If your website gets hacked, secure it first, then worry about rankings. Take the site offline if it is serving malware, call your host or developer, change every password, clean the infection, restore a safe backup and request a review in Google Search Console. A hack can absolutely hurt SEO if Google finds spam, redirects or malicious code.
Website hacked SEO damage: what actually happens
A hacked site can damage SEO in several ways, and none of them are theoretical. Google may show a warning in search results, browsers may block visitors, your pages may be removed from results temporarily or hacked spam pages may start appearing under your domain.
The most common SEO problems are hidden links, injected pages, strange redirects, cloaked content and malware warnings. You might see your site ranking for nonsense like casino terms, fake pharmacy products or random Japanese text. That is not Google being weird. That is usually a sign someone has planted rubbish on your site.
Google is clear in its hacked sites guidance that compromised websites can be flagged to protect users. Fair enough, really. If your site is pushing malware, Google is not going to send people there just because you used to rank well.
The good news is that a hack is not always a death sentence for rankings. If you fix it properly, prove the site is safe and clean up the SEO mess, recovery is usually possible. If you bodge it, ignore warnings or let the infection keep coming back, you can turn a nasty problem into a proper disaster.
What to do in the first hour
Your first job is containment. Not rankings. Not blog posts. Not fiddling with title tags. Stop the damage spreading and stop customers landing on a dodgy site.
Do these things first:
- Contact your web host and tell them the site may be compromised.
- Put the site into maintenance mode if it is actively serving malware or redirecting users.
- Take a full backup of the current hacked site before cleaning, so the developer can inspect what happened.
- Change passwords for hosting, CMS admin, FTP, database, email, Google accounts and any connected tools.
- Remove unknown admin users from WordPress, Shopify, Magento or whatever CMS you use.
- Check Google Search Console for security issues, manual actions and strange indexed pages.
- Tell your developer or security specialist what changed recently, including plugins, themes, hosting moves or new user accounts.
If the site has personal data, payments, customer accounts or booking information, you may also need legal or data protection advice. In the UK, the ICO breach reporting guidance explains when organisations must report a personal data breach. Do not guess with that bit.
Check whether Google has already spotted it
Google does not always spot a hack instantly. Sometimes you catch it first. Sometimes Google catches it before you do, which is a fun little way to ruin a Tuesday morning.
Start with Google Search Console. Look at the Security Issues report, Manual Actions report, Pages report and Sitemaps section. Use URL Inspection on important pages, especially your homepage, service pages and high-value landing pages. If Google has detected malware, hacked content or harmful downloads, it should tell you there.
Then do a few manual checks. Search Google for your domain plus obvious spam words you would never use. Try searches like site:yourdomain.co.uk casino, site:yourdomain.co.uk viagra or site:yourdomain.co.uk Japanese. You are looking for indexed pages that should not exist.
Check analytics too. Sudden traffic from odd countries, strange landing pages or weird referral sources can all point towards a compromise. Rankings may also wobble because Google is testing whether your pages are still safe and useful. Do not confuse a normal ranking bounce with a hack, but if the traffic drop lines up with security warnings, you have your answer.
Clean the hack properly, not just the obvious mess
Deleting one dodgy file is not a cleanup. It is a guess. Hackers usually leave more than one backdoor, because they are annoying but not stupid. If you remove the visible spam and leave the door open, they come straight back in.
A proper cleanup usually means checking server files, CMS core files, themes, plugins, database tables, cron jobs, redirects, .htaccess rules, user accounts and file permissions. On WordPress, that often means replacing core files with clean versions, removing abandoned plugins and checking for malicious code hidden inside theme files.
Do not restore an old backup unless you know it was clean and you know how the hack happened. Restoring last month’s backup while keeping the same vulnerable plugin is like changing the carpet after a flood but leaving the pipe burst.
This is also where SEO and development overlap. Once the infection is removed, the site needs crawling properly for broken pages, bad redirects, noindex tags, canonical mistakes and missing content. If you need that cleaned up properly, technical SEO support should be part of the recovery, not an afterthought.
Do not make the SEO damage worse while fixing it
Plenty of hacked websites lose more traffic during the fix than during the hack. That sounds ridiculous, but it happens. Someone panics, deletes half the site, blocks Google in robots.txt or redirects every hacked URL to the homepage. Congratulations, the burglar left and you knocked your own wall down.
Use temporary measures carefully. If your site is down for a short cleanup, a 503 server response is usually better than serving broken pages or 404s everywhere. A 503 tells search engines the problem is temporary. Blocking the entire site from crawling can slow down recovery because Google cannot see the cleaned pages when you are ready.
Here is the sort of mess to avoid:
| Bad fix | Why it hurts SEO | Better option |
|---|---|---|
| Deleting important pages without checking traffic | You lose URLs that ranked and brought leads | Restore clean versions of valuable pages |
| Blocking all search engines in robots.txt | Google cannot confirm the site is clean | Use short maintenance mode and remove blocks after cleanup |
| Redirecting every hacked URL to the homepage | It creates irrelevant redirects and confusion | Let genuine spam URLs return 404 or 410 |
| Restoring a backup without patching the cause | The hack comes back | Fix the vulnerability before restoring |
| Ignoring Search Console warnings | Google may keep warning users | Request a review once the site is clean |
How to recover your rankings after the site is clean
Once the website is genuinely clean, you need to help Google trust it again. Start by confirming the security issue in Google Search Console, then request a review if Google has flagged the site. Be specific. Explain what was hacked, what you removed, what you updated and what you changed to stop it happening again.
Next, resubmit your XML sitemap and use URL Inspection to request indexing for your most important pages. Do not hammer every URL like a lunatic. Start with the homepage, main service pages, location pages and pages that previously drove leads.
Then check the basics. Are your key pages still indexable? Are title tags and meta descriptions intact? Are canonical tags pointing to the right URLs? Are internal links still working? Have spam pages been removed from the sitemap? Are hacked URLs returning sensible status codes?
You may also need to rebuild confidence signals. If customers saw browser warnings, mention on your site that the issue has been resolved only if that is appropriate. Keep your site stable, fast and crawlable. Rankings usually recover through a clean site, clear signals and patience, not by stuffing more keywords into a wounded homepage.
Local businesses have an extra problem: trust drops fast
If you are a local business, a hacked website can hurt more than rankings. It can damage trust. Someone searching for a plumber, solicitor, dentist, roofer or accountant is not going to push through a browser warning and hope for the best. They will go to the next result and you will never know they existed.
Your Google Business Profile matters here too. If your website link sends people to warnings, spam or redirects, that can affect enquiries even if your map visibility holds steady. Customers do not separate your website, reviews and Google profile in their heads. To them, it is all your business.
After the website is fixed, check your Google Business Profile website link, services, opening hours, appointment links and UTM tracking if you use it. Make sure the profile points to the right clean page, not a cached spam URL or old staging site. If your local leads have dropped after a hack, Google Business Profile optimisation can help tidy the local signals around your recovered site.
For businesses relying on local calls and quote requests, I would also check rankings by location. You may rank differently in Crewe, Chester, Warrington, Northwich or Stockport depending on how strong your local pages and profile are.
Why hacked WordPress sites are so common
WordPress is not bad. Lazy WordPress management is bad. Most hacked WordPress sites I see are not victims of some elite hacker in a hoodie. They are running old plugins, abandoned themes, weak passwords or cheap hosting with security held together by hope.
The usual suspects are predictable. Old contact form plugins. Page builders that have not been updated. Nulled themes downloaded because someone wanted to save £49. Admin accounts called admin. Passwords that would embarrass a child. Staging sites left open. Former agencies still having access years later.
WordPress needs maintenance. That means core updates, plugin updates, theme updates, backups, security monitoring and sensible user permissions. It also means deleting plugins you no longer use, not just deactivating them and pretending they have vanished.
A hacked WordPress site can also create SEO-specific issues, like injected internal links, fake landing pages, spam schema, cloaked mobile redirects and altered robots.txt files. Some of these are invisible when you casually browse the site. That is why a crawler, Search Console and server-level checks matter. Looking at the homepage and saying it seems fine is not an audit. It is wishful thinking with a cup of tea.
How to stop the same thing happening again
Security is never perfect, but basic discipline prevents a lot of nonsense. The National Cyber Security Centre’s Small Business Guide gives sensible, plain-English advice for small businesses. It is worth reading if your current security plan is basically pray and renew the domain.
For most small business websites, these measures make a real difference:
- Use strong unique passwords and a password manager.
- Turn on two-factor authentication for CMS, hosting, email and Google accounts.
- Keep plugins, themes, CMS core files and server software updated.
- Remove old user accounts, especially past staff, freelancers and agencies.
- Use reliable hosting with malware scanning, backups and support that replies before Christmas.
- Schedule off-site backups and test that they can actually be restored.
- Add a firewall or reputable security tool suitable for your CMS.
- Monitor Search Console, uptime and key pages so problems are caught early.
Backups deserve a special mention. A backup you have never tested is not a backup. It is a comforting idea. Make sure you know where backups are stored, how often they run, how long they are kept and who can restore them.
When to get help instead of winging it
If your brochure site has one hacked page and your host has already cleaned it, you may not need a full SEO rescue job. Keep an eye on Search Console, check your main pages and move on with your life.
But get help if rankings or leads have dropped, spam pages are indexed, browser warnings are showing, Google has issued a security notice or the hack keeps coming back. Also get help if you sell online, collect customer data or rely heavily on local enquiries. The cost of guessing can be far higher than getting someone competent involved early.
The right fix often needs two people: a developer or security specialist to remove the infection and an SEO who can clean up the search damage. Sometimes one person can do both, but do not assume your web designer has checked indexation, redirects, canonicals, sitemap pollution and Search Console messages unless they tell you clearly.
If you are not sure how badly the hack has affected search visibility, a local SEO audit can help separate technical damage from normal ranking movement. That matters, because you do not want to spend three months blaming Google when your site is quietly leaking trust through a hacked subfolder.
Frequently Asked Questions
Can a hacked website recover its Google rankings? Yes, hacked websites can recover rankings if the infection is fully removed and Google can verify the site is safe again. Recovery depends on how long the hack lasted, what Google indexed, whether users saw security warnings and whether important pages were changed or deleted during cleanup. A fast, careful fix gives you the best chance.
How long does SEO recovery take after a website hack? It can take days, weeks or longer. Small hacks caught quickly may recover once Google recrawls and removes warnings. Larger hacks with indexed spam pages, manual actions or damaged site structure take longer. Search Console review times vary, so the priority is making the site genuinely clean before asking Google to reassess it.
Should I delete all hacked pages from Google? Remove hacked pages from your website, but do not blindly delete legitimate pages that used to rank. Genuine spam URLs can usually return 404 or 410. Valuable business pages should be restored from a clean version. After cleanup, update your sitemap so Google sees only the pages you actually want indexed.
Will changing web hosts fix a hacked website? Not by itself. Moving host can help if your old hosting is insecure, but it will not remove infected files, bad plugins, malicious database entries or compromised admin accounts automatically. If you move a hacked site without cleaning it, you may simply take the problem with you to a shinier server.
Can a hack affect my Google Business Profile enquiries? Yes. If your Google Business Profile links to a hacked site, customers may hit browser warnings, spam redirects or broken pages after finding you on Maps. That can reduce calls, forms and bookings even if your map rankings look stable. After cleanup, check every profile link and make sure it points to a clean working page.
Do I need to tell customers if my website was hacked? It depends on what happened. If no personal data was accessed, you may not need to contact customers. If customer data, payments, logins or enquiries were exposed, you may need legal or data protection advice. UK businesses should check ICO guidance and keep clear records of what happened, when and what was fixed.
