“This site may be hacked” is a Google warning. Cleanup first, then recrawl.

What this usually is

Google Safe Browsing and Search Console security issues fire on phishing pages, injected spam, or malware downloads. A host “malware scan” that deleted three files and left the dropper will get you a warning that returns. Submitting a review request while the injector still runs is how people wait six weeks for a “no” from Google.

What you are probably seeing

• Chrome interstitial: “Deceptive site ahead” or “This site may be hacked”
• Search Console → Security & Manual Actions shows hacked content or malware
• Google results show a warning under your title
• The host sent a “malware detected” notice and a one-click tool that did not stick

What not to do

• Do not submit a Safe Browsing review until someone who can read the files says the public HTML is clean.
• Do not treat a host one-click cleanup as the review evidence. Google recrawls what visitors get, not what the host dashboard claims.
• Do not ignore Search Console because “the site looks fine to me.” The warning is about what Googlebot got, not what your logged-in session shows.

What we actually do

Phase A removes what Google is flagging and gives you a written report. Then someone with Search Console access requests a recrawl of the poisoned URLs. Recrawl work is quoted separately. We do not invent a date the interstitial will disappear. We will tell you when it is honest to click the button.

Published rates live on the WordPress incident-response packages page: Phase A from $2,500, Phase B from $2,000, combined from $4,200. Remote nationwide. Onsite in the Tri-Cities and Western North Carolina if you want someone in the room. If the WordPress site is the front door to a larger business compromise, start at emergency incident response instead.