Confirming whether your site is actually compromised
If Google has alerted you to a hack, you see a warning in search results, or you simply suspect something is wrong, the first step is to verify the problem in Search Console. Register your site if you haven't already, then open the Security Issues report. This section lists example URLs where Google detected hacked content.
Checking those URLs directly is useful, but it is not always conclusive. A hacker may be using cloaking, a technique that serves different content to different visitors. When you open a flagged URL such as www.example.com/cheap-drugs, you might see a blank or normal page. Googlebot, however, may be served spammy text and links. This makes manual inspection unreliable.
Checking for cloaked pages
To reveal content that may be hidden from you, search Google for site:your-site-url, using the root domain. This query returns all indexed pages on your site, including any that a hacker may have injected. You can also use the URL inspection tool in Search Console to see how Google renders a specific page.
Next steps after verification
If you have reviewed the flagged URLs and still believe the warnings are incorrect, post in the Google Search Central Help Community. If the hack is real, move on to forming your support team to begin the cleanup process.
