My site shows the "This site may be hacked flag" underneath my domain in search results. This only shows on homepage and no further warning shows when visiting the page.

I have checked within my Google webmasters search console for a bit more information on this and run various malware scans as well as looking over the code myself without finding anything suspicious. Transparency report shows similarly no issues. https://transparencyreport.google.com/safe-browsing/search. I have also checked with sites like Quttera and IsTtHacked.com and that has flagged nothing either. Magereport shows no issues also and am running the latest version of Magento (2.2.3). https://www.virustotal.com also shows the site to be clean.

I want to know if there is any other way to check why google has flagged this and what they have detected (or if anyone can see anything suspicious as i cannot) or how i can contact google for an explanation of this?

Issue

  • If everything seems Ok and as suggested by google : "Request a review in the Security Issues section in Search Console when your entire website is clean and secure. After we check that your site is fixed, we'll remove the "This site may be hacked" message." – Soufiane Tahiri Mar 29 at 14:32
  • @SoufianeTahiri Thanks for geting back to me. It's just that i cannot request a review of something that does not show up in my search console. – harri Mar 29 at 14:33

According to Google, in the Google Search Console you should be able to find suspicious URLs on your site, that originated the message. If no URLs appear, your only recourse is contacting Google for an explanation.

After solving the error (or vulnerability: for example if you have a Magento Community Edition software v. 2.1.6 or below, you should upgrade), you need to request a new check from the Security Problem section of the Console.

The notice might appear even if everything is fine, if some components of your web site are obsolete AND they are vulnerable AND an update exists AND you did not install that update.

The most straightforward way to contact Google is not straightforward at all - not to my metric for straightness at least. You run the search, get your site with the problem, go to the end of the page and click "SEND FEEDBACK". Choose 'Send Screenshot' and activate the selector tool, border your result in yellow, and explain what happened. Include your email, specify that Google Admin Console is not working, and hopefully you'll be contacted (or maybe they'll silently fix the problem).

  • Yeah i read that. My site is running that latest version with no vulnerabilities i am aware of this can be checked on magereport.com. Permissions and all security precautions have been taken including moving any admin url and locking them down to a single ip. I cannot review within search console as this does not show in my search console however. I am using version Magento 2.2.3 – harri Mar 29 at 14:36
  • Thanks for getting back to me tho. Do you know where would i contact google? I cant find any numbers or emails for this kind of problem. – harri Mar 29 at 15:04
  • Amending answer – LSerni Mar 29 at 21:56
  • Yeah i was wondering if my site may link to something hacked as that seems to be another reason these issues do not show in your own search console – harri Mar 30 at 2:52

Malware could be injected into your website or database in more ways than one, for example through a vulnerability in another website located on the same server as yours which resulted in an information leakage, privilege escalation or file uploading. This happened often at the hosting company I worked at - a single insecure website could lead to the infection of all websites on the host.

Even if the website is on a dedicated server with no other domains hosted on the same machine, it is possible that someone got access to the server (although it's unlikely that they would only go after your website in this case) or that the attacked used a zero-day vulnerability.

What I would recommend you to do first is to navigate through your website and try to determine whether there is anything abnormal - injected page content, pop-ups being opened out of the blue or any similar unwanted events. If nothing is found, scan your website manually and automatically - if you do not have access to tools for the latter, you may ask your web hosting provider to assist you or, if your server managed by yourself, use a tool such as ClamAV, rkHunter or alternatives depending on your environment.

  • Thanks yeah have done all of the above. Site is on its own on a dedi just waiting on scan results but cannot see anything when looking over manually. Feel like google should tell me somewhere or i should be able to contact them somehow however. – harri Mar 29 at 15:19
  • I see - in case everything comes up clean, you should check out this link: developers.google.com/web/fundamentals/security/hacked/… Best of luck! – Elhitch Mar 29 at 19:18

It is rather strange that you go somewhere else to look for security info. The flag is coming from Google safe browsing(gsb), the first place you should check is Virustotal.

When you see many well known vendor and GSB give a red marker, check your magento folder for injected code(anything that are not suppose be there), monero miner. Most prominent AV might give your the immediate answer should your site contains any funny script. Then go to those popular AV vendor that red-marker website and ask them to lift the status.

(update) : There is a way to learn whether your website is infected by injected script using virustotal. First, select your magento landing page and checkout page. Then upload the file to virustotal and wait for the results. Since such scan is resource intensive, it might take quite some time.

  • Thanks for the reply that is not showing anything either however. I am running a malware scan on the folder now however will take a bit to complete. – harri Mar 29 at 15:17
  • Shouldnt GSB show issues in my search console tho really? – harri Mar 29 at 15:21
  • @harri : AFAIK, website content detection is something expensive, only a direct file scan will give you the actual detection results. – mootmoot Mar 29 at 16:05

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.