Strange Japanese pages in Google, visitors redirected to betting sites, or a red "Deceptive site ahead" warning? Here is a calm, step-by-step plan to clean your website and win back Google's trust.
You search for your business on Google and see pages in Japanese, ads for medicines or betting links under your own website name. Or customers call to say your site sends them to a strange page, or Chrome shows a red "Dangerous site" warning. These are signs of a hacked website, and they are far more common than most business owners think – especially on WordPress sites that nobody has updated for a year or two. This guide explains, in plain words, how to confirm the hack, clean it properly, remove Google's warning and make sure it does not come back.
Many hacks are designed to stay hidden from the owner. Hackers often show the spam only to Google or only to visitors arriving from a search, so the site may look normal when you type the address yourself. Watch for these signs:
site:yourdomain.in and look through the results. Pages in Japanese or Chinese, or about medicines, loans, casinos or replicas, mean spam has been added to your site.You can also check your domain on Google's Safe Browsing status page at transparencyreport.google.com/safe-browsing/search. It tells you whether Google currently flags the site.
Do not delete everything in a hurry. Deleting files without a plan can destroy the evidence you need to find how the attackers got in, and it can break the site further.
Instead:
Attackers often keep stolen passwords and come back after you clean up. Change all of these, from a computer you trust:
wp-config.php)Turn on two-factor authentication wherever it is offered. For WordPress, also replace the security keys ("salts") in wp-config.php – this logs out everyone, including any attacker who is still signed in. WordPress provides fresh keys at api.wordpress.org/secret-key/1.1/salt/.
While you are in the admin area, delete any user accounts you do not recognise.
It sounds strange, but take a full backup (files and database) of the infected site before you change anything else. Keep it separate and do not restore it. It is your safety net if the cleanup goes wrong, and your evidence if you need to work out what happened.
Then check whether your hosting provider has an older, clean backup from before the hack started. Restoring a clean backup is often the fastest fix – but only if you also close the hole that let the attacker in (Step 5). Otherwise the site will simply be hacked again within days.
If there is no clean backup, or you would lose too much recent content, clean the site in place. For a WordPress website:
wp-admin and wp-includes folders. Never copy these from your hacked site.wp-config.php, .htaccess, index.php in the main folder, and the wp-content/uploads folder. Look for long unreadable code, or functions like eval, base64_decode or gzinflate that do not belong there. PHP files inside uploads are almost always malicious.<script> tags that you never added.| Where hackers hide things | What to look for |
|---|---|
.htaccess | Redirect rules pointing to unknown websites, often only for mobile or search visitors |
wp-config.php and index.php | Extra lines of unreadable or encoded code at the top or bottom |
wp-content/uploads | PHP files – images and documents should never be PHP |
| Database (posts, options) | Spam pages, hidden links, injected JavaScript |
| Admin users | Accounts you did not create, especially administrators |
| Scheduled tasks (cron) | Jobs that re-create the malware after you delete it |
If your website is custom-built rather than WordPress, ask the developer to compare the live files with the original source code (for example, the Git repository) and redeploy a clean copy.
Be honest about your limits. If the hack keeps coming back or you are not comfortable editing files, get professional help. A half-cleaned hacked website is worse than one that is fully offline, because Google keeps seeing spam and your visitors keep getting hurt.
Cleaning removes the damage; closing the hole stops a repeat. The most common entry points are:
Update everything, delete what you do not use, and make sure each person has their own login with only the access they need.
Once the site is clean, the spam pages should return a "404 Not Found" or "410 Gone" response. Do not redirect them to your home page – Google may treat that as a soft error and keep them longer.
In Google Search Console:
If you have never set up Search Console, verify your domain now. It is free, and it is the only place Google tells you directly about hacks on your site.
If Google shows a security warning, it will not disappear on its own the moment you clean the site. In Search Console, open Security issues, tick that you have fixed the problems and click Request review. Explain briefly what you found and what you did – for example, "Removed injected spam pages and a malicious redirect in .htaccess, replaced all core files and plugins, changed all passwords and removed an unknown admin user."
Reviews for malware and hacked content are usually processed within a few days. If the review is rejected, Google normally gives example URLs that are still infected – clean those and request again.
A hacked website often means hacked email, or a domain that was used to send spam. Check that your SPF, DKIM and DMARC records are set up correctly so others cannot easily fake your domain – our business email guide explains these records simply.
If customer data such as names, phone numbers, passwords or payment details may have been exposed, take it seriously: inform affected customers, ask them to change passwords, and take advice on your legal duties. In India, cyber security incidents can be reported to CERT-In, the national response team, through its website cert-in.org.in.
Most hacks on small business websites are not targeted attacks – they are automated bots scanning millions of sites for old software. Good, boring habits stop most of them:
Search Google for site:yourdomain.in and look for pages you did not create, check Google Search Console for security messages, test your site on Google's Safe Browsing status page, and look for unknown admin users or redirects – especially on mobile.
Yes, if it is not fixed quickly. Google may show a warning, drop spam-filled pages or lower trust in the whole site. Once the site is clean and Google has reviewed it, rankings usually recover over the following weeks.
After you clean the site and request a review in Search Console, Google usually processes it within a few days. Spam pages can take a few weeks to disappear from results completely, faster if you use the Removals tool.
Only if the backup is from before the hack and you also fix the cause – update software, remove the vulnerable plugin and change all passwords. Otherwise the attacker can get in again the same way.
Usually yes. Your posts, pages and images live in the database and uploads folder, which can be cleaned and kept, while the core files, plugins and themes are replaced with fresh copies.
A hacked website is stressful, but it is fixable. Protect visitors first, change every password, back up the infected site, clean it or restore a clean backup, close the hole that let the attacker in, then tell Google through Search Console and request a review. After that, regular updates, real (not nulled) plugins, strong passwords and good hosting keep it from happening again.
Need help? Our web hosting includes free SSL and backups, and our team can clean and secure your site through our website design and maintenance services. If your site is showing a warning right now, contact us and we will help you get it back to normal.
"This site can't be reached", a 500 error, a red privacy warning or a blank white page? Each message points to a different cause. Here is how to read it and get your website back online.
Read article: Website Not Opening? What Each Error Means and How to Fix It FastYour quotes, invoices and replies land in the customer's spam folder – or never arrive at all. Here is how to find the exact reason in 10 minutes and fix it for good.
Read article: Why Your Business Emails Are Going to Spam (and How to Fix It)Your developer registered the domain, kept the logins and now won't reply – or wants money to hand it over. Here is a calm, step-by-step way to recover your domain, website and email.
Read article: How to Recover Your Domain and Website From a Developer Who Won't Give Access
