Website Hacked? How to Clean It, Recover Your Google Rankings and Protect Your Site

When most owners hear that their website was hacked, they picture a defaced homepage with a dramatic message. In reality, the commonest hacks are quiet. Attackers do not want you to notice. They use your website, your domain's age and your hosting to promote something else: online gambling, counterfeit goods, pills, adult content, scam pages or redirects to other sites. Your site keeps loading normally for you, while thousands of hidden pages are created for search engines, and visitors from Google are sent somewhere you never intended.

The damage builds in layers. First, Google may flag the site as unsafe, showing a red warning in the browser or in search results. Second, your real rankings fall, because Google sees a flood of low-quality pages and loses trust in the domain. Third, your own customers lose confidence if they see warnings or spam. Fourth, your hosting company may suspend the account. Fifth, and most frustratingly, cleaning the files does not automatically fix the search results. The spam pages remain in Google's index for weeks or months unless you act.

This guide explains how to tell whether your site has been hacked, how to clean it properly, how to repair your search visibility and how to prevent a repeat. It is written for business owners and the people who manage their websites, in plain language. If you would rather have a team handle it, our website maintenance service covers cleaning, monitoring and protection.

Some signs are obvious. Others appear only in search results or analytics. Check these.

A very common trick is cloaking. The hacked code shows normal content to you and to anyone who types the address, but shows spam to people arriving from Google or to search engine crawlers. That is why a site can look fine when the owner checks and still be full of spam in search results.

Do not panic and do not start deleting things at random. A few calm steps in the first hour make the cleaning far more reliable.

1. Confirm with more than one check. Search Google for the word site followed by a colon and your domain name, and scroll through the results. Look for pages you do not recognise. Open Search Console and check the Security issues and Manual actions reports. Look at the Pages report for sudden increases. Run the site through a reputable malware scanner and check the hosting control panel for any malware warnings.

2. Decide whether to take the site offline. If the site is actively sending visitors to harmful pages or serving malware, put up a simple maintenance page. This protects your visitors and your reputation. Your hosting provider can usually help with this. If the damage is limited to hidden spam pages, you may keep the real site live while you clean, but move quickly.

3. Take a full backup of the current state, infected or not. It sounds odd to back up a hacked site, but you may need to examine it to find how the attacker got in. Store the copy offline, and label it clearly as infected so no one restores it by mistake.

4. Change every password. Do this from a clean device. Change the hosting account password, FTP and SSH credentials, database password, content management system administrator passwords, and the email accounts connected to them. Remove old users and old SSH keys that you do not recognise or no longer need. If you reuse passwords across services, change those too.

5. Tell your host. A good hosting provider can help scan the account, identify the entry point and restore from a clean backup. Ask whether they keep their own backups and from what dates.

Cleaning a hacked site means finding everything the attacker planted, not only the visible spam. Attackers deliberately leave several ways back in, so removing one file while missing another means the infection returns within days. Look for the following.

Unknown or modified files. On a WordPress site, compare the core files against a clean copy of the same version. Anything extra or altered is suspicious. Pay special attention to files in the uploads folder, which should hold images and documents but never executable code, to folders with random names and to files with names that imitate system files.

Backdoors and web shells. These are small scripts that give the attacker remote control, often hidden inside legitimate-looking files. They may be obfuscated with functions that decode text and run it. Scanners catch many of them, but not all. A manual review of recently modified files is worth the time.

Modified configuration files. Check the server configuration file for strange rewrite rules that redirect visitors from search engines, and check any file that loads code on every page. Attackers often add a few lines at the top of an existing file.

Database changes. Spam content may be injected into the database: hidden links in posts, new posts or pages, malicious scripts in widgets and options, and new administrator users. Review users, recent posts, options and widget content.

Scheduled tasks. Look for scheduled jobs that re-create malicious files, or that fetch code from another site.

Plugins and themes. Remove any plugin or theme you do not use. Check the ones you keep against official sources, and delete any that are abandoned, cracked or downloaded from unofficial sites. Nulled, pirated themes and plugins are among the most common sources of infection.

There are three ways to clean a site, and the right one depends on how deep the infection is and how good your backups are.

Restore from a known clean backup. If you have a backup from before the infection, and you can be sure it is clean, restoring it is the fastest method. The key phrase is known clean. Backups can contain the infection too, especially if it was planted weeks before you noticed. Before restoring, scan the backup and check its file dates. After restoring, immediately update everything and change all passwords, or the attacker will use the same hole again.

Rebuild on a fresh install. For smaller sites, the most reliable approach is often to install a fresh copy of the platform, add clean versions of the plugins and theme from official sources, and then import only the content: posts, pages, products and media. Check the imported content for hidden spam links. This avoids carrying over any hidden backdoor in old files. It takes longer, but it gives confidence.

Repair in place. For large or complex sites where a rebuild is impractical, you can remove malicious files and code one by one. This needs careful, experienced work, because missing a single backdoor means reinfection. It is generally the least reliable method and works best when a professional does it with good tools.

In our experience, the most important lesson is to be sceptical about old copies. If an attacker was inside your account for weeks, every backup from that period may carry their files. A clean site is built from clean parts, not from whatever copy is closest.

Cleaning without fixing the cause is a waste of time. Common entry points include outdated software, vulnerable or pirated plugins and themes, weak or reused passwords, compromised devices, stolen credentials, insecure file permissions and poorly protected admin areas. Try to work out which applies.

Look at the logs if your host provides them. Find the earliest suspicious activity, such as a login at an odd hour or a request to a file that should not exist, and trace back what happened before it. If you cannot determine the cause, assume the worst and rotate every credential, update everything and remove everything unnecessary.

Once the site is clean, Google's index may still list hundreds or thousands of spam addresses. These need to be dealt with directly.

Make removed pages return the right response. The best signal for a page that should no longer exist is a response meaning gone, known as 410, or not found, 404. Both tell Google the page is not coming back, and the 410 is slightly faster. Avoid redirecting spam addresses to your homepage, because Google may treat that as a soft error.

Use the removals tool for urgent cases. Search Console lets you temporarily hide addresses or whole folders from results while the removal takes effect. It is useful for prominent spam pages, but it is temporary, so it must be combined with proper 404 or 410 responses.

Submit a clean sitemap. Remove spam addresses from the sitemap and submit only your real pages. Check that the sitemap does not contain addresses created by the hack.

Request a review if you were flagged. If Search Console shows a security issue or a manual action, fix the problem and then use the review option, with a short, honest description of what happened and what you changed. Google reviews these requests, typically within days to a couple of weeks.

Be patient. Spam addresses can linger in reports as "not found" for months. That is normal and does not mean you have failed. They fade as Google recrawls and drops them. Thousands of old addresses showing as not found in the page indexing report is a typical sign of a past clean-up, not of a current problem.

When Google has seen a lot of spam on a domain, it may suppress the genuine pages for a while. Recovery usually follows once the site has been clean for some time and Google has recrawled it. You can speed things up with a few actions.

If the hack happened long ago and rankings never recovered, the problem may not be the hack any more. It may be that the domain lost momentum, the content is thin or competitors have moved ahead. A fresh look at content, structure and links is then the right next step, and our SEO services can help with that. Our guide on how long SEO takes explains realistic timelines.

Understanding the typical patterns helps you spot them early. The gambling spam pattern creates thousands of pages with names of lottery and betting terms, often from other countries, and can send surprising amounts of low-value traffic to a small business site for a short while. You may notice a sudden spike of impressions and clicks in Search Console for queries unrelated to your business, followed by a collapse when Google catches on.

The pharmaceutical pattern injects links to pills and drugs into pages. The Japanese keyword pattern creates pages full of Japanese text selling counterfeit goods. The redirect pattern sends visitors from search to scam sites. The cloaking pattern shows different content to Google than to humans. The malware pattern attempts to infect visitors' devices.

Whichever type you have, the cleaning principles are the same: find everything, remove it, fix the entry point, tell Google and monitor.

Prevention is cheaper than cure. The following habits stop most attacks.

Keep everything updated. The platform, the theme, all plugins and the server software should be updated promptly. Most successful attacks use known vulnerabilities that have been fixed in newer versions. Turn on automatic updates for minor security releases where it is safe to do so.

Remove what you do not use. Every plugin, theme and old test installation is a potential door. Delete unused ones entirely, not just deactivate them. Remove old development folders and forgotten staging copies from the server.

Use strong, unique passwords and a password manager. Enable two-factor authentication on the hosting account, the domain registrar, the CMS and your email. Limit administrator accounts to the people who truly need them.

Protect the login. Limit login attempts, hide or protect the admin address where appropriate and use a web application firewall, which filters malicious traffic before it reaches your site.

Set safe file permissions and disable file editing. On most platforms you can turn off the built-in code editor in the admin area, so an attacker who gets in cannot edit files directly. Make sure the uploads folder cannot run scripts.

Keep off-site backups and test them. Store daily or weekly backups away from the server, keep several generations and periodically restore one to a test location to prove it works. Keep at least one older backup in case an infection went unnoticed for a while.

Monitor. Use a tool that alerts you to file changes, malware and downtime. Check Search Console weekly for security issues and strange queries. Set a calendar reminder to review users, plugins and backups every month.

Use trusted sources. Download plugins and themes only from official or reputable vendors. Never install cracked or nulled software, however tempting the saving.

Secure your devices and email. Many hacks begin with a stolen password from an infected laptop or a phishing email. Keep your own devices updated and be careful with unexpected messages that ask you to log in.

Use a modern architecture where it fits. A static website, which serves pre-built pages and has no admin login or database on the public server, has a far smaller attack surface than a traditional dynamic site. For brochure sites that rarely change, it can be an excellent choice. Our website development services team can advise on whether this suits your business.

Many small businesses and agencies keep several sites on one hosting account. This is convenient but risky: an infection on one site can spread to the others, because they often share file access. If one site is hacked, treat all sites on the account as suspect. Scan each of them, change credentials for the whole account and consider separating important sites into their own accounts. Clean up forgotten sites that are no longer used, since neglected installations are a favourite entry point.

Owners sometimes decide to leave a hack alone because the site still seems to work. This is rarely wise. Hidden spam can harm rankings, put visitors at risk, lead to account suspension and, in some cases, damage your reputation and legal standing if customer data is exposed. The cost of cleaning up grows with time, because more spam pages accumulate and the infection spreads. A prompt, thorough clean-up is far cheaper than months of lost visibility.

You can handle a simple infection yourself if you are comfortable with files and databases and the site is small. Bring in help when the site is business-critical, when you cannot find the entry point, when the infection keeps coming back, when customer data may have been exposed, or when you are flagged by Google and need a clean review request. A professional also brings tools and experience that save time.

Crystal Design handles website security, clean-up and maintenance for businesses across Navi Mumbai, from Kopar Khairane to Panvel. We can audit your site, clean it, harden it and set up monitoring and backups. You can also read how we approach WordPress website development with security built in. To discuss a problem, call +91 9136024670, message us on WhatsApp or use the contact page.