Hacked Website? How Security Problems Hurt SEO and How to Recover

Many owners only find out their website has been hacked when a customer messages to say Google is showing a red “Deceptive site ahead” warning, or that the search results for the business name list pages about replica handbags in Japanese. By then the problem has usually been running for days or weeks, and enquiries have quietly dropped.

This guide explains how security problems damage SEO, how to tell whether your site has been compromised, and the recovery steps that matter: cleaning the site, closing the hole the attacker used, asking Google for a review and handling any personal data obligations under the PDPA. It finishes with WordPress hardening basics and a simple prevention routine a small Singapore team can actually keep up.

How a hacked website hurts SEO and enquiries

Security problems affect search performance in several ways at once, which is why recovery needs more than deleting a few bad files.

• Browser and search warnings. When Google Safe Browsing detects malware, phishing or unwanted software, Chrome and other browsers can show a full-page warning before visitors reach you, and search results can carry a “This site may be hacked” or similar label. Most people turn back.
• Spam pages in the index. Attackers often inject thousands of pages selling counterfeit goods, pharmaceuticals or gambling, sometimes in Japanese or gibberish text. Those pages compete with your real ones and change what Google thinks your site is about.
• Cloaking and redirects. Some hacks show normal pages to the site owner but redirect mobile visitors or visitors from Google to scam sites. You may not notice, but your customers do.
• Manual actions. Google can apply a manual action for hacked content or user-generated spam, visible in Search Console.
• Lost trust and ads. Google Ads can disapprove ads that point to a compromised site, so paid traffic may stop at the same time as organic traffic.
• Slow pages and downtime. Malicious scripts and crypto-mining code use server resources, which hurts page speed and user experience.

The good news is that a cleaned site can recover. Google states in its spam policies documentation that hacked content is treated as a problem to fix, and the Security Issues report gives you a route to ask for a review once you have fixed it. Recovery is usually measured in weeks, not days, so speed of response matters.

Warning signs your site may be compromised

Check for these signs, especially if traffic or enquiries have fallen without an obvious reason:

• A message in Google Search Console about security issues or manual actions, or an email from Google to the site owner address.
• Unfamiliar pages when you search site:yourdomain.com.sg on Google, often with foreign-language titles or product names you do not sell.
• New admin users, unknown plugins, or files with odd names in your hosting file manager.
• Visitors reporting redirects to other sites, pop-ups or download prompts, particularly on mobile.
• Your hosting provider suspending the account or warning about outgoing spam emails.
• Search Console showing a sudden spike in indexed pages or impressions for unrelated queries.
• Sudden changes in sitemaps or the .htaccess file, which attackers edit to get their pages indexed or to redirect users.

Some of these signs overlap with harmless issues such as fake bot traffic in analytics, so confirm with Search Console and a file check before assuming the worst.

Where Google shows security problems

Two reports in Search Console matter most. The Security Issues report lists problems Google has detected, grouped by type, such as hacked content, malware, deceptive pages (social engineering) or harmful downloads, with sample URLs. The Manual actions report shows any penalties applied by a human reviewer. You can also check a domain’s status on Google’s Safe Browsing site status page.

Remember that the sample URLs in the Security Issues report are examples only. Google reviews the whole site, so clean everything, not just the listed pages.

Step-by-step recovery plan for a hacked site

This plan assumes a typical SME WordPress site and a small team. Owners are suggested in brackets; adjust them to your set-up. If you have an IT vendor or web developer on retainer, bring them in at step 1.

1. Contain (owner and developer, same day). Put the site into maintenance mode or take it offline if it is actively harming visitors. Tell your hosting provider. Do not delete everything yet; you need evidence of what happened.
2. Change every credential (owner, same day). Reset passwords for WordPress admins, hosting, FTP or SFTP, database, domain registrar and any connected email. Turn on two-factor authentication wherever it is offered. Remove admin users you do not recognise.
3. Take a forensic backup (developer, day 1). Copy the current infected files and database somewhere offline so you can study the attack later, then identify your most recent clean backup.
4. Find the entry point (developer, days 1 to 3). Common causes are outdated plugins or themes, nulled (pirated) premium plugins, weak or reused passwords, and abandoned staging sites. Check server logs and recently modified files. If you skip this step, the attacker usually returns.
5. Clean or restore (developer, days 2 to 5). Restore from a clean backup if one exists, then update WordPress core, themes and plugins. Otherwise reinstall core files from official sources, remove unknown files, clean injected code from the database and inspect .htaccess, wp-config.php and sitemaps.
6. Remove spam URLs from search (marketing lead, days 3 to 7). Make sure the injected URLs now return a 404 or 410 status. Use the Removals tool in Search Console only to hide urgent URLs temporarily; it does not remove them permanently. Resubmit your clean sitemap.
7. Verify (developer and marketing lead). Use URL Inspection to fetch key pages as Google sees them, test on mobile, and check that no cloaking or redirects remain.
8. Request a review (owner, after cleaning). In the Security Issues report, mark the issue as fixed and request a review. Explain what the problem was, what you did and how you prevented it from recurring. Google notes that hacked-spam reviews can take several weeks, and a review requested before the site is clean will fail.
9. Assess personal data (owner, within days). If customer data may have been accessed, follow the PDPA steps in the next section.
10. Monitor (marketing lead, next 8 weeks). Watch Search Console, your site: results and branded searches weekly until spam pages drop out of the index.

If spam pages had built up for a long time, expect some lag before branded search results look normal again. Our guide to getting pages crawled and indexed explains how recrawling works.

Personal data, the PDPA and who to tell

A hacked website is not only an SEO problem. If enquiry forms, customer accounts or orders were stored on the site, personal data may have been exposed. Under the PDPA’s data breach notification obligation, the PDPC describes a breach as notifiable if it is likely to result in significant harm to affected individuals, or if it affects 500 or more individuals. Once you assess a breach as notifiable, PDPC states that you must notify it as soon as practicable and no later than three calendar days, and notify affected individuals where significant harm is likely.

This is general information, not legal advice. Read PDPC’s Guide on Managing and Notifying Data Breaches, keep a written record of your assessment, and get professional advice if you are unsure. Our overview of the PDPA for marketing teams covers the wider consent and data protection basics.

For the cyber incident itself, the Cyber Security Agency of Singapore runs SingCERT, which accepts incident reports, and publishes free guidance for SMEs under its SG Cyber Safe Programme, including the Cyber Essentials and Cyber Trust marks. Check current details and any support schemes directly on the CSA website. If payment card data was involved, also contact your payment provider.

WordPress hardening basics

Most SME sites in Singapore run on WordPress, and many WordPress compromises trace back to the same few weaknesses. The official WordPress hardening guide is the best reference. The essentials are:

• Update promptly. Keep WordPress core, themes and plugins current, and delete plugins and themes you are not using rather than just deactivating them.
• Never use nulled plugins or themes. Pirated premium software is a common source of backdoors.
• Strong, unique passwords and two-factor authentication for every admin account, plus fewer admin accounts overall. Give staff the lowest role they need.
• Use HTTPS everywhere with a valid certificate, and redirect http to https.
• Automatic off-site backups kept for at least several weeks, so you can restore a version from before the infection started. Test a restore at least once.
• Choose hosting with security support: malware scanning, a web application firewall, isolated accounts and current PHP versions.
• Lock down file editing in the dashboard and limit login attempts.
• Protect or remove staging sites and old subdomains, which are often forgotten and unpatched.
• Moderate comments and forms with spam protection to prevent user-generated spam.

Hardening also helps performance and trust. A lean, updated site is usually faster, which supports the Core Web Vitals Google measures.

How AI can help with website security and SEO monitoring

AI will not replace a security professional, but it can shorten the time between a problem starting and someone noticing. Useful applications include summarising server logs to highlight unusual login attempts, comparing today’s list of indexed URLs with last week’s to flag sudden spikes, drafting a clear review request for Google from your developer’s notes, and turning the hardening checklist above into a monthly task list.

Marketing2u’s AI Website Agent monitors public pages for broken links, HTTPS and mobile issues, and reports WordPress plugin and theme status where supported, while the AI SEO Agent watches Search Console for indexing changes and index drops. Neither is a malware scanner or a replacement for your host’s security tools, and neither deletes pages automatically; a person decides on the fix.

Use AI with care during an incident. Never paste passwords, database dumps or customers’ personal data into a public chatbot, and treat any AI-generated cleanup instructions as a draft for a qualified developer to check.

Common mistakes after a hack

• Requesting a Google review before the site is fully clean, which wastes weeks.
• Restoring a backup without finding the entry point, so the same vulnerability is exploited again.
• Only fixing the sample URLs listed in Search Console and missing the rest.
• Changing the WordPress password but not hosting, FTP, database or email credentials.
• Using robots.txt to block spam URLs, which stops Google from seeing that they now return 404 or 410.
• Ignoring PDPA obligations because “it was only the website”.
• Quietly deleting thousands of real pages in panic, causing new SEO problems. If you must change URLs, follow our 404 and 301 redirect guide.

Prevention routine for a small team

Security is mostly routine. As a rough planning guide, a small business site needs around an hour a month of attention:

Conclusion: treat security as part of SEO

Website security and SEO are closely linked: a compromised site loses visitors to warnings, fills the index with spam and can trigger manual actions. Recovery is very possible if you contain the damage, find the entry point, clean thoroughly, request a Google review only when the site is clean and handle any personal data obligations. After that, simple habits such as updates, two-factor authentication, backups and a weekly look at Search Console protect your rankings far more cheaply than another cleanup. If you are rebuilding after an incident, our list of common web design mistakes is a useful next read.

Frequently asked questions

How long does it take for Google to remove a hacked site warning?

It depends on how quickly you clean the site and how Google processes the review. Google says reviews for sites hacked with spam can take several weeks, while some malware reviews are faster. Requesting a review before the site is completely clean usually leads to a rejection and a longer delay.

Will my rankings come back after a hack?

Usually they can, once the site is clean, the spam URLs return 404 or 410, and any manual action or warning is lifted. Recovery is not instant, because Google has to recrawl your pages and drop the injected ones. Sites that were compromised for a long time can take longer to settle.

How do I know if my website has been hacked?

Check the Security Issues and Manual actions reports in Google Search Console, search Google for site:yourdomain to look for pages you did not create, and review admin users and recently changed files. Visitor complaints about redirects or browser warnings are also strong signs.

Do I need to report a hacked website to the PDPC?

Only if personal data was affected and the breach is notifiable, which PDPC defines as likely to cause significant harm to individuals or affecting 500 or more people. In that case PDPC expects notification no later than three calendar days after you assess it as notifiable. This is general information, so check PDPC’s guidance or get professional advice for your situation.

Sources and further reading

• Search Console Help: Security Issues report
• Google Transparency Report: Safe Browsing site status
• WordPress Developer Resources: Hardening WordPress
• PDPC: Report your organisation's data breach
• Cyber Security Agency of Singapore: Cybersecurity certification for organisations
• web.dev: Fix the Japanese keyword hack

Related guides

• Google Manual Actions: Types, Causes and How to Recover
• How to Fix 404 Errors and Use 301 Redirects Correctly
• Core Web Vitals and PageSpeed Insights: A Guide for Business Owners
• PDPA Marketing Singapore: The 2026 Compliance Playbook
• How To Do An SEO Audit: 9 Things To Check For

Browse every article in our Websites & Content guides.