Hacked Website SEO: How to Recover Your Rankings Step by Step
By Shehazia Muhazina, digital marketing strategist in Kannur, Kerala
A hacked website can lose search visibility because Google may flag it, warn visitors, or drop affected pages. Recovery comes down to four steps: find the hack, clean it completely, close the hole that let attackers in, then ask Google to re-review the site.
If you’re reading this because your site was just compromised, take a breath. This is fixable, and the order you do things in matters most. I work on SEO and WordPress websites every day, and the recovery side of a hack is something I want site owners to understand clearly.
How a hacked website damages your SEO
You don’t have to be deleted from Google to lose traffic. A hack hurts in a few quiet ways.
Google can warn people away. Pages affected by a security issue can show a warning label in search results, or an interstitial warning page when someone tries to visit. Few people click past that, so traffic drops quickly.
Spam gets injected into your pages. Common patterns include hidden links, strange pages in other languages, and pharmacy or gambling content. Google groups these under labels such as “Hacked: Malware” and “Hacked: Code injection.”
Cloaking makes it worse. This is when attackers show Google one version of a page and visitors another. It raises the risk of both security issues and manual actions.
Trust erodes. Even after cleanup, visitors who saw a warning may not come back for a while.
Step 1: Confirm what Google sees
Start with Google Search Console. The Security Issues report shows Google’s findings if it decides your site was hacked or could harm visitors. The same report is the source of truth for whether issues still exist or have been fixed.
While you’re there, check the Manual Actions report. Then search site:yourdomain.com in Google and look for pages or titles you never created.
Step 2: Document before you delete
It’s tempting to wipe everything immediately. Resist that for ten minutes. One recovery guide advises recording the current situation first, since the timeline of events is the most valuable data in a recovery.Take screenshots, note the dates of suspicious files, and save your server logs. You’ll need these to find the entry point and to write a convincing review request later.
Step 3: Clean it completely
Don’t stop at the visible symptoms. Checking the CMS dashboard alone isn’t enough when there’s a security alert; you need to inspect server files too.
A solid cleanup covers:
- Removing injected code, rogue files and unknown admin users
- Replacing core files with fresh copies from a trusted source
- Deleting plugins and themes you don’t use, and updating the rest
- Resetting every password, API key and database credential
- Checking scheduled tasks (cron jobs) and .htaccess for sneaky redirects
If you’re not confident doing this yourself, ask your hosting provider or a website security specialist to handle the technical cleanup. Restoring from a clean backup taken before the infection is often faster, as long as you then fix the hole.
Step 4: Close the door that let them in
Cleaning without patching just invites a repeat. Find the entry point: an outdated plugin, a weak password, or a flaw in the server software itself. If your site was caught up in the recent PHP2Shell wave, that’s a server-level problem, and updating PHP is the fix.
Prevention pays off. One guide says isolated hosting accounts, current PHP, a web application firewall, malware scanning and regular backups can cut recovery to hours. A well-built, regularly maintained WordPress site is far harder to break into, and that’s part of how I approach web design and SEO for clients.
Step 5: Ask Google to review the site
Only do this once everything is clean. Submitting a request while the problem is still there can lengthen the next turnaround, or even get your site marked as a repeat offender. Leftover malicious content will likely cause Google to delay or deny the request.
When you’re confident, open the Security Issues report and choose Request a review. In the request, describe your fixes. Be specific. For each issue type, say what you removed and what vulnerability you closed, for example “updated PHP and removed the compromised plugin.”
How long will it take? A review can take anywhere from a few days to a few weeks.
One reassuring note: Google has tested automatically lifting hacked-site manual actions when it detects that the hacked content is gone, but it still suggests you check and submit a request if needed. Don’t count on automation. Verify.
Step 6: Rebuild trust and monitor
After the warning clears:
- Re-submit your XML sitemap in Search Console
- Watch the Security Issues and Manual Actions reports for the next few weeks
- Check that no spam URLs remain indexed
- Set up uptime and file-change monitoring
- Keep tested, offsite backups
Rankings usually return gradually, not overnight, so track impressions and clicks week by week. For more practical guides like this, browse the latest posts on my blog.
Frequently asked questions
Can a hacked website lose its Google rankings? Yes. Google can show warnings, flag the site in Search Console, or remove affected pages, all of which reduce traffic.
How do I know if Google flagged my site? Open the Security Issues report in Google Search Console. It lists any problems and sample affected URLs.
How long does Google take to review a hacked site? Anywhere from a few days to a few weeks after you submit a review request.
Should I submit a review request right away? No. Clean the site and fix the vulnerability first, or you risk delays and rejections.
Will my rankings come back after recovery? In most cases they recover gradually once the issues are resolved and the warnings are cleared, but the timing varies.
Is updating PHP part of SEO? Indirectly, yes. An unpatched server is a common way sites get hacked, and a hack can cost you rankings.
Final thoughts
A hack is stressful, but it doesn’t have to be permanent. Find it, document it, clean it, patch the entry point, and only then ask Google to look again. Do it in that order and you give your rankings the best chance of coming back.
Want help getting your site’s SEO back on track? Visit my homepage to see my services, read more guides on the blog, or get in touch here.