Will a Hacked Website Lose Its Google Ranking? (October 2026)

A hacked website can lose its Google ranking, because Google's spam policies list hacked content as a violation, and sites that violate them "may rank lower in results or not appear in results at all". That line is from Google's spam policies, which define hacked content as content "placed on a site without permission, due to vulnerabilities in a site's security".

Ranking is only part of it, though. For a business that lives on Google enquiries, these are the five things that can happen:

"This site may be hacked" sits under your result in Google and tells searchers that a hacker may have changed your pages or added spam ones; your site still opens, but Google's help page advises people not to visit while the label is there. Google applies it "when we believe a hacker might have changed some of the existing pages on the site or added new spam pages", per its Search help page.

Your position in the results may not even change. But a renovation firm with that label under its name is going to lose most of the people who were about to click, and those are the enquiries you care about.

The same help page gives the way out: verify the site in Search Console, check Security Issues for sample URLs, fix the weakness that let the attacker in, and request a review once the whole site is clean. Google removes the label after it confirms the fix. A site carrying malware gets a harsher label, "This site may harm your computer", according to Google's guide for sites hacked with malware.

"Deceptive site ahead" is the red full-page warning Chrome shows when Google Safe Browsing decides a site is tricking visitors, for example with a fake login page, a scam download or ads that redirect to scams. People call it being on the Google blacklist. Officially it's the Safe Browsing list, and Google's page on social engineering explains what puts a site on it.

Two details from that page matter to owners. Deceptive content in embedded ads counts against your page even though you didn't write it. And when you check the sample URLs, Google suggests doing it from a computer outside your hosting network, because attackers may switch their content off for the site's owner. Google says a review after you remove the content can take several days.

Check where you stand on Google's Safe Browsing site status page. And fix it properly the first time. Under Google's repeat offenders policy, sites that keep switching between clean and harmful get a status that "persists for 30 days", and you can't request another review until it ends.

A hack on its own usually shows up in the Security Issues report rather than as a manual action, but some of the things hacks do, like sending phone visitors to spam sites, are manual action types in their own right. A manual action is a penalty a human reviewer at Google applies, and you see it in Search Console under Manual actions.

Google's Manual Actions help says the Security Issues report "lists indications that your site was hacked". Its list of manual actions includes "Cloaking and/or sneaky redirects" and "Sneaky mobile redirects". Google's spam policies give this as an example of a sneaky redirect: "showing desktop users a normal page while redirecting mobile users to a completely different spam domain". That is exactly what a lot of hacks do.

So check both reports. A manual action can mean "some or all of that site will not be shown in Google search results", and the fix is a reconsideration request once every listed issue is fixed. Google says most reconsideration reviews take "several days or weeks".

Yes. Google Ads disapproves ads that lead to a compromised site, so your ads stop running until the site is clean, and if the problem continues the account can be suspended after a warning. For a business paying for clicks, that's the fastest way a hack costs money: the enquiries stop the day the ads do.

Google's Ads policy on compromised sites defines one as "a site or destination whose code has been manipulated to act in ways that benefit a third party", and names credit card skimmers and malware among the examples that lead to disapproval. What the policy says about fixing it:

• Violations "won't lead to immediate account suspension without prior warning", and a warning comes at least 7 days before any suspension.
• Use the Search Console Security Issues report to find the problem, and check the domain on Safe Browsing's site status page.
• After fixing malware, file an appeal through Search Console to get the domain off the Safe Browsing threat list.
• Then resubmit the ads, and allow up to 72 hours for Google to recrawl the site.

If you run ads, don't wait for the warning. Pause the campaigns pointing at the hacked pages and fix the site first.

Spam pages hurt the rest of your rankings by putting your domain in breach of Google's spam policies, and in my experience they also drag your real pages down by flooding Google with thousands of junk URLs under your name. Google documents the first part. It doesn't publish how much the second part costs, so that's what I've seen on hacked sites rather than what Google says.

What I usually find:

• Google spends its visits to your site crawling spam, so a new service page can take longer to be picked up.
• Your business name starts appearing beside Japanese product titles or casino pages in Google, which is what customers see when they search for you.
• Search Console's Performance report fills with clicks on queries that have nothing to do with you, while the searches that bring real enquiries slip.

The real pages are still there, and that's the hopeful part. Once the junk is gone and Google has recrawled, they have nothing pulling against them.

To get your Google ranking back after a hack, clean the site and close the hole first, then use Search Console to remove the attacker's access, kill the spam URLs, fix your sitemap and request a review, and keep checking for a few weeks. In this order:

1. Clean the site and close the hole. Everything else is wasted if the attacker can walk back in. My guide to the first 24 hours after a hack has the clean-up order.
2. Get into Search Console and check who else is in it. Under Settings, then Users and permissions, remove anyone you don't recognise. For a verified owner, also delete their verification token from the site, per Google's permissions help, or they can verify again.
3. Make every spam URL return a 404 or 410. Google's clean-up guide says deleted pages that return a 404 drop out of the index over time.
4. Use the Removals tool for new spam URLs only. It hides them faster, but only for about six months, and never use it on your real pages that the hacker merely changed.
5. Check your sitemaps. In the Sitemaps report, delete any you didn't submit, then delete the sitemap file itself. Google says removing a sitemap from the report alone doesn't make it forget the URLs in it. Resubmit your real one.
6. Request a review in Security Issues. Explain the problem, what you fixed and the result. Fix every affected page first, because a partial fix doesn't earn a partial return.
7. Handle any manual action with a reconsideration request in the Manual actions report.
8. Resubmit your Google Ads once the review clears.
9. Watch it for a month. Run a site:yourdomain.com.sg search each week, and keep an eye on Search Console's Performance report for your normal searches coming back.

Google says a Security Issues review takes from a few days to a few weeks; ranking recovery after that has no published timeline. These are the timings Google documents:

The 72-hour warning figure comes from Google's request a review guide, which was last updated years ago, so treat it as a guide. Google's current help also warns that asking for a review before the site is fixed can make the next review take longer.

Usually, yes, but not instantly, and Google doesn't guarantee it. Once the warnings are lifted and the spam pages have dropped out, the sites I've seen recover tend to climb back as Google recrawls their real pages. How long that takes depends on how big the hack was, how long it ran and how often Google visits your site. Anyone promising a date is guessing.

Some sites don't fully come back, usually because the hack ran for months, the clean-up missed a backdoor and the site got reinfected, or the spam left a trail of junk links pointing at the domain. If the warnings have been gone a while and your normal searches still haven't returned, that's an SEO job rather than a security one, and it's what my SEO service is for.

Most small business sites get hacked through an outdated plugin, a reused password or an unpatched server, and this month an unpatched PHP version is high on that list. PHP is the software on your server that builds each page, and WordPress runs on top of it. On 21 October 2026, PHP fixed two critical flaws known as PHP2Shell in releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35, per the PHP security advisory. Sites on 8.1 or older got no fix from the PHP project, and the US agency CISA said PHP systems that can't be patched should be taken offline.

If you clean the spam but leave PHP old, you're cleaning a site with the door still open. Checking your PHP version takes a couple of minutes, and my plain-English guide to PHP2Shell covers what to ask your host.

Some owners decide a rebuild costs less than keeping an old PHP site patched. A static site has no PHP running for a bug like this to reach. When I moved MET Interior's 176-page site from WordPress to Astro in August 2026, every old URL was mapped across, which is what protects rankings during a move.

No. The way to remove a hacked warning from Google is to clean the site and request a review in Search Console's Security Issues report, which means you need access to Search Console for your domain. If the person who built your site set it up under their own Google account, ask them to add you as an owner, or verify the site yourself. Verifying is free and takes a few minutes with access to your domain or hosting.

Use the Removals tool only for brand-new spam URLs the hacker created, and only alongside a 404 or 410, because a removal lasts about six months. Google's Removals help says a successful request "lasts only about six months", and that permanent removal needs the page to return a 404 or 410, sit behind a password, or carry a noindex tag. Never use it on your own pages that were merely tampered with. You want those back in Google, cleaned.