Search Console Security Issues: Hacked Content, Malware and Social Engineering
When Google decides a site has been hacked or could harm visitors, it reports it in Search Console and warns people in search results and the browser. This guide explains what each security issue means, how to check a flagged page safely, how to fix it and request a review, and how long Google says reviews take.
This guide uses Search Console Help: Security issues report; Google Search Central: Social engineering (phishing and deceptive sites), Malware and unwanted software, Safe Browsing Repeat Offenders Policy and the spam policies; Google's Request a review article on web.dev; and Google Search Help on the "This site may be hacked" message. Quotes are from those pages.
What the report is for
Google's own definition: "If a Google evaluation determines that your site was hacked, or that it exhibits behavior that could potentially harm a visitor or their computer, the Security issues report will show Google's findings." The examples Google gives are phishing and installing malware or unwanted software on a visitor's computer.
The effect is visible to everyone. Affected pages "can appear with a warning label in search results or an interstitial warning page in the browser when a user tries to visit them." For social engineering, Chrome may show a "Deceptive site ahead" warning. For hacked spam, searchers may see "This site may be hacked" under your result, and Google Search Help says that message "won't be removed until the website owner of the site takes action."
Do not confuse it with the Manual Actions report. Google explains that manual actions are "mostly attempts to manipulate our search index, but are not necessarily dangerous for users", and usually mean lower rankings with no visible label. Security issues are about harm to visitors and come with warnings.
This guide covers what the report says and how to get a warning lifted. For keeping a site from being hacked in the first place (updates, backups, multifactor sign-in, fewer admins), see our website security guide for small businesses.
How you find out
Open the Security issues report in Search Console. If nothing is wrong, it shows "a green check mark and an appropriate message". If something is, you see a count of issues at the top, and each issue opens to show the date it was first detected, a short description, a "Learn more" link and sample affected URLs.
Two points from Google about the samples. The list "is not necessarily complete, but just a sample of pages on your site affected by the selected issue." And an issue can come with no example URLs at all, which "does not mean that no pages are affected".
You only get the report, and the emails about it, if the site is verified in Search Console. Google's Safe Browsing service says it "notifies website owners when their websites are compromised", and Search Console is where you see those findings and request reviews. Our Search Console guide explains how to verify a site and add owners. It is worth doing before anything goes wrong, so the warning reaches you and not just your visitors.
If you cannot see the warning yourself, trust the report. Google says Safe Browsing "displays warnings to users based on the browsing context", so you may not be able to reproduce it, and "you should rely on the Security Issues report as the source of truth". Anyone can also look a site up in Google's Safe Browsing site status tool, which shows whether Safe Browsing currently considers it dangerous.
Bought a domain or site that was already flagged? Google says to fix the listed issues, then mention in the review request "that you recently acquired the site".
The three groups of issues
- Hacked content: "any content placed on your site without your permission because of security vulnerabilities in your site." Google's spam policies list the forms it takes: code injection (often malicious JavaScript or iframes), page injection (new spam or phishing pages), content injection (hidden links or text, sometimes cloaked) and redirects that only trigger for some visitors, for example those arriving from Google Search.
- Malware and unwanted software: software "designed to harm a device or its users, that engages in deceptive or unexpected practices, or that negatively affects the user." Google notes it "can be either installed by a hacker or the site owner".
- Social engineering: "content that tricks visitors into doing something dangerous, such as revealing confidential information or downloading software." That covers phishing, deceptive content such as ads that falsely claim your device software is out of date, and third-party services that do not make clear whose site the visitor is on.
The last one catches honest sites. Google's example is a charity that collects donations through a separate platform: the donation site "must clearly identify that it is a third-party platform acting on behalf of that charity site, or else it could be considered social engineering." The same applies to ads. Deceptive content can arrive through "images, other third-party components, or ads", and Google treats it as "a policy violation for the host page", even when your own code is clean.
Every issue in the report
| Issue | What Google found |
|---|---|
| Hacked: Malware | The site is infected with, or hosting, malware from a hacker. |
| Hacked: Code injection | Malicious code added to your pages, for example redirects to a malicious site or in-browser cryptocurrency mining. |
| Hacked: Content injection | Spam links or text added to existing pages, often pharmaceutical terms. |
| Hacked: URL injection | New pages created by a hacker, often with spam words or links, sometimes with code that redirects visitors. |
| Deceptive pages | Pages that imitate a trusted entity or try to get passwords, calls to fake support numbers or downloads. |
| Deceptive embedded resources | The same, delivered through ads, images or other third-party components, including pop-ups and pop-unders. |
| Harmful downloads | Downloads that Safe Browsing classes as malware or unwanted software. Chrome may warn visitors. |
| Links to harmful downloads | Links to other sites that offer such downloads. |
| Unclear mobile billing | Pages that do not tell users clearly enough about mobile charges. |
| Possible phishing detected on user login | A password reuse warning was triggered when someone logged in on one of your pages. |
| Suspected deceptive pages | Content flagged as possibly deceptive. |
| Uncommon downloads | A download Safe Browsing has not seen before. Google says this "will not prevent your page or site from appearing in Google Search results", but Chrome may warn when someone first downloads the file. |
In this report "Malware" means "web-based malware that operates without explicit user action", while "Harmful downloads" means files "that must be explicitly downloaded by the user".
Checking a flagged page safely
Google's advice for hacked issues is to avoid opening infected pages directly in a browser, "Because malware often spreads by exploiting browser vulnerabilities". Hackers also hide their changes from site owners, so a page can look normal to you and still be infected. Google suggests two alternatives:
- The URL Inspection tool in Search Console, which shows the page as Google sees it. That matters because "many hackers make changes that are visible only to Google machines."
- cURL or Wget from the command line, with a Google referrer or a different user agent, because hacks often target only visitors who come from search.
For hacked code, Google suggests searching your files and responses for terms such as "eval", "base64_decode" and "unescape". For spam pages, try a site: search in Google, for example site:example.com plus a spam word. For deceptive ads, refresh the page a few times, because ad networks rotate what they show, and check both mobile and desktop.
Fixing it
The rules that apply to every issue type:
- Fix the whole site. "Fixing the issue on just some pages will not earn you a partial return to search results." If the report lists several issues, fix all of them.
- Close the way in. Google Search Help says to fix the problem "that allowed your website to be infected. Otherwise, your site is likely to be reinfected." Google names insecure directories, outdated content management systems and hacked third-party plugins as common causes.
- Restore or clean. Google's options are to "replace affected files with the last good backup" or remove the injected content by hand. A clean backup from before the hack is often the fastest route, which is why our website backups guide covers how many copies to keep and how to test a restore.
- Check who has access. For social engineering, Google says to check "that no new, suspicious owners have been added" in Search Console.
- Keep pages crawlable. The web.dev review guide notes that cleaned pages must not be "roboted out or blocked from indexing by noindex", or Google cannot confirm they are clean.
For your own downloads, Google suggests running files through antivirus software or a service such as VirusTotal, while noting that Safe Browsing "applies its own criteria". Google also says fixing malware "requires the ability to read and understand code, and possibly web server configurations". If that is not you, bring in your developer or host before you request a review.
Requesting a review
When every listed issue is fixed on every page, open the Security issues report and select Request Review. Google says a good request "Explains the exact quality issue on your site", "Describes the steps you've taken to fix the issue" and "Documents the outcome of your efforts". Its own sample for a hacked site: "For Content injection hacked URLs, I removed the spam content and corrected the vulnerability by updating an out-of-date plugin."
You get an email when the request arrives and another when the review is finished. Do not send a second request while one is pending. Google warns that requesting a review before the issue is fixed "can cause longer turnaround time for the next request, or even get you marked as a repeat offender".
If you think Safe Browsing flagged a page by mistake, Google points to its Safe Browsing error report form. Google says that form can also trigger a review of phishing pages that have been cleaned.
How long reviews take
Google gives different figures in different places, so here they are side by side:
| Case | What Google says | Source |
|---|---|---|
| Each issue type in the report | "from a few days to a few weeks" | Security issues report |
| Social engineering | "several days" | Social engineering doc |
| Hacked with spam | "up to several weeks", because it can involve manual investigation | web.dev |
| Malware | "a few days" | web.dev |
| Phishing | "about a day" | web.dev |
If the review passes, web.dev says warnings in browsers and search results "will be removed within 72 hours". If it fails, the report may show more sample URLs to help with the next round. For uncommon downloads, Google will "eventually" classify most files without a request, but a request "can help speed the evaluation process".
Repeat offenders
Safe Browsing has a policy for sites that keep getting reinfected or keep putting harmful content back: "Sites that repeatedly switch between compliant and noncompliant behavior within a short window of time will be classified as Repeat Offenders." The owner is emailed at the Search Console address, can no longer request reviews, and the status "persists for 30 days". In practice, a quick clean-up that leaves the hole open can keep warnings up for a month. Finding the real cause first is the faster path.
Once the warning is gone, the work becomes ongoing care: updates, monitoring and tested backups. We cover what that involves in our website maintenance checklist.
Frequently asked questions
Where is the security issues report in Search Console?
It is one of the reports in Search Console, called Security issues. You need a verified property to see it. If the site is clean it shows a green check mark.
Why can't I see the warning Google says is on my site?
Safe Browsing warnings depend on the browsing context, and hackers often hide their changes from site owners. Google says to treat the Security issues report as the source of truth.
Is a security issue the same as a manual action?
No. Manual actions are about attempts to manipulate search results and usually lower rankings without a label. Security issues are about harm to visitors and show warnings in search results or the browser.
How long does a security review take?
Google says from a few days to a few weeks. Its web.dev guide gives about a day for phishing, a few days for malware and up to several weeks for hacked spam. Warnings are removed within 72 hours of a successful review.
Can I request a review if only some pages are fixed?
You can, but it will not help. Google says partial fixes do not earn a partial return, and an early request can slow the next one or lead to repeat offender status.
What is a Safe Browsing repeat offender?
A site that switches between safe and harmful behavior within a short time. The owner is emailed and cannot request reviews for 30 days.
Keeping a site updated, monitored and backed up is part of our website maintenance work. See all our services, or browse more guides.