Open the Security Issues report in Search Console, expand each issue and read its sample addresses. Fix every issue on every page, not only the samples, and test the fixes. Then select Request Review once, describing what was wrong, what you did and the result. Google says malware reviews take a few days, spam reviews can take up to several weeks, and warnings are removed within 72 hours of a site being found clean.
What the report shows
The Security Issues report lists Google's findings when a site appears to have been hacked, or behaves in a way that could harm visitors or their devices, such as phishing or installing malware or unwanted software [1]. If the report is empty, Google has not found a problem. If it lists issues, affected pages can show a warning label in search results or a warning page in the browser [1].
Because warnings do not always appear consistently for every visitor, Google treats the report itself as the reliable place to check whether issues exist or have been fixed [1].
The three main issue types
| Type | What it means | Common WordPress example |
|---|---|---|
| Hacked content | Content placed on the site without permission through a security weakness [1]. | Spam pages selling medicines or counterfeit goods, often thousands at once. |
| Malware and unwanted software | Software designed to harm devices or users, installed by a hacker or sometimes by the owner [1]. | Injected scripts that redirect visitors or prompt them to download a fake update. |
| Social engineering | Content that tricks visitors into doing something dangerous, such as revealing private details or downloading software [1]. | A fake login or payment page planted in a subfolder of an otherwise normal site. |
The report breaks each type into more specific issues, such as code injection, content injection, URL injection, harmful downloads or deceptive pages, each with its own help link [1].
Fixing the issues
Google's instructions are straightforward and strict. Expand each issue, follow its "Learn more" link, and check the sample addresses, keeping in mind that the list may be incomplete [1]. Then fix every issue listed. Google states that fixing the issue on just some pages will not earn a partial return to search results [1].
On a WordPress site, that usually means a full cleanup rather than a page-by-page repair:
- remove injected code from theme, plugin and core files, ideally by replacing them with clean copies;
- remove spam posts, pages and users from the database;
- check
.htaccessand other server files for redirect rules; - find and close the way in, or the issue may reappear before the review is complete.
Testing before you ask
Google's guide to requesting a review lists what should be true first: you have verified ownership in Search Console, cleaned the hacker's changes, corrected the weakness that let them in, and brought the clean site back online [2]. It suggests checking key pages with tools such as Wget or cURL, and warns that requesting a review too early prolongs the time a site stays flagged [2].
Some infections only show themselves to search engines or to visitors from a search result. Fetching pages with tools like these, rather than only viewing them in your own logged-in browser, is the practical way to catch that.
Requesting the review
When every listed issue is fixed on every page, select Request Review in the report [1]. In the request, describe the exact problem, the steps taken and the results [1]. A short, specific note works better than a long one. For example: what kind of infection it was, which files and database entries were cleaned, how the entry point was closed, and what monitoring is now in place.
Google says not to resubmit while a review is pending, and that requesting a review before the issue is fixed can lengthen review times or mark the site as a repeat offender [1].
How long reviews take
Google's figures, in its own words:
- reviews for sites infected with malware require a few days to process [2];
- reviews for sites hacked with spam can require up to several weeks to process [2];
- more broadly, most reconsideration reviews can take several days or weeks [1].
If Google finds the site clean, warnings from browsers and search results are removed within 72 hours [2]. If the request is declined, the response normally indicates what remains, and the cycle starts again for that part.
An example review request
A review request does not need to be long. Something like this covers what Google asks for, which is the problem, the steps and the result [1]:
The site was injected with spam pages through an outdated form plugin. We removed all injected pages and posts from the database, replaced WordPress core, theme and plugin files with clean copies, removed an unauthorised administrator account, updated the form plugin and every other component, reset all passwords and security keys, and switched on file change monitoring. We tested the listed sample addresses and the rest of the site with cURL and a browser and found no remaining hacked content.
Adjust it to what actually happened. Do not claim steps you did not take, because a declined request costs more time than an accurate one.
If Search Console was never set up
You can verify a site after it has been flagged. Google offers several verification methods, such as adding a DNS record at your domain registrar or uploading a small file to the site. Once verified, the Security Issues report shows the current findings straight away, so set it up as soon as you suspect a problem.
Keeping a record of the review
Review requests are easier to manage, and easier to repeat if needed, when you keep a short record of each one. This is especially useful if the first request is declined and you need to work out what was missed.
For each request, note:
- the date you submitted it and the exact issue types listed in the report at the time;
- the sample URLs Google showed, and what you found and fixed on each of them;
- the text of your request, copied into your notes before you press submit;
- the outcome and the date you received it.
If a request is declined, compare the new report with your notes. A different sample URL often points to a part of the site that was not checked, such as an old landing page, a subfolder with a separate install, or a page only search engines were being shown. Fix that, check the rest of the site for the same pattern, and only then submit again.
Keep the record after the warning is removed too. If a similar issue appears months later, knowing what was found last time can save hours. It may also show that the cause was never fully dealt with, such as an old administrator account or a plugin that was left installed after the cleanup.
After the warning is removed
Check that the site works normally, that pages load and links work [2], and keep an eye on the report for the following weeks. In our view, a repeat infection soon after a review is a strong hint that the entry point was not closed or a backdoor was missed. Monitoring that watches file changes and Search Console messages, such as our monitoring service, catches that early.
If you would rather not run this process yourself, our warning removal service handles it from cleanup to review.
Questions people ask
I fixed the hack but the warning is still there. Why?
Google only re-checks after a review request, and only removes the warning once it finds the whole site clean. If you have not requested a review, or the request is pending, the warning stays. If the request was declined, something listed in the report is still present.
Can I request a review without Search Console?
Not for warnings shown in Google Search and Chrome. You need to verify ownership of the site in Search Console first. Google's guide lists verified ownership as the first thing to have in place.
Will my rankings return when the warning is removed?
Removing the warning lets visitors through again, and pages that were hidden or labelled can return to normal results. How rankings behave after that depends on many factors, including how long the spam was live and what it did to the site's links. No one can promise a specific outcome.
Is it worth submitting a review early just to get in the queue?
No. Google warns that requesting a review before the site is fixed prolongs the time it stays flagged, and resubmitting while a request is pending can lengthen review times.
Sources
Labels show each source's type.
- Security issues report Primary source Search Console Help
- Request a review Primary source web.dev (Google)