Website security issues that affect SEO

Why security is an SEO issue

When a site is hacked, attackers often use it for their own purposes: injecting spam pages, adding hidden links, redirecting visitors to scam sites or serving malware. Google may then:

• Show a warning in search results such as "This site may be hacked".
• Show browser warnings through Safe Browsing that stop people visiting.
• Remove affected pages from results.
• Flag the issue in Search Console's Security issues report.

Even if rankings recover, customers who saw a warning may not come back.

Common attacks on small business sites

Spam page injection

Thousands of pages selling counterfeit goods or pharmaceuticals appear on your domain. You might not notice because they're not linked from your menu.

Japanese keyword hack

A well-known pattern where auto-generated pages in Japanese appear on the site, often selling counterfeit goods. Visitors and owners may never see them, but Google does.

Hidden links

Links to spammy sites are inserted into your pages, sometimes only visible to search engine bots.

Malicious redirects

Visitors arriving from Google, especially on mobile, get redirected to scam or adult sites, while visitors typing your address directly see the normal site. That makes it hard to spot.

Comment and form spam

Not strictly a hack, but unmoderated comments and forms filled with spam links can harm your site's quality.

How to spot problems

• Search Console. Check the Security issues and Manual actions reports. Google often emails registered owners when it detects a problem, which is another reason to own your Search Console account.
• Site search. Search `site:` plus your domain. Look for pages you didn't create, foreign-language titles or spam keywords.
• Performance report. Look for queries unrelated to your business, such as designer handbags on a joiner's site.
• Indexing report. A sudden jump in indexed pages you didn't create is a red flag.
• Test from search. Click through to your site from Google on a phone, not just by typing the address.

How most small sites get hacked

• Outdated software. Old versions of WordPress, themes and plugins with known vulnerabilities.
• Abandoned plugins. Plugins no longer maintained by their developers.
• Weak or reused passwords on admin accounts, hosting or FTP.
• Old admin accounts for former staff or freelancers.
• Nulled themes and plugins, pirated premium software often bundled with malware.
• Insecure hosting.

Prevention basics

1. Keep your platform, themes and plugins updated. Turn on automatic updates where it's safe. 2. Remove plugins and themes you don't use. 3. Use strong, unique passwords and two-factor authentication for admin, hosting and domain accounts. 4. Review user accounts regularly and remove anyone who no longer needs access. 5. Choose reputable hosting with security monitoring and backups. 6. Take regular backups stored off the server, and test that you can restore them. 7. Use HTTPS across the whole site. 8. Moderate comments and forms, and add spam protection.

The National Cyber Security Centre's guidance for small businesses is a good, free UK resource.

If you've been hacked

1. Don't panic, but act quickly. Contact your host and your developer. 2. Change all passwords: admin, hosting, FTP, database and domain registrar. 3. Identify the problem. Use Search Console's Security issues report for examples. Your host may scan for malware. 4. Clean the site. Restore a clean backup from before the hack if you have one, then update everything. Otherwise, remove the malicious code and pages. This is often a job for a specialist. 5. Close the hole. Find how attackers got in and fix it, or they'll be back. 6. Remove spam pages from Google. Let them return 404 or 410 status. For urgent cases, the Removals tool in Search Console can temporarily hide URLs. 7. Request a review. Once clean, use the "Request review" option in the Security issues report, explaining what you fixed.

Google's security guidance for site owners gives detailed steps.

A worked example

A small hotel in the Lake District noticed enquiries had dried up and Search Console showed searches for designer watches. A `site:` search revealed hundreds of spam pages on its domain.

The hotel's website used an old booking plugin that hadn't been updated for years. Its host restored a clean backup from a month earlier, the developer replaced the plugin with a maintained alternative and updated everything else, and all passwords were changed with two-factor authentication added. The spam URLs were left to return 404, and the hotel requested a review in Search Console.

The warning cleared after the review, and the spam pages dropped out of results over the following weeks. The hotel now has automatic updates switched on and a monthly security check in its diary.

Questions