Technical SEO
Hacked Site SEO Recovery (Including Japanese Keyword Hacks and WordPress)
A hack can put warnings on your results and fill Google with spam pages. Recovery means fixing all of it, then asking for review.
Search Console’s Security issues report shows when Google finds that a site was hacked or could harm visitors. Affected pages can show a warning in search results, or browsers can show a warning page before visitors reach the site.
Common forms include injected spam content (such as pages full of Japanese text or pharmaceutical keywords), injected code and injected URLs.
Short answer: To recover from a hack: check Search Console’s Security issues report; take the site offline or into maintenance if needed; identify and remove all injected content, code, users and files; close the vulnerability (update WordPress, themes and plugins, change all passwords, remove unknown admin users); remove spam URLs so they return 404 or 410; then request review in the Security issues report, explaining the issue, the fix and the outcome.
Key Takeaways
- The Security issues report is the source of truth.
- Fix every page; partial fixes don’t earn a partial return, Google says.
- Close the vulnerability or it will happen again.
- Spam URLs should return 404 or 410.
- Don’t request review until everything is fixed.
Recovery steps
- Open the Security issues report and note every issue and sample URL.
- Back up the site for investigation, then clean from a known-good state where possible.
- Remove injected pages, scripts, redirects and unknown users.
- Update the CMS, themes and plugins; remove unused ones; change all passwords and keys.
- Make spam URLs return 404 or 410; check for injected sitemaps.
- Check Search Console users and verification methods for anything you didn’t add.
- Request review from the Security issues report.
Japanese keyword and spam page hacks
- Search site:yourdomain.com and look for pages you didn’t create, often in Japanese or with spammy keywords.
- Check the Page indexing and Performance reports for unfamiliar URLs and queries.
- Look for cloaking: spam shown only to Googlebot, so inspect URLs with URL Inspection rather than your browser.
- After cleaning, remove leftover spam URLs quickly with the Removals tool (how to remove URLs).
WordPress specifics
- Check for unknown admin users and recently changed files.
- Review active and inactive plugins; remove anything abandoned or unrecognized.
- Reinstall core files from a clean source.
- Check .htaccess and wp-config.php for injected redirects or code.
Requesting review
Google says a good request explains the issue, describes the fix and documents the outcome, and that reviews usually take several days or weeks. Don’t resubmit while a request is pending. The approach is the same as for reconsideration requests.
Frequently asked questions
Why can’t I see the hack when I visit my site?
Some hacks show spam only to search engines or certain visitors. Use URL Inspection and the Security issues report.
How long until warnings are removed?
Google says most reviews take several days or weeks.
Will rankings come back after a hack?
Usually, once the site is clean and reviewed, though spam URLs can take time to drop out.
Want a second pair of eyes on your technical SEO?
We review crawling, indexing, rendering and speed issues by hand and give you a prioritized list of fixes, starting with a free manual audit.
Sources
- Search Console Help: Security issues report
- Google Search Central: Spam policies for Google web search
- Google Search Central: Remove a page hosted on your site from Google
Last reviewed October 14, 2026.
Table of Contents
Need Technical SEO Help?
We find what stops Google from crawling and indexing your important pages, and fix the cause.
Related Guides
Free SEO Audit
A manual on-page and technical SEO review of your website, with prioritized fixes.