Search Console Security Issues report and review

Where the report lives

When Google determines that your site has been hacked or serves content that could harm a visitor, it flags it in the Security Issues report. Find it under Security & Manual Actions in the Search Console left navigation, where the issues appear with sample affected URLs. Issues in this report surface as warnings: a "This site may be hacked" label in search results, or an interstitial warning page in the browser when someone tries to visit.

The issue types you will read

• Hacked: code injection: malicious code added to existing pages.
• Hacked: content injection: spam or third-party content injected into pages (the common pharma-style pattern).
• Hacked: URL injection: entirely new spam URLs generated under your domain.
• Malware / harmful programs: the site serves or links to software designed to harm a device.
• Social engineering / phishing: fake login or deceptive pages impersonating a real service to steal credentials.
• Cloaking and other search-quality issues can also appear here, showing different content to Googlebot than to visitors.

Google lists these alongside the example URLs it found, so the report doubles as a cleanup starting point. The behaviour behind "phishing" is closely analysed in the website-hacked redirect article, and the whole recovery path is the malware removal checklist.

Clean up properly before reviewing

A review request is only meaningful once the cause is fixed. In order:

1. Confirm the issue on one of the sample URLs the report gives you, so you are fixing the real pattern rather than a symptom.
2. Remove the injected code, spam content, malware, or phishing pages.
3. Close the route that let the attacker in: update outdated plugins and core, remove unknown admin accounts, rotate credentials, and check persistence points such as cron and hidden files (the checklist covers the full sweep).

Request a review

Back in Security Issues, select Request a Review for the affected category. Google asks you to describe the cleanup: for content-injection issues name what you removed and which vulnerability you corrected; for malware, state what you uninstalled or cleared. After the review is submitted, Google re-evaluates the site and, if it is clean, lifts the warning automatically. A successful cleanup and review typically takes a couple of days to clear, and after that the trustworthy-pages decisions continue in the indexing analysis the same way as for any page.

Positioning

The Security Issues report is a watchdog you want to check reactively when flagged and periodically when not, because a hacked site that goes unnoticed quietly damages both visitors and rankings. The report is not the place to tune indexing; deindexing and content controls belong to noindex and the indexing analysis. Its job is narrower and more urgent: tell you exactly what harmed visitors found, let you confirm you fixed it, and give you the button to get the warning lifted.