Security Issues

What the Security Issues report is

Security Issues is the Search Console report that flags when Google believes your site has been hacked or is actively harming visitors - injected malware, deceptive "social engineering" pages, or unwanted software. When it fires, Google can slap a red interstitial warning in front of your pages in Chrome and suppress you in search, so traffic can crater within hours.

This is one of the few Search Console reports where "wait and monitor" is the wrong instinct. A flagged security issue is an emergency: it means real users are seeing warnings and your rankings are already bleeding.

The categories Google flags

Google groups security problems into a handful of types. Knowing which one you have tells you where to look.

Deceptive-page flags catch a lot of people off guard because the site was never "hacked" in the classic sense - a misleading download button or an ad network serving fake "your computer is infected" pages is enough.

What a hacked injection actually looks like

Injected spam is often hidden from human visitors but served to Googlebot (cloaking), which is why owners miss it. A classic content injection buried in a theme footer file looks like this:

<!-- injected block, hidden off-screen from users -->
<div style="position:absolute;left:-9999px;top:-9999px;">
  <a href="http://spam-pharma-example.tld/cheap-pills">buy cheap pills</a>
  <a href="http://spam-casino-example.tld/">online casino bonus</a>
</div>

// ...and lower down, a PHP backdoor one-liner (shown here defanged):
// <?php  @[EVAL]( [BASE64-DECODE]( $_POST['x'] ) );  ?>

The hidden links farm your authority out to spam sites; the PHP eval line is a backdoor that lets the attacker run code again after you clean up. Miss the backdoor and you get re-hacked within days - which is the single most common reason a "fixed" site gets flagged all over again.

How to check it on your own site

1. Open Search Console and go to Security & Manual Actions > Security issues. A green check means Google currently sees nothing.
2. If there is an issue, expand it to read the category and the sample affected URLs Google provides. Those samples are your starting map.
3. Fetch those sample URLs as Googlebot using the URL Inspection tool - injected content is often cloaked, so what you see in a browser may differ from what Google sees.
4. Scan your server files and database for recently modified files, unknown admin users, and suspicious code like eval, base64_decode, or gzinflate wrappers.
5. Check for hidden or spammy pages by searching site:yourdomain.com plus spam terms (pharma, casino, replica) to surface URL-injection pages.
6. Once genuinely clean - including every backdoor - use Request Review in the same report and describe exactly what you fixed.

Common mistakes and how to fix them

• Cleaning the visible symptom, missing the backdoor. You delete the spam links but leave the eval shell, so you are re-hacked in days. Hunt down every injected access point before requesting review.
• Requesting review too early. A rejected review costs you days. Confirm the site is fully clean - crawl it, check logs, verify no cloaking remains - before you submit.
• Assuming a deceptive-page flag means you were hacked. Sometimes it is your own misleading download buttons or a shady ad network. Audit third-party ad code and any download UX, not just your core files.
• Not changing credentials. The attacker got in somehow. Rotate all passwords, database creds, and API keys, and force-logout existing sessions - otherwise they walk right back in.
• Ignoring the underlying vulnerability. Patch the CMS, themes, and plugins that let them in. Cleaning files without patching the hole is mopping the floor with the tap running.

FAQ

How fast do I need to act on a security issue?

Immediately. Google may already be showing a warning interstitial to your visitors and demoting you in results. Every hour of delay is lost traffic and trust. This is not a "next sprint" ticket.

Will the warning disappear the moment I fix the site?

No. After cleaning up you must submit a Request Review. Google re-crawls and re-evaluates, which typically takes a few days for hacked/malware cases and can be faster for deceptive-page reviews. It is not automatic.

My site was flagged but I cannot find anything wrong. Now what?

The content is probably cloaked - shown only to Googlebot or only to visitors from search. Use URL Inspection to fetch the sample URLs as Google sees them, and check server logs and file timestamps. What renders in your browser is not the whole story.

Is this the same as a manual action?

No. Security Issues covers hacking, malware, and deceptive pages detected by Google's safety systems. Spam and quality violations that draw a human penalty appear under Manual Actions instead. Different reports, different fixes.

Can weak security hardening trigger this?

Missing hardening does not trigger the report by itself, but it is what lets attackers in. Fixing things like a missing Content-Security-Policy header and missing HSTS reduces the attack surface that leads to these flags.

Related reading

• HTTPS and Site Security as Ranking Signals.
• Negative SEO - when the attack is aimed at you deliberately.
• Handling User-Generated Content SEO Risks - a common injection vector.