Google shows my site as hacked in their search results

Question

Google shows a "This site may be hacked" warning underneath my domain in search results. No further warning are shows when visiting the page.

I have tried to make sure my site is safe. I've looked over the code myself without finding anything suspicious. Googles Transparency report shows no issues, and neither does Quttera, IsItHacked.com or VirusTotal. I'm running the latest version of Magento (2.2.3) and Magereport reports the site as clean.

I've been trying to find an explanation in Google webmasters search console, but without any luck. Is there any other way to check why Google has flagged my site and what they have detected? Or how can I contact Google for an explanation of this?

Answer 1

According to Google, in the Google Search Console you should be able to find suspicious URLs on your site, that originated the message. If no URLs appear, your only recourse is contacting Google for an explanation.

After solving the error (or vulnerability: for example if you have a Magento Community Edition software v. 2.1.6 or below, you should upgrade), you need to request a new check from the Security Problem section of the Console.

The notice might appear even if everything is fine, if some components of your web site are obsolete AND they are vulnerable AND an update exists AND you did not install that update.

The most straightforward way to contact Google is not straightforward at all - not to my metric for straightness at least. You run the search, get your site with the problem, go to the end of the page and click "SEND FEEDBACK". Choose 'Send Screenshot' and activate the selector tool, border your result in yellow, and explain what happened. Include your email, specify that Google Admin Console is not working, and hopefully you'll be contacted (or maybe they'll silently fix the problem).

Answer 2

Yours’ seem like a rare case. Like you said no malware was found on the website and other search engines are also not flagging the website. Here’s what you can do:

1. Submit a re-request on the google search console detailing everything
2. Submit an incorrect phishing request here - https://safebrowsing.google.com/safebrowsing/report_error/?hl=en

There’s not much you can do after this. You would need to wait for Google to review the

Warning: It may take a day or two for google to review it but the warning will go away.

Answer 3

Malware could be injected into your website or database in more ways than one, for example through a vulnerability in another website located on the same server as yours which resulted in an information leakage, privilege escalation or file uploading. This happened often at the hosting company I worked at - a single insecure website could lead to the infection of all websites on the host.

Even if the website is on a dedicated server with no other domains hosted on the same machine, it is possible that someone got access to the server (although it's unlikely that they would only go after your website in this case) or that the attacked used a zero-day vulnerability.

What I would recommend you to do first is to navigate through your website and try to determine whether there is anything abnormal - injected page content, pop-ups being opened out of the blue or any similar unwanted events. If nothing is found, scan your website manually and automatically - if you do not have access to tools for the latter, you may ask your web hosting provider to assist you or, if your server managed by yourself, use a tool such as ClamAV, rkHunter or alternatives depending on your environment.

Answer 4

It is rather strange that you go somewhere else to look for security info. The flag is coming from Google safe browsing(gsb), the first place you should check is Virustotal.

When you see many well known vendor and GSB give a red marker, check your magento folder for injected code(anything that are not suppose be there), monero miner. Most prominent AV might give your the immediate answer should your site contains any funny script. Then go to those popular AV vendor that red-marker website and ask them to lift the status.

(update) : There is a way to learn whether your website is infected by injected script using virustotal. First, select your magento landing page and checkout page. Then upload the file to virustotal and wait for the results. Since such scan is resource intensive, it might take quite some time.