Check a website for search security issues

A warning about hacked pages or malware needs prompt attention because visitors may be at risk. First establish what Google found and which parts of the site are affected. Then the cleanup can be checked against evidence instead of a guess.

Short answer: Open the Security Issues report in Search Console, record the affected URLs and warning type, and check the site with your host or security provider. Remove the cause and affected content before requesting a review. Keep software, accounts and backups under control afterward.

Written by Hamza Rivera. Last reviewed November 8, 2026

Hamza works in SEO and GEO/AEO. He writes the Passieon guides and checklists and does the SEO work for the businesses Passieon serves.

Find the warning and preserve the evidence

Check Search Console messages and the Security Issues report. Save the warning text, example URLs and the date. Search your domain for unfamiliar pages or subjects, and ask the host for access and change logs. A missing Search Console warning does not prove a site is clean, so check the server and files as well.

Contain the problem before changing pages

Have the host or security team review the affected account, files and database. Reset compromised credentials, remove unknown users and close the entry point. Restore only from a backup made before the infection and verified clean. Simply deleting the visible spam page can leave the access that created it in place.

Check what visitors and Google receive

Test affected URLs and a sample of normal pages on desktop and phone. Check redirects, downloaded files and scripts that load from outside domains. Attackers sometimes serve different content to crawlers or visitors, so compare what the server returns with the page you see in a browser.

Request review after the cause is gone

Use the Security Issues report to request a review when the site and affected URLs are clean. Describe the cause and the fix accurately. Keep monitoring Search Console, backups, updates and account access. Enable multi-factor authentication for hosting and site accounts. If the business runs WordPress, plugin and theme updates are part of that routine.

Sources for technical rules

Google's documentation is the authority for its own search systems. This guide explains the work in our words.