A warning in search results is a different thing from a browser certificate warning. This one means the search engine has found something harmful or misleading on the site. The effect is immediate and severe, because most visitors do not click past a warning.
| What it says | What it means |
|---|---|
| This site may be hacked | Foreign content or redirects have been added to the site |
| Deceptive site ahead | The site has a page imitating some other service |
| The site contains malware | Visitors are served a file or code that should not be there |
The search engine's own tool has a security section listing example addresses where the problem was found. That is the single most useful piece of information, because it tells you where to look. If the site is not connected to the tool yet, do that right away.
The warning is a consequence, not a cause. There is almost always a break-in behind it, and the clean-up is covered in our guide on a hacked website. If the symptom has been a redirect to an unknown address, see the site redirects to an unknown address.
Before requesting a review, check that extra users are gone, passwords changed, scheduled tasks reviewed and software updated. If any of these is missed, the warning returns within days and the second round takes longer.
The request is made in the same tool. Write briefly what you found, what you did and how access was closed. Processing usually takes from a few hours to a few days. Do not send a new request every day, it does not speed anything up.
During a break-in hundreds of spam pages may have been created, and they can still be in the search results. It is worth removing them and letting those addresses answer with an error, so the search engine stops visiting them. The topic is touched on in our guide on fixing a 404 error.
Do not request a review before the site is genuinely clean. A rejected request not only leaves the warning in place but makes the next review slower.
We clean the site, document what was found and file the review request for you. We also tell you how they got in, so the same route is not open next month.
