is not there, and open Security issues.
• Run a site:yourdomain.com search and scroll through every page Google has.
• Write down who has admin access to your site and remove anyone who should not.
• If your site has been hacked more than once, or it runs on old software nobody looks after, it may be cheaper to replace it than to keep patching it. You can see your site rebuilt first, on a setup with no plugins to keep updated, and decide with the new version in front of you.