# Hacked site

Category: [Technical SEO](https://seo-geo-glossary.com/en/glossary/category/technical-seo/) › [CMS, operations & special files](https://seo-geo-glossary.com/en/glossary/category/technical-seo/cms-operations-special-files/) · Also known as: hacked website, SEO spam hack, spam injection

A **hacked site** is a website on which third parties have placed content, code or redirects without permission. Google defines hacked content as any content placed on a site without permission due to vulnerabilities in its security. In SEO, spam injection is the typical case: attackers add spam pages or hidden links to profit from the site's reputation.

## What types of hacked content does Google describe?

Google's spam policies name four forms:

- **Code injection:** malicious code such as JavaScript or iframes inserted into existing pages.
- **Page injection:** new pages with spam or phishing material, while the original pages look unchanged.
- **Content injection:** hidden text or links added through CSS, HTML or cloaking, so that search engines see them but owners and visitors may not.
- **Redirects:** code that sends some users to spammy or harmful pages, sometimes depending on referrer, user agent or device.

## Where does a hack show up?

The Security Issues report in Search Console lists what Google detected, grouped into hacked content, malware and social engineering. Affected pages can carry a warning label in search results, and browsers can show a warning page before the site loads.

After the issues are fixed, you can submit a reconsideration request in the report. Google states that most reviews take several days or weeks, and resubmitting before a decision can extend the process.

## Example

A company site suddenly has hundreds of URLs such as `/shop/cheap-watches-4711.html` that appear in no menu but show up in Google. They are the result of page injection.

## Signs to look for

- Unknown URLs in the index or the performance report
- Redirects that only affect visitors coming from Google
- A warning in the Security Issues report
- Impressions for queries unrelated to your business

## Checklist

- Read the issue in the Security Issues report and follow its description and "Learn more" link.
- Confirm the problem on one of the example URLs. According to Google, the examples are only a sample, not a complete list of affected pages.
- Avoid opening infected pages directly in a browser. Fetch them with cURL or Wget instead and mimic the referrer and user agent of a Google Search visit, because attackers often serve spam only to specific user agents or referrers.
- Also view the page as Google sees it with the URL Inspection tool.
- Clean the site, either by restoring the last good backup or by removing the spam content. Search for further affected pages with `site:` and by searching the source files.
- Close the vulnerability that allowed the access. Google names open directory permissions, outdated CMS versions and hacked third-party plugins as typical causes.
- Fix every issue listed in the report on the whole site and test the fixes.
- Only then select Request Review and describe the problem, the steps taken and the outcome.

## Common mistakes

- **Cleaning only some of the pages.** According to Google, fixing the issue on just some pages does not earn a partial return to search results.
- **Requesting a review too early.** A request submitted while the issue is not fixed can lengthen the turnaround for the next request and can get the site marked as a repeat offender.
- **Resubmitting before a decision.** Google asks site owners to wait for the result of an open request. Reviews typically take several days or weeks.
- **Checking only in a browser.** Some changes are visible only to Google's fetches, to specific user agents or to visitors coming from Google Search, so a normal browser visit can miss them.

## FAQ

**How do I find out if my site was hacked?**
Check the Security Issues report in Search Console and look for unfamiliar URLs and unexpected redirects.

## Related terms

- [Google Safe Browsing](https://seo-geo-glossary.com/en/glossary/google-safe-browsing/index.md)
- [Cloaking](https://seo-geo-glossary.com/en/glossary/cloaking/index.md)
- [Hidden text](https://seo-geo-glossary.com/en/glossary/hidden-text/index.md)
- [Sneaky redirects](https://seo-geo-glossary.com/en/glossary/sneaky-redirects/index.md)
- [Spam policies](https://seo-geo-glossary.com/en/glossary/spam-policies/index.md)
- [Manual action](https://seo-geo-glossary.com/en/glossary/manual-action/index.md)
- [Google Search Console](https://seo-geo-glossary.com/en/glossary/google-search-console/index.md)

## Sources

- [Spam policies for Google web search (hacked content) – Google Search Central](https://developers.google.com/search/docs/essentials/spam-policies)
- [Security Issues report – Search Console Help](https://support.google.com/webmasters/answer/9044101)

---

Last updated: October 8, 2026
URL: https://seo-geo-glossary.com/en/glossary/hacked-site/