Google Says “This Site May Be Hacked”: What to Do First
The warning appears in the results and costs clicks immediately. Removing it needs a genuine cleanup, not just a reconsideration request. Here is the order.
WORDPRESS RESCUE JOURNAL
Specialist-reviewed guides for broken, compromised or blocked websites. Diagnosis, security and practical decisions without blind recipes.
START WITH THE VISIBLE SYMPTOM
These guides help you preserve evidence, avoid risky shortcuts and decide when the problem needs a controlled technical intervention.
Understand the fatal error behind the generic message and the evidence worth preserving before changing plugins or themes.
Open the guide 02Learn why a blank page should be diagnosed through protected logs instead of exposing debug information publicly.
Open the guide 03See where conditional redirects hide and why clearing one server rule may not remove the infection.
Open the guide 04Separate a legitimate access problem from signs of compromise and recover control without leaving a bypass.
Open the guide 05Compare rollback, compatibility repair and safe update routes when production fails after a release.
Open the guide 06Trace the sales journey from browser and session through payment callback, order creation and stock.
Open the guideThe warning appears in the results and costs clicks immediately. Removing it needs a genuine cleanup, not just a reconsideration request. Here is the order.
Reinfection means the effect was removed but the persistence or entry point was not. Here are the five places it survives and how to check each.
An admin you did not create is not a glitch. Treat it as evidence of compromise and preserve it before deleting. Here is what to capture and check.
A checkout can fail in the browser, session, gateway or at order creation. Here is how to find the failing layer with the tools WooCommerce gives you.
Customers paid but the order never progressed. The gateway callback is usually where it broke. Here is how to find it and reconcile safely.
Resets, order confirmations and form notifications vanish. The cause is almost always how the mail is sent. Here is the durable SMTP fix.
Enquiries stop arriving and nothing looks broken. Separate a form that fails to submit from one that submits but never delivers — here is how.
An update is a strong lead, not a verdict. Work this order to restore service without destroying the evidence you need.
A 403 means the server understood the request and refused it. Permissions, security rules and ownership are the usual reasons. Here is the safe order.
The home page loads but every other URL is a 404. The rewrite rules did not survive the move — and the fix is usually one click plus a check.
The padlock disappears because some resources still load over HTTP. Fix the stored references instead of forcing them with a plugin.
A site that was fast last week and crawls today has a specific cause. Measure where the time goes before installing another optimisation plugin.