My Website Was Hacked and Google Blacklisted It

The first hour: contain, do not delete

Change your hosting, domain and admin passwords from a clean device. Take the site into maintenance mode if the host allows it. Do not mass-delete suspicious files yet: they tell us how the attacker got in, and clumsy deletion can break the evidence and the site simultaneously. Check Google Search Console’s Security Issues tab; it names what Google actually found, which shapes the fastest path to delisting.

Why the warning keeps coming back

Scanners remove what they recognise. Attackers plant what scanners do not recognise: an extra admin user with an innocent name, a modified core file, a cron job that re-downloads the payload nightly, database-stored redirects that activate only for Google’s crawler. That last trick is why “the site looks fine to me” and “Google says it is hacked” are both true at once. Cleanup that misses one persistence mechanism buys you a quiet week, then the flag returns.

The rebuild route

Our hacked site recovery abandons the infected installation entirely: content is rescued from rendered pages and verified sources, the site is rebuilt on a fresh stack with new credentials, hardened configuration and security headers (check any site’s with our headers checker), and then we file the Google security review. Because the malicious code is genuinely gone rather than patched over, reviews pass and the warning does not return.