What the warnings mean
| Where you see it | What it means |
|---|---|
| Google Ads: Compromised site (ads disapproved) | Google found malware, hidden redirects or hacked content on your landing page or domain. Ads stay disapproved until it is fixed. |
| Google Search: This site may be hacked | Google found pages or content added by a hacker, often spam pages in another language or about pharmacy, casinos or loans. |
| Chrome: Dangerous site or Deceptive site ahead | Google Safe Browsing found malware or phishing. Visitors see a red warning page. |
Step 1: Confirm what Google found
- Open Google Search Console for your domain. If you have not set it up, verify it now with a DNS record.
- Go to Security & Manual Actions → Security issues. Google lists the type of problem and sample URLs.
- Check the Pages and Performance reports for URLs you do not recognise. Hacked sites often have hundreds of spam pages.
- Check your site on Google's Safe Browsing site status page (transparencyreport.google.com/safe-browsing/search).
Step 2: Contain the damage
- Take a full backup of files and database as they are now, for investigation.
- Change every password: hosting, control panel, FTP or SFTP, database, every website admin and your domain registrar.
- Remove any admin users you do not recognise.
- If the site is redirecting visitors to scams, consider putting up a temporary maintenance page.
- Pause your Google Ads campaigns so you are not paying for disapproved or harmful traffic.
Step 3: Find and remove the hack
On WordPress sites, check these places:
| Where to look | What looks suspicious |
|---|---|
| Plugins and themes | Ones you did not install, or "nulled" (pirated) copies |
wp-content/uploads | PHP files. Uploads should only hold images and documents. |
.htaccess, wp-config.php, index.php | Redirect rules or code you did not add |
| Any PHP file | eval, base64_decode or long scrambled strings |
| Posts, pages and users | Spam content, unknown admins, unknown scheduled tasks |
| File dates | Files changed recently that you did not edit |
The safest clean-up is to reinstall WordPress core, themes and plugins from official sources, then restore only your content and uploads after checking them. Remove any "nulled" (pirated) themes or plugins; they often contain backdoors.
If the site is old or heavily infected, rebuilding it cleanly can be quicker and safer than cleaning. A simple static site has very little for hackers to attack.
Step 4: Fix how they got in
Common causes are outdated plugins, weak or reused passwords, nulled themes, old PHP versions and shared hosting with poor isolation. Fix the cause before asking for a review, or the hack will come back and the next review takes longer.
Step 5: Deal with spam URLs
Pages the hacker created should now return "404 Not found" or "410 Gone". In Search Console, use Removals → New request to hide them from search quickly. Use a URL prefix removal if they all sit in one folder. Old pages from your own previous site can be redirected (301) to the matching new page instead.
Step 6: Request a review
- In Search Console, open Security issues, tick that you have fixed the issues, and click Request review.
- Explain briefly what you found and what you did: removed malware, updated software, changed passwords, fixed the cause.
- Google says malware reviews usually take a few days. Reviews for spam hacks can take longer.
Step 7: Get your ads approved again
- In Google Ads, open Policy manager (under Tools).
- Find the disapproved ads, choose Appeal, and select that you have made changes to comply.
- If the appeal fails, contact Google Ads support and mention that Search Console shows no security issues.
How to stop it happening again
| Risk | Prevention |
|---|---|
| Outdated software | Update WordPress, themes and plugins weekly |
| Malware uploads | Use a firewall and malware scanning |
| Stolen passwords | Strong, unique passwords and two-factor login for every admin |
| Losing everything | Daily backups stored away from your server |
| Forgotten entry points | Remove unused plugins, themes and old admin accounts |
| Late discovery | Check Search Console monthly. See our website maintenance checklist. |