Blog
Website Hacked and Search Console Taken Over? A Calm Checklist for Today
A practical incident checklist when your small-business site is hacked and Google Search Console access may be compromised: isolate, reclaim ownership, clean, request review, and keep leads coming from channels you own.
Your site looks wrong, Google shows a warning, or someone else seems to control Search Console. If that's today, here's a calm checklist I'd follow, based on Google's own Search Console help and the official hacked-site recovery guides, written so a non-technical owner can either do the steps or hand them to a host or IT person.
The short version: Treat it as an active incident. Don't keep clicking around on the infected site from your everyday computer. Reclaim hosting and Search Console ownership, remove unknown users, restore clean files, fix what let them in, then request a review in Search Console. Keep your phone, email list and Google Business Profile bringing in leads while search recovers. Nobody can promise rankings will bounce back on a set timeline.
What owners are reporting
Late last week on X, a few people described WordPress sites that had ranked well getting compromised, Search Console access looking wrong, and others scrambling on PHP patches after an emergency. Those were individual, low-engagement posts, not a study. I can't tell you how common that pattern is. What I can do is walk the official recovery path Google and WordPress document for when the site, Search Console or both are already in trouble.
This is different from a Google Ads suspension, a Meta page lockout or a general email phishing checklist. Here the problem is an active website and search-presence incident.
Step 1: Isolate and call for the right help
Google's Security Issues guidance warns that opening infected pages in a normal browser can put your machine at risk, and that attackers often hide spam so only Googlebot or certain visitors see it. Use Search Console's URL Inspection tool to see what Google sees, or ask your host to pull page content for you. If reading code or server configs is outside your comfort zone, Google's own pages say to build a support team: your host, a trusted developer or a security pro. Hand them this checklist.
Also pause any automated deploys or plugin auto-updates until you know what is clean. Screenshot the warning messages and the date. Note whether customers can still reach you by phone or email.
Step 2: Reclaim hosting and Search Console ownership
Start with the accounts that control the site:
Hosting control panel and FTP or file manager.
Domain registrar (make sure name servers and contact email still match what you expect).
WordPress or CMS admin users.
Google Search Console property users and owners.
Reset every related sign-in, turn on two-factor login everywhere it is offered, and remove people you do not recognize.
For Search Console, Google's ownership verification help explains how to prove you own the site again with an HTML file, HTML tag or another supported method. Once you are a verified owner, open Users and permissions. Google's help and the web.dev Search Console guide both say to remove unauthorized users and owners, and for owners to delete every verification token (meta tag, HTML file and so on) so they cannot re-verify. Google also notes that if you find an owner you don't recognize, the site may have been hacked, and removing the token alone is not enough until the site itself is secured.
While you are in Search Console, check Settings and Removals for crawl-rate changes or URL removals you did not request.
Step 3: Clean the site, then close the hole
Google's clean and maintain your site guide is the practical playbook. In plain language:
Take a labeled backup of the current (possibly infected) site so you can compare later. Do not treat that copy as clean.
Restore from a known-good backup taken before the compromise, if you have one. If the backup is older, restore it, then carefully bring forward only content you know is yours.
If you have no clean backup, clean a copy offline: remove spam pages, injected scripts and unknown admin users, then do a fresh install of the CMS and move only known-good content back.
Update core software, themes and plugins. Remove anything you no longer use. WordPress's Hardening WordPress guide stresses staying on maintained versions, using trusted plugin sources and deleting unused plugins.
Fix the root cause: an outdated plugin, a weak admin login, open file permissions or a compromised computer used to publish. Until that is fixed, Google notes the site can be reinfected.
Reset related sign-ins again after cleanup.
Optional but useful: in Search Console, use Remove URLs only for brand-new spam URLs the attacker created that you never want in results, and ask Google to recrawl clean pages you do want indexed. Do not use URL Removal on good pages you plan to restore.
Step 4: Request a Security Issues review
When the whole site is clean, open the Security issues report in Search Console. Google says fixing only some pages will not earn a partial return to results. When every listed issue is fixed site-wide, select Request Review. A good request, in Google's words, does three things: explains the issue, describes the steps you took, and documents the outcome.
Reviews often take several days or weeks. You get email when the request is received and when it finishes. Do not resubmit while one is pending. Google warns that requesting a review before the issue is truly fixed can slow the next review or get you treated as a repeat offender. The request a review guide walks the same flow for hacked spam, malware and social engineering flags.
I can't promise when warnings will clear or when rankings will look normal again. Clean first, then wait for Google's review.
Step 5: Keep leads coming while search recovers
Search warnings and spam URLs can scare customers away even after the files are clean. Keep owned channels warm:
Your phone, with a short voicemail that you are open and how to reach someone.
Your email list of past customers.
Your Google Business Profile, if it is still under your control.
A simple temporary landing page on a clean host if the main site must stay offline longer.
That way one compromised site does not silence the whole business while Google rechecks you.
What we don't know
I can't tell you how you were breached, whether Search Console was taken over in your case, or how long recovery will take. Google publishes the cleanup and review path, not success rates. The honest goal today is stop the bleeding, reclaim control, clean thoroughly, then ask for review once, not guess at ranking timelines.
How Local Business Search can help
We harden and rebuild small-business websites, help reclaim Search Console ownership, clean the lead path so forms and calls still reach you, and cover small-business IT, AI setup and consulting, and marketing. Done-for-you how-to videos are coming soon too.
If your site or Search Console looks compromised and you want a second set of hands, contact Local Business Search and we'll walk the next step with you.