How to remove Google’s “dangerous site” warning

Which warning do you have?

• A red full-page warning (“Dangerous site”, “Deceptive site ahead”, “The site ahead contains malware”): Google Safe Browsing has flagged the site for malware, phishing or unwanted software. Chrome, Firefox and Safari use this list, so most visitors are blocked.
• “This site may be hacked” under your result in Google Search: Google found content a hacker added, typically spam pages, hidden links or redirects to other sites.
• A manual action in Search Console: a person at Google reviewed the site for a spam policy violation. This is handled in the Manual Actions report, not the Security Issues report.

Step 1: Confirm what Google found

Look up your domain in Google’s Safe Browsing site status page (part of the Transparency Report). Then open Google Search Console, choose your property and go to Security & Manual Actions → Security issues. It names the issue type and lists example URLs. If the site isn’t in Search Console yet, add it as a domain property and verify it with a DNS TXT record.

Step 2: Find the infected pages

Open the example URLs in a private window, but expect that hacks often hide from logged-in owners and only show to search engines or visitors arriving from Google. Fetch the page the way Googlebot does and look for scripts, iframes or redirects you didn’t add:

curl -s -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" https://yourdomain.com/ \
  | grep -iE '<script|<iframe|http-equiv="refresh"' | head -n 20

On the server, list PHP files changed recently. Attackers often drop files with names that look like WordPress files:

find /path/to/site -type f -name '*.php' -mtime -14 -printf '%TY-%Tm-%Td %p\n' | sort

On WordPress, WP-CLI compares core and plugin files with the official copies and shows every administrator account:

wp core verify-checksums
wp plugin verify-checksums --all
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

Injected scripts often live in the database (posts, widgets, options), where a file scan won’t see them:

wp db search '<script' --all-tables
wp db search 'eval(' --all-tables

Also check .htaccess files for rules that redirect only search engines or visitors from Google:

grep -rnE --include=.htaccess 'HTTP_REFERER|HTTP_USER_AGENT|base64' /path/to/site

Step 3: Clean the site and close the hole

Deleting the visible spam isn’t enough: if the way in is still open, the infection returns within days. Work through this list:

• Take a full backup of files and database first, even of the infected site, for comparison.
• Replace WordPress core, plugins and themes with fresh copies from the official sources; don’t try to clean them line by line.
• Delete plugins and themes you don’t use, and update everything else. See how to find outdated plugins with known vulnerabilities.
• Remove unknown administrator accounts, then change all passwords: WordPress users, hosting panel, SFTP/SSH, database and email.
• Replace the secret keys in wp-config.php (wp config shuffle-salts) so every stolen session is logged out.
• Remove the spam pages Google listed. Return 404 or 410 for them, not a redirect to your homepage.

The step-by-step cleanup is in How to tell if your WordPress site is hacked (and clean it up). If you aren’t sure the site is clean, restore a backup from before the infection and then update everything.

Step 4: Request a review

Only when the whole site is clean, return to the Security issues report, tick I have fixed these issues and choose Request review. Describe what you did, issue by issue, for example: “Removed injected JavaScript from 14 posts, replaced an outdated slider plugin with the current version, deleted an unknown admin account and changed all passwords.” According to Google, phishing reviews take about a day, malware reviews a few days, and hacked-spam reviews can take several weeks. Once a review is approved, the warnings are usually removed from browsers and search results within about 72 hours. Don’t submit again while a review is pending, and don’t take the site offline: Google needs to fetch it to check it.

Step 5: Keep it from happening again

• Keep Search Console email notifications on; it is usually the first place you hear about a new problem.
• Turn on automatic updates for plugins you trust, and remove the ones you don’t need.
• Use two-factor login for every administrator. See how to secure the WordPress login.
• Keep off-site backups with several restore points, and test a restore.

What HackGrade checks

HackGrade doesn’t query Google’s Safe Browsing list; use the Transparency Report and Search Console for that. Its free scan flags the most common ways in, such as outdated WordPress core, plugins and themes with known vulnerabilities, listed usernames and XML-RPC. The deep scan, for verified owners only, also looks for injected code such as fake CAPTCHA pages. See also Is my website hacked?