A hacked site is a website on which third parties have placed content, code or redirects without permission. Google defines hacked content as any content placed on a site without permission due to vulnerabilities in its security. In SEO, spam injection is the typical case: attackers add spam pages or hidden links to profit from the site’s reputation.
What types of hacked content does Google describe?
Google’s spam policies name four forms:
- Code injection: malicious code such as JavaScript or iframes inserted into existing pages.
- Page injection: new pages with spam or phishing material, while the original pages look unchanged.
- Content injection: hidden text or links added through CSS, HTML or cloaking, so that search engines see them but owners and visitors may not.
- Redirects: code that sends some users to spammy or harmful pages, sometimes depending on referrer, user agent or device.
Where does a hack show up?
The Security Issues report in Search Console lists what Google detected, grouped into hacked content, malware and social engineering. Affected pages can carry a warning label in search results, and browsers can show a warning page before the site loads.
After the issues are fixed, you can submit a reconsideration request in the report. Google states that most reviews take several days or weeks, and resubmitting before a decision can extend the process.
Example
A company site suddenly has hundreds of URLs such as /shop/cheap-watches-4711.html that appear in no menu but show up in Google. They are the result of page injection.
Signs to look for
- Unknown URLs in the index or the performance report
- Redirects that only affect visitors coming from Google
- A warning in the Security Issues report
- Impressions for queries unrelated to your business
Checklist
- Read the issue in the Security Issues report and follow its description and “Learn more” link.
- Confirm the problem on one of the example URLs. According to Google, the examples are only a sample, not a complete list of affected pages.
- Avoid opening infected pages directly in a browser. Fetch them with cURL or Wget instead and mimic the referrer and user agent of a Google Search visit, because attackers often serve spam only to specific user agents or referrers.
- Also view the page as Google sees it with the URL Inspection tool.
- Clean the site, either by restoring the last good backup or by removing the spam content. Search for further affected pages with
site:and by searching the source files. - Close the vulnerability that allowed the access. Google names open directory permissions, outdated CMS versions and hacked third-party plugins as typical causes.
- Fix every issue listed in the report on the whole site and test the fixes.
- Only then select Request Review and describe the problem, the steps taken and the outcome.
Common mistakes
- Cleaning only some of the pages. According to Google, fixing the issue on just some pages does not earn a partial return to search results.
- Requesting a review too early. A request submitted while the issue is not fixed can lengthen the turnaround for the next request and can get the site marked as a repeat offender.
- Resubmitting before a decision. Google asks site owners to wait for the result of an open request. Reviews typically take several days or weeks.
- Checking only in a browser. Some changes are visible only to Google’s fetches, to specific user agents or to visitors coming from Google Search, so a normal browser visit can miss them.
FAQ
How do I find out if my site was hacked? Check the Security Issues report in Search Console and look for unfamiliar URLs and unexpected redirects.
Sources
- Spam policies for Google web search (hacked content) – Google Search Centraldevelopers.google.com
- Security Issues report – Search Console Helpsupport.google.com
Last updated: