Chrome says "this site may be hacked": cleanup before Search Console review

The warning is not a ranking score and it is not a timer. It means Google (or a similar checker) believes something harmful is still reachable on public URLs. This post explains what owners usually see, what it usually means, what not to do in the first hour (including requesting a review while the site is still dirty), and when it makes sense to stop DIY and book cleanup. It is not a full malware-removal guide. We do not promise how long Safe Browsing or Search Console will take to clear after a clean report.

If you only just noticed the problem, start with our first 24 hours after a WordPress hack guide and the free checklist. The shorter symptom stub Google says this WordPress site may be hacked covers the same panic pattern in fewer words.

What owners usually see

• Chrome interstitial: "this site may be hacked" or "deceptive site ahead"
• Search Console security issues (malware, unwanted software, social engineering)
• Host or CDN banners that the site was flagged
• Logged-in admins still see a normal dashboard or homepage
• Related patterns that often ride alongside a Safe Browsing flag: spam titles in Google, spam links that return after delete, redirects for phones or logged-out visitors

Related live guides if you recognize a sibling pattern:

• Google / malware warning stub
• Casino titles in Google while the site looks fine logged in
• Spam links keep coming back after I delete them
• Spam links on a WordPress site
• Casino or gambling links injected
• Unknown WordPress administrator
• Redirects for mobile or logged-out visitors

What a Safe Browsing or Search Console flag usually means

At a pattern level (not a claim about your specific site), these warnings usually mean something harmful is still reachable without logging in:

• Injected pages, posts, or SEO spam that Googlebot can crawl
• Redirects or scripts that send visitors to phishing, scam, or malware URLs
• Planted files under uploads, themes, or plugins that serve bad content
• Persistence left behind after a partial delete, so the bad content comes back

Deleting one spam post, clearing a cache, or filing a "request review" does not remove those. Review is an owner step after the public site is actually clean. Requesting review while the harmful URLs still respond usually fails, and it can burn time when you need evidence preserved instead.

First-hour don'ts (preserve, do not "fix")

1. Do not request a Safe Browsing or Search Console review yet. Wait until public pages, redirects, and planted files are actually clean. A failed early review does not speed anything up.
2. Do not wipe the host or restore blindly just to make the interstitial go away. Blind restores can hide how the door got in, and a dirty backup can put the same problem back.
3. Do not keep deleting spam in a loop without capturing evidence. If content returns, that is a reinfection clue (see spam keeps coming back).
4. Capture evidence: screenshots of the Chrome warning, Search Console issue text, the flagged URLs, dates, the Users list, and any security plugin reports. Note times.
5. Take an off-server backup of files and the database if you can. Label it "pre-cleanup evidence."
6. Change passwords for WordPress administrators, hosting, SFTP, and the database from a clean device, and do not reuse old ones.
7. Avoid random "cleanup" plugins and forum snippets pasted into functions.php.
8. Work through the calm order of operations in our free WordPress compromise checklist. It helps you decide what is safe to touch. It does not fully clean a compromised site by itself, and it does not clear Google warnings by itself.

When DIY should stop (book)

A public Safe Browsing or Search Console flag is often past the point where DIY deletes are enough. Use WordPress incident response when any of these are true:

• Chrome or Search Console still shows a warning after you deleted the obvious spam
• You cannot tell which administrator accounts are legitimate
• Spam or redirects came back after a delete or restore
• WooCommerce or lead forms need to stay up while cleanup happens carefully
• You need a written report of what was found and changed before you ask Google to review again

Published cleanup packages start around $2,500 (typical ranges and combined cleanup and hardening options are on the IR page). Work is remote nationwide; Tri-Cities and Western NC onsite is by appointment.

What careful cleanup usually means (expectations)

• Preserve evidence first, then find what Google (or visitors) can still reach that looks harmful
• Remove planted content and the persistence behind it, not just the interstitial symptom
• Close the original weak point where it can be identified
• Deliver a written report of what was found and changed
• Search Console or Safe Browsing review is an owner step after the site is actually clean
• We do not promise Google timelines, Safe Browsing clear dates, or ranking recovery dates. Timing is controlled by Google's systems, not by the cleanup itself

After cleanup, hardening and ongoing Care ($149 / $249 / $399) are optional next steps so the same door is less likely to reopen. They do not replace cleanup while a public warning is still justified.