Google shows a "This site may be hacked" warning underneath my domain in search results. No further warning are shows when visiting the page.

I have tried to make sure my site is safe. I've looked over the code myself without finding anything suspicious. Googles Transparency report shows no issues, and neither does Quttera, IsItHacked.com or VirusTotal. I'm running the latest version of Magento (2.2.3) and Magereport reports the site as clean.

I've been trying to find an explanation in Google webmasters search console, but without any luck. Is there any other way to check why Google has flagged my site and what they have detected? Or how can I contact Google for an explanation of this?

  • If everything seems Ok and as suggested by google : "Request a review in the Security Issues section in Search Console when your entire website is clean and secure. After we check that your site is fixed, we'll remove the "This site may be hacked" message." Commented Mar 29, 2018 at 14:32
  • @SoufianeTahiri Thanks for geting back to me. It's just that i cannot request a review of something that does not show up in my search console.
    – harri
    Commented Mar 29, 2018 at 14:33

4 Answers 4


According to Google, in the Google Search Console you should be able to find suspicious URLs on your site, that originated the message. If no URLs appear, your only recourse is contacting Google for an explanation.

After solving the error (or vulnerability: for example if you have a Magento Community Edition software v. 2.1.6 or below, you should upgrade), you need to request a new check from the Security Problem section of the Console.

The notice might appear even if everything is fine, if some components of your web site are obsolete AND they are vulnerable AND an update exists AND you did not install that update.

The most straightforward way to contact Google is not straightforward at all - not to my metric for straightness at least. You run the search, get your site with the problem, go to the end of the page and click "SEND FEEDBACK". Choose 'Send Screenshot' and activate the selector tool, border your result in yellow, and explain what happened. Include your email, specify that Google Admin Console is not working, and hopefully you'll be contacted (or maybe they'll silently fix the problem).

  • Yeah i read that. My site is running that latest version with no vulnerabilities i am aware of this can be checked on magereport.com. Permissions and all security precautions have been taken including moving any admin url and locking them down to a single ip. I cannot review within search console as this does not show in my search console however. I am using version Magento 2.2.3
    – harri
    Commented Mar 29, 2018 at 14:36
  • Thanks for getting back to me tho. Do you know where would i contact google? I cant find any numbers or emails for this kind of problem.
    – harri
    Commented Mar 29, 2018 at 15:04
  • Amending answer
    – LSerni
    Commented Mar 29, 2018 at 21:56
  • Yeah i was wondering if my site may link to something hacked as that seems to be another reason these issues do not show in your own search console
    – harri
    Commented Mar 30, 2018 at 2:52

Yours’ seem like a rare case. Like you said no malware was found on the website and other search engines are also not flagging the website. Here’s what you can do:

  1. Submit a re-request on the google search console detailing everything
  2. Submit an incorrect phishing request here - https://safebrowsing.google.com/safebrowsing/report_error/?hl=en

There’s not much you can do after this. You would need to wait for Google to review the

Warning: It may take a day or two for google to review it but the warning will go away.


Malware could be injected into your website or database in more ways than one, for example through a vulnerability in another website located on the same server as yours which resulted in an information leakage, privilege escalation or file uploading. This happened often at the hosting company I worked at - a single insecure website could lead to the infection of all websites on the host.

Even if the website is on a dedicated server with no other domains hosted on the same machine, it is possible that someone got access to the server (although it's unlikely that they would only go after your website in this case) or that the attacked used a zero-day vulnerability.

What I would recommend you to do first is to navigate through your website and try to determine whether there is anything abnormal - injected page content, pop-ups being opened out of the blue or any similar unwanted events. If nothing is found, scan your website manually and automatically - if you do not have access to tools for the latter, you may ask your web hosting provider to assist you or, if your server managed by yourself, use a tool such as ClamAV, rkHunter or alternatives depending on your environment.

  • Thanks yeah have done all of the above. Site is on its own on a dedi just waiting on scan results but cannot see anything when looking over manually. Feel like google should tell me somewhere or i should be able to contact them somehow however.
    – harri
    Commented Mar 29, 2018 at 15:19
  • I see - in case everything comes up clean, you should check out this link: developers.google.com/web/fundamentals/security/hacked/… Best of luck!
    – Elhitch
    Commented Mar 29, 2018 at 19:18

It is rather strange that you go somewhere else to look for security info. The flag is coming from Google safe browsing(gsb), the first place you should check is Virustotal.

When you see many well known vendor and GSB give a red marker, check your magento folder for injected code(anything that are not suppose be there), monero miner. Most prominent AV might give your the immediate answer should your site contains any funny script. Then go to those popular AV vendor that red-marker website and ask them to lift the status.

(update) : There is a way to learn whether your website is infected by injected script using virustotal. First, select your magento landing page and checkout page. Then upload the file to virustotal and wait for the results. Since such scan is resource intensive, it might take quite some time.

  • Thanks for the reply that is not showing anything either however. I am running a malware scan on the folder now however will take a bit to complete.
    – harri
    Commented Mar 29, 2018 at 15:17
  • Shouldnt GSB show issues in my search console tho really?
    – harri
    Commented Mar 29, 2018 at 15:21
  • @harri : AFAIK, website content detection is something expensive, only a direct file scan will give you the actual detection results.
    – mootmoot
    Commented Mar 29, 2018 at 16:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .