Why does Google say my site has security issues?

A security issues warning is Google telling you it found something on your site that could harm a visitor: injected malware, a page built to trick people into handing over information, or a link to a harmful download. This is a safety flag, not the usual kind of ranking penalty, and it lives inside Search Console under the Security Issues report rather than the Performance or Coverage reports.

Open Search Console, pick your property, and click Security Issues in the left menu. Google names the exact category it detected, for example hacked content, social engineering, or malware, and lists the specific URLs where it found the problem. That list is your starting point; read what Google actually flagged instead of guessing at the cause.

Most owners are surprised because the site still looks and works fine to them. That is normal. Attackers who inject spam pages or redirect scripts usually hide their work from a logged-in owner and show it only to crawlers or first-time visitors, so the front door looks untouched while the back rooms are compromised.

The most common entry point is an outdated plugin or theme on a CMS like WordPress. A known flaw in an old version gives an attacker a way to write files to your server without ever touching your login screen. The second most common entry point is a reused or weak admin password, often one already exposed in an unrelated data breach years earlier.

Once inside, attackers rarely deface your homepage; that would get noticed and cleaned quickly. Instead they add hidden pages targeting unrelated search terms, insert invisible links to sell backlinks, or redirect a slice of your traffic elsewhere. All three behaviors are built to survive as long as possible without an owner noticing.

Shared hosting can also spread an infection sideways: if another site on the same server is compromised, a misconfigured server can let that infection reach your files too. This is one reason the fix sometimes needs a hosting provider, not just a plugin update.

Start by changing every password with access to the site: hosting account, CMS admin, FTP or SFTP, and any connected email accounts. Then update the CMS core and every theme and plugin to their current versions, and remove anything you no longer use, since an unused plugin is unmaintained risk sitting on your server.

Next, go through every URL Google listed in the Security Issues report and check the actual file or page for injected code, unfamiliar admin users, or content you did not create. A developer or hosting provider's malware scan can catch files a manual check misses, particularly ones hidden inside image or font file extensions.

Only after the site is genuinely clean should you use Request Review inside the Security Issues report. Google's review is a manual process and can take days; asking for it before the underlying problem is fixed just resets the clock and delays the day the warning actually clears.

The habits that prevent a repeat are unglamorous but effective: keep the CMS, theme, and plugins on a real update schedule, use unique passwords with two factor authentication on every account that can touch the site, and remove any plugin or user account you are not actively using.

It also helps to check on your own schedule rather than waiting for a warning to appear. Search Console lets you review the Security Issues report any time; a look every month costs a few minutes and catches a compromise before it spreads to hundreds of pages.

If your site is built or maintained by an agency, ask directly who owns responsibility for security updates, and get that answer in writing. A site nobody is actively maintaining is the single biggest predictor of ending up back in this report.