Google shows 'This site may be hacked' when it thinks someone changed your pages or added spam. Here's what it means and what to do first.
What it means
In Google search results, your site has a warning label saying it may be hacked. Google detected spam content, injected links, or malicious code on your pages - it's warning searchers before they click.
Why it happens
Hackers inject spam content into WordPress sites - hidden links, doorway pages, pharma/casino spam, or malicious scripts. Google detects this during crawling and flags the site to protect users.
What to do
- Check Google Search Console for the specific security issue type.
- Scan your site for spam content - look for pages/posts you didn't create.
- Check for injected scripts in theme files, wp-config.php, and database options.
- Remove all malicious content - blocking the pages isn't enough, the code must go.
- Request a review in Search Console after cleanup.
Still stuck? Google hacked-content flags need thorough malware removal - we clean every trace and handle the reconsideration.
Get emergency help