Website Hacked: Repair the Harm Without Promising a Ranking Recovery

Deal with the unsafe site first

If visitors face malware or deceptive pages, leaving them exposed is a poor way to protect traffic. Start by containing the harm.

The right response depends on the compromise and available access. My hacked website guide describes the repair decisions.

Search visibility can change during a compromise or cleanup. A promise that a short outage never matters would go beyond the evidence.

Separate real pages from injected content

List the pages customers still need. Check what changed. An unknown address may be junk added by the hack.

Keep the real page addresses if the repair allows. If you remove injected junk, don't send every missing address to your homepage.

For a planned move, map an old useful page to a relevant replacement. Google warns against redirects to unrelated destinations.

Match the link to the page it replaces. That choice can't promise to keep your old rank.

Use the report that describes your problem

Search Console's Security Issues report shows harm Google has found. Its examples may leave out other pages with the same problem.

Google says to fix all listed issues on every page before asking for a security review. Explain the repairs.

That review isn't a promise to restore your rank. A cleared warning doesn't mean the visits will return.

Check crawl and index reports after cleanup, too. Server errors, lost pages and changed links need checking.

Choose the repair before choosing a rebuild

You may be able to clean the site and secure its access. Consider rebuilding if the old system can't be kept safe.

Don't change all the addresses just to make a repair look new. My rebuild article covers deciding the scope.

I offer repair help for WordPress you're currently using. I need access and the known damage to assess the scope.