Security Guides
Does website security affect SEO? Vulnerabilities, hacked sites, HTTPS and rankings, sorted out from Google's official documentation
Does website security affect SEO? Using Google Search Central, Search Console Help, web.dev and Bing's own documentation: a vulnerability alone is not a listed ranking factor, but a hacked or malware-serving site gets warnings and can drop out of results. How to check and how to recover.
Who this is for: anyone running their own website who wants to know whether security affects search rankings, or who has just seen a hacked-site warning on their own listing. This guide is based on Google Search Central, Search Console Help, web.dev, Chrome Help and Bing Webmaster Tools documentation. It does not cover how attacks are carried out.
Security state and search impact
First, how each state affects search, with the official source for each. "Not listed by Google as a ranking factor" means we could not find it described as one anywhere in Google's documentation, not that Google says it is irrelevant.
| Security state | Effect on search | Official source |
|---|---|---|
| A known vulnerability exists (for example an old plugin) but hasn't been exploited | Not listed by Google as a ranking factor. Once exploited, you move to the rows below | Spam policies (hacked content is content placed "without permission, due to vulnerabilities") |
| No security headers, or a low grade from a scanner | Not listed by Google as a ranking factor | Page experience documentation (the aspect it says ranking systems use is Core Web Vitals) |
| Still on HTTP | A "very lightweight" signal per the 2014 announcement; Chrome shows "Not secure" in the address bar | 2014 blog post, page experience docs, Chrome Help |
| Hacked, with spam pages added | "This site may be hacked" in results; sites that violate the policies may rank lower or not appear | Google Search Help, spam policies |
| Serving malware or phishing | Warning label in results and a "Dangerous site" warning page in the browser | Search Console Help (Security issues report), Chrome Help |
| A forum or comments flooded with third-party spam | Manual action; affected pages ranked lower or omitted from results | Search Console Help (Manual actions report) |
| Bing detects malware | Removed from Bing results, or a malware warning added to the listing | Bing Webmaster Tools Help |
Hacking shows up under Security issues, not Manual actions
The current list of manual action types in Search Console has no "hacked site" entry. Hacked content, malware and unwanted software, and social engineering (tricking people, for example with a fake login page) appear in the Security issues report. Check both reports.
How much does HTTPS help rankings?
In an August 2014 Search Central blog post, Google announced it would use HTTPS as a ranking signal. It described it as, for now, only a very lightweight signal, affecting fewer than 1% of global queries and carrying less weight than signals such as high-quality content.
Google's current page experience documentation includes HTTPS as a self-assessment question: "Are your pages served in a secure fashion?" The same page says Core Web Vitals (metrics for loading speed, responsiveness and visual stability) are used by Google's ranking systems, and that beyond Core Web Vitals, other page experience aspects don't directly help a website rank higher. An April 2023 blog post likewise said that not all of the previously listed page experience signals, which included HTTPS, may be directly used to inform ranking.
You still need HTTPS. Chrome Help says that on a site without a private connection, someone may be able to view and change the information you send and get, and it advises users not to enter private or personal information on such pages. If your site has a contact form or a login page, missing HTTPS is visible to every visitor.
What happens in search and in browsers when a site is hacked
Google's spam policies define hacked content as any content placed on a site without permission, due to vulnerabilities in the site's security, and say sites that violate the policies may rank lower in results or not appear in results at all. Google detects violations through automated systems and, as needed, human review.
1 A vulnerability exists
Old plugins, reused passwords. At this stage it is not a listed ranking factor
2 It is exploited and the content changes
Spam pages, hidden links, redirects to other sites, malware
3 Warnings appear in search and browsers
Hacked label in results, "Dangerous site" page, lower rankings or removal
4 Fix it, then request a review
Only after the hole is closed. Reviews take about a day to several weeks
5 Warnings are removed
Once the site is found clean, browser and search warnings are removed within 72 hours (web.dev)
"This site may be hacked" in search results
According to Google Search Help, the "This site may be hacked" message appears when Google believes a hacker might have changed some of the existing pages on the site or added new spam pages. It stays until the site owner fixes the problem and Google confirms the fix.
"Dangerous site" in the browser
Google Safe Browsing (Google's list of unsafe sites, which browsers and other products use to warn people) protects Chrome and other browsers, as well as Google Search, Gmail and more. Chrome Help says sites involved in phishing, malware, unwanted software or social engineering get a red "Dangerous site" warning. In this site's view, you should assume few visitors will click past that page.
Hack types Google describes
web.dev (Google's guidance for web developers) publishes cleanup guides for hacks that affect search. Three common ones:
| Type | Google's description |
|---|---|
| Japanese keyword hack | New pages with autogenerated Japanese text appear in randomly named directories, monetized with affiliate links to stores selling fake brand merchandise. The hacker typically adds themselves as a property owner in Search Console |
| Gibberish hack | Many pages of nonsensical, keyword-filled sentences are created to rank in search, and visitors are redirected to unrelated sites |
| Cloaked keywords and links hack | Many pages of nonsensical text, links and images are created to manipulate Google's ranking factors; the owner may be shown a fake 404 |
All three are built so the owner does not notice them in normal browsing. web.dev recommends a site: search and the URL Inspection tool, which shows the page as Google sees it.
What to check today
Even without any warning, these five checks take a few minutes. If your site is not in Search Console yet, add and verify it first; once it is, problems Google finds are reported in the reports and in Search Console messages.
Open Security issues and Manual actions in Search Console
Both reports are under "Security & Manual Actions" in the left menu. If there is a problem, you will see the issue type and sample affected URLs. Google notes the sample list may not be complete, and some issues show no example URLs even though pages are affected.
Check for owners you didn't add
Go to Settings > Users and permissions and look for users or owners you don't recognize. web.dev says the hacker typically adds themselves as a property owner in the Japanese keyword hack. To remove a verified owner, you must delete that person's verification token (HTML file, meta tag and so on) from your site; "Unused ownership tokens" shows the tokens left behind.
Run a `site:` search for pages you didn't create
Search Google for site:yourdomain and look for URLs or titles you don't recognize, such as Japanese brand, pharmacy or shopping terms. This site also suggests adding a suspicious word after the site: query to narrow it down. If Google shows nothing, web.dev suggests trying another search engine.
Check Safe Browsing site status
Enter your domain in Site status under Safe Browsing in the Google Transparency Report to see whether Safe Browsing currently considers the site dangerous.
Make sure you serve HTTPS
Open your site in Chrome and check that the address bar doesn't say "Not secure". Search Console's HTTPS report shows whether you serve secure HTTPS pages and what to fix if you don't.
Looking normal to you is not proof the site is clean
web.dev explains that hacked pages may show their owner a 404 or similar error so they look gone. Don't just open a suspicious URL in your own browser; check it with URL Inspection to see what Google sees. Server-side checks for signs of intrusion are in how to check if your website or server was hacked.
Recovery steps if you already have a warning
Order matters. Requesting a review before the cause is fixed keeps the warning up longer.
Preserve evidence and stop the spread
Back up the whole site and the database off the server, and save the logs. If visitors are being harmed, take the site offline temporarily. The detailed order is in the intrusion check and response guide.
Remove the hacker's content and close the hole
Delete added pages, modified files and unknown users, and change every password. Google Search Help warns that if you don't fix the vulnerability, the site may be hacked again. web.dev (a 2015 page) cites a study that found 20% of hacked sites were hacked again within one day. On WordPress, work through updates and remove unused plugins with the WordPress security reference.
Make spam URLs return 404 or 410
Per Search Console Help, to remove a page from results permanently, remove it and make the server return 404 (Not Found) or 410 (Gone). The Removals tool's temporary removal can hide URLs quickly, but only for about six months. Google says not to use robots.txt as a blocking mechanism.
Confirm the fix as Google sees it
web.dev asks you to confirm before a review that key pages, including URLs the hacker modified, are clean, and that Googlebot can crawl them (not blocked by robots.txt or noindex). Use URL Inspection to check that spam URLs are now treated as not found (404 or similar).
Select Request Review in the right report
For Security issues, fix every listed issue across the whole site, then select Request Review in that report and describe the issue, the steps you took and the outcome. For a manual action, request reconsideration from the Manual actions report the same way. Search Console Help says most reviews take several days or weeks and asks you not to resubmit while one is pending. web.dev gives about a day for phishing, a few days for malware and up to several weeks for hacked-with-spam reviews.
Check Bing too
Bing says it alerts site owners through Bing Webmaster Tools when it detects malware, and either removes the site from its results entirely or adds a malware warning to the listing. If your site is in Bing Webmaster Tools, check for the alert and follow the Bing Webmaster Guidelines, which say sites involved in phishing, malware distribution or other harmful activities risk demotion or removal.
This site's view: security for SEO means not getting hacked and noticing fast, not raising a score
Some site owners assume stronger security will lift their rankings, and spend time raising a security header grade or a scanner score. Nothing in Google's documentation supports that. The large search effect comes when a site is hacked and labeled. A review can take up to several weeks, and during that time search traffic can fall sharply.
So from an SEO point of view, we suggest focusing on two things. First, keep the software and passwords that hackers use to get in under control. Second, register in Search Console, receive its email alerts, and notice problems early. For security headers, setting the ones that still matter to limit damage is enough.
Sources (official)
- Google Search Central Blog, "HTTPS as a ranking signal" (August 7, 2014) — developers.google.com
- Google Search Central, "Understanding page experience in Google Search results" — developers.google.com
- Google Search Central Blog, "The role of page experience in creating helpful content" (April 19, 2023) — developers.google.com
- Google Search Central, "Spam policies for Google web search" (hacked content) — developers.google.com
- Search Console Help, "Security Issues report" — support.google.com
- Search Console Help, "Manual Actions report" — support.google.com
- Search Console Help, "Removals and SafeSearch reports Tool" — support.google.com
- Search Console Help, "Manage owners, users, and permissions" — support.google.com
- Google Search Help, "Report a problem with Google Search" ("This site may be hacked") — support.google.com
- web.dev, "Request a review" — web.dev
- web.dev, "Fix the Japanese keyword hack" — web.dev
- web.dev, "Fix the gibberish hack" — web.dev
- web.dev, "Fix the cloaked keywords and links hack" — web.dev
- Google Safe Browsing — safebrowsing.google.com / Transparency Report Site status — transparencyreport.google.com
- Chrome Help, "Manage warnings about unsafe sites" — support.google.com
- Chrome Help, "Check if a site's connection is secure" — support.google.com
- Bing, "Webmaster Guidelines" — bing.com
- Bing, "Why is My Site Not in the Index?" — bing.com
Read next
- Checking for intrusion: How to check if your website or server was hacked (shared hosting, WordPress, VPS)
- Settings that limit damage: Choosing security headers: what is still needed, what is obsolete, and what does harm / tool: security header scanner
- WordPress: WordPress security — a production hardening reference
- Another way strangers' pages appear on your domain: Subdomain takeover (dangling DNS)
- When your host is breached: When your web hosting provider is breached: what customers should do
- Recovery: Backup essentials
- Glossary: What is malware? / What is phishing?
FAQ
QDoes website security affect SEO?
Security work does not raise your rankings by itself. Google does not list vulnerabilities or security headers as ranking factors. The big effect comes when a vulnerability is exploited and the site is hacked or starts serving malware. Google labels hacked sites in search results and says sites that violate its spam policies may rank lower or not appear in results at all.
QHow do I remove "This site may be hacked" from Google?
Only the site owner can get it removed, by fixing the site. Verify the site in Search Console, open the Security issues report to see the issue and sample URLs, and fix the vulnerability that let the hacker in. When the whole site is clean, select Request Review in the same report. Google removes the message after it checks that the site is fixed. web.dev says reviews for sites hacked with spam can take up to several weeks.
QWill switching to HTTPS improve my rankings?
Don't expect much. When Google announced HTTPS as a ranking signal in 2014, it called it a very lightweight signal affecting fewer than 1% of global queries. Google's current page experience documentation lists HTTPS among its self-assessment questions, but says that beyond Core Web Vitals, other page experience aspects don't directly help your website rank higher. Treat HTTPS as something you need to protect visitors.
QDo security headers or vulnerability scan scores affect rankings?
Google Search Central's documentation does not list security headers or third-party scanner grades as ranking factors. The page experience aspect Google says its ranking systems use is Core Web Vitals. Security headers are worth setting to limit the damage if your site is attacked, not for rankings.
QWhat is the difference between a manual action and a security issue?
A manual action means a human reviewer at Google determined that pages on your site violate the spam policies; affected pages may rank lower or be left out of results. Spam posted on your forum or comments shows up there as 'Site abused with third-party spam' or 'User-generated spam'. Hacking and malware show up in the Security issues report instead. In both cases you fix the problem and select Request Review in the relevant report.
QHow do I get hacked spam pages out of Google quickly?
Delete the pages and make sure the server returns 404 or 410. If you need them hidden fast, the Removals tool can block them temporarily, but only for about six months; it is not a permanent removal. Don't block the URLs with robots.txt, which Google says not to use for removal.