Codiffy (codiffy.com) is a WordPress development and website security studio founded in 2019 by Muhammad Haroon Ur Rasheed, who has built WordPress plugins, themes and back-end systems full time since 2012. Codiffy cleans hacked WordPress and WooCommerce sites for businesses in the United States and Canada.

Google shows “This site may be hacked” under your site in search results when it believes a hacker changed your pages or added spam pages. To remove it, clean the whole site and close the way the hacker got in, verify the site in Google Search Console, then click Request review in the Security issues report. Google removes the label after it confirms the fix; reviews of spam hacks can take up to several weeks, so the cleanup has to be complete before you ask.

Need the warning gone fast? Call +1 (347) 474-0387, answered immediately, 24/7. We clean the site the same day, from $200, and file the review request for you. You get the fixed price before we start. WordPress malware removal

What the warning means

Google adds the line “This site may be hacked” under a result when it believes “a hacker might have changed some of the existing pages on the site or added new spam pages” (Google Search Help, checked 31 October 2026). It stays until the site owner acts. Google will not remove it on its own.

It is one of several Google warnings. Find yours before you start:

What you see Where What it usually means
“This site may be hacked” under your result Google search results Spam a hacker added: new pages, injected links or text, or redirects
A full red page saying the site is dangerous or deceptive Chrome and other browsers (Google Safe Browsing) Malware, or a page that tricks visitors (phishing, fake download or fake “verify you are human” prompts)
An email or a “Security issues” entry Google Search Console Google’s own list of the problem type and sample URLs. Start here
A “Manual actions” entry Google Search Console A penalty for spam, which can also follow a hack

Why Google thinks your site is hacked

Google’s Security issues report names the type of hack. The three you meet most on WordPress sites:

  • URL injection: the hacker creates new pages, often thousands of them, selling casino games, pills, replica goods or written in Japanese.
  • Content injection: spam links or text added to pages you already have, sometimes hidden from people and shown only to Google.
  • Code injection: a script added to your pages that sends visitors to another site or shows a fake prompt.

The site often looks fine to you. Hackers show the spam to Google and a normal page to everyone else. At In Order to Succeed, a professional organizing firm in New York and Connecticut, nobody saw anything wrong on the site in 2026. Their SEO consultant found the hack in Search Console while writing a monthly report: German casino spam had been spliced into real testimonial posts, and one spam page had 2,402 impressions.

How to check what Google sees

  1. Search Google for site:yourdomain.com, then add words like casino, viagra or replica. Pages you never wrote mean URL injection. Japanese titles on an English site are the Japanese keyword hack.
  2. Open Search Console > Security issues for the issue type and sample URLs, and Manual actions for any penalty.
  3. Open Search Console > Pages and look for indexed addresses you do not recognise, and Performance for search terms that have nothing to do with your business.
  4. Run a URL Inspection on a flagged URL and choose “View crawled page”. That is the HTML Google received, which may differ from what your browser shows.

How to remove “This site may be hacked”, step by step

  1. Verify your site in Google Search Console. A Domain property covers every version of your address. Without it you cannot see the report or ask for a review.
  2. Check who else has access. In Settings > Users and permissions, remove any owner or user you do not know. Hackers sometimes verify themselves so they can submit their own spam sitemaps. Then check Sitemaps for files you did not add.
  3. Clean the whole site, not only the sample URLs. Google says a partial fix does not earn a partial return. On WordPress that means the files, the database, the user list and the scheduled tasks. Our guide on how to fix a hacked WordPress site goes through it in order.
  4. Close the way in. Find how the hacker got in and fix it, or the spam comes back and Google flags the site again. At In Order to Succeed the spam traced back to a backdoor uploaded through the WP File Manager plugin, years before anyone noticed.
  5. Make the spam pages return 404 or 410. Delete them so Google sees they are gone. Do not block them in robots.txt: Google then cannot crawl them to see they were removed. For spam that keeps showing in results, the Removals tool in Search Console hides it for about six months while it drops out.
  6. Check your pages the way Google does. Run URL Inspection again on your homepage and a few of the flagged URLs. The live test should show clean HTML, and nothing should be blocked by robots.txt or a noindex tag.
  7. Request a review. In Security issues, click Request review and say plainly what you found, how you removed it, and what you changed to close the way in. For example: “We removed 65 spam posts and a backdoor uploaded through an old file manager plugin, removed the plugin, reset every password and turned on two-factor login for all admins.”
  8. Wait, and do not resubmit. Google’s guidance on review requests says reviews of sites hacked with spam “can require up to several weeks”, malware reviews take a few days, and phishing reviews about a day. Once a review is approved, the warnings in search results and browsers are removed within 72 hours. Sending another request while one is open, or before the site is clean, makes the wait longer.

How Codiffy cleans a flagged site

Haroon, Codiffy’s founder, follows the same order on every hacked site:

  1. Look at what is visible: the redirect, the spam pages, the warning.
  2. Read the error logs for the first leads.
  3. Inspect the recently changed files and the code that was added.
  4. Search the database for injected scripts, spam links and accounts nobody created.
  5. Run automatic scans with Guardian Shield Lite, Codiffy’s own security plugin, to catch what manual checks miss.
  6. Trace the attack in the server terminal: when it came in, how, and which scripts ran.
  7. Close the way in last, once the site is clean, then request the review in Search Console.

Mistakes that keep the warning up

  • Restoring a backup and calling it fixed. At In Order to Succeed the host restored a backup from 30 days earlier and a scan came back clean, but the way in was still open. A clean scan is not proof.
  • Cleaning what you can see. Spam hidden from visitors, a hidden admin account or a compromised plugin brings the hack back. At BenchmarkTitle.net a compromised Hello Dolly plugin kept reinfecting the site, and the spam returned about four months after a first cleanup because the follow-up steps (new passwords, new keys, updates, a newer PHP version) were skipped.
  • Asking for a review too early. A request sent while spam is still on the site is turned down and the next one takes longer.
  • Blocking spam pages in robots.txt instead of removing them.

When to call a developer

Call for help if:

  • The spam or the warning came back after a cleanup.
  • You cannot find how the hacker got in.
  • Your site is an online store, or Google also shows a red browser warning.
  • The review was turned down.

Codiffy cleans hacked WordPress and WooCommerce sites 24/7, from $200, usually $200 to $400, and files the Search Console review for you. If the malware returns, we clean it again free. Call +1 (347) 474-0387 or email haroon@codiffy.com. See the malware removal service

Frequently asked questions

How long does it take to remove “This site may be hacked”?

The cleanup itself usually takes a day. Google’s review of a site hacked with spam can take up to several weeks, and once it is approved the label is removed within 72 hours. Resubmitting early only makes it longer.

Can I remove the warning without Search Console?

No. The review request lives in the Security issues report, so you need to verify the site in Search Console first. Verification is free.

Will my rankings come back?

Usually, once the spam is gone and the label is removed, but Google makes no promise and it can take weeks. The label itself costs you clicks, because searchers see it and pick another result.

My site is clean but still shows the warning. What now?

Check Search Console > Security issues. If it lists nothing, Google may not have recrawled the site yet; run URL Inspection on your homepage and request indexing. If it lists issues you believe are fixed, request a review and describe what you removed.

What should I do in the first hour after finding a hack?

Do not delete anything yet. Change your passwords from a clean device and save a copy of the site and logs. Our guide on what to do if your website is hacked covers the first hour step by step.

About the author

Muhammad Haroon Ur Rasheed founded Codiffy in 2019 and leads its website security work. He has been a full-time WordPress and back-end developer since 2012 and built Guardian Shield Lite, the security plugin included in Codiffy’s malware removal service. Codiffy works from Rawalpindi, Pakistan, and handles hacked sites 24/7 for clients across the United States and Canada.