A customer tells you your website sent them to a "you have won a prize" page, a casino or a pharmacy. You open the site yourself and it looks fine. Or Google now shows "This site may be hacked" under your listing, your results carry Japanese or pill-shop titles you never wrote, or Chrome shows a red "Dangerous site" screen. All of these are the same thing: someone has added code to the site, and it is written to hide from the owner. Below is a rebuilt example (not a real client), then how to confirm it, how to clean it so it stays clean, and how to get Google's warning taken off.
The added code is selective on purpose, so the owner is the last to notice. It typically redirects only visitors who are not logged in, only phones, only people arriving from a Google search, or only someone's first visit (it sets a cookie and leaves them alone afterwards). Some versions show Google's crawler a different page from the one people see, which is how spam titles end up in your search results while the site looks normal in your browser. The way in is usually an out-of-date plugin or theme with a known hole, a "nulled" (pirated) copy of a paid plugin, or a reused or leaked password.
site:yourdomain.com in Google. Pages you never made (Japanese text, "cheap", "casino", brand-name handbags) mean spam pages were added or are being shown to Google.wp-config.php), and every WordPress administrator. Delete admin users you do not recognise.wp-admin and wp-includes folders from wordpress.org. Your content lives in the database and wp-content, so this does not touch it..htaccess, wp-config.php and the root index.php for added lines (long unreadable strings, eval, base64_decode, rules that check for Google as the referrer). Delete any .php file inside wp-content/uploads: that folder should only hold images and documents. Check wp-content/mu-plugins, which loads silently and does not appear in the plugin list.<script and links you did not add, and check Settings, General that both site addresses are still yours.wp-config.php (WordPress publishes a generator at api.wordpress.org/secret-key/1.1/salt/), then update everything to its latest version and turn on two-factor login for admins.| What you see | Usual cause | Usual fix |
|---|---|---|
| Customers land on a prize, casino or pharmacy page; you never do | Conditional redirect for logged-out, phone or Google visitors | Full clean-up above; test as a stranger |
| Japanese or shop titles in your Google results | Spam pages added, or a different page shown to Google only | Remove them, let them 404, Removals tool, sitemap |
| "This site may be hacked" under your listing | Google found injected content or spam pages | Clean, then Search Console Request review |
| Red "Dangerous site" screen in Chrome | Safe Browsing flagged malware or a scam redirect | Clean, then review in Search Console Security issues |
| Fixed it, it came back a few days later | A backdoor or an unknown admin was left, or the hole was not closed | Fresh copies of everything, delete stray PHP, new passwords and keys |
| An admin user you never created | Account added during the break-in | Delete it, change every password, fresh keys |
| Host suspended the account for malware | Host's own scanner found the same code | Clean, then ask the host to rescan and lift it |
A clean-up like this is usually a few hours of careful work, most of it reinstalling and checking. If you would rather hand it over, that is what the box below is for. Related: a site stuck in a redirect loop, a login page that just reloads and a blank white page.