What does the Security Issues report show?

The Security Issues report lists problems Google has detected on your site that could harm visitors or that point to a break-in: hacked content, malware or unwanted software, and social engineering such as deceptive pages. Affected pages can carry a warning label in search results or a full-page warning in the browser. When nothing is wrong, the report shows a green check mark. After cleaning up, you ask for a review from the same report.

The issues it can list

Google's Security Issues help groups them into errors and warnings:

Each issue comes with sample URLs, which are only part of the affected list. Uncommon downloads don't keep your pages out of Google Search, although Chrome may warn people before they download the file.

What visitors see

Search results can show a warning label, and browsers can show a warning page before your site loads; with malware you will probably see a "Dangerous" warning in the address bar. Google adds that you may not be able to reproduce the warnings yourself, and that the report is the source of truth.

Cleaning up and requesting a review

1. Read each issue and open its sample URLs to learn what was changed or added.
2. Fix the problem everywhere on the site. Google says fixing only some pages won't bring a partial return.
3. Close the way in: update the CMS, plugins and themes, remove admin accounts you don't recognise, and change passwords and keys.
4. Click Request Review in the report and explain the issue, what you did and the result.
5. Wait for the decision. Google confirms the request and emails you when the review is complete. For malware, hacked and deceptive content, a review takes from a few days to a few weeks.

Don't send another request before you have a decision. Google warns that repeated early requests can slow your review and can get a site treated as a repeat offender.

Security issues versus manual actions

They are separate reports. Security issues cover hacking and behaviour that harms users; manual actions cover attempts to manipulate Google's index, applied by a human reviewer. If your traffic fell and only one of the two reports shows a problem, start there.

How AutoPSEO helps

The Search Console API has no endpoint for security issues, so AutoPSEO can't read this report; keep Google's email notifications going to someone who reads them. AutoPSEO helps you notice the side effects. New and lost rankings lists the queries and pages that started ranking between two periods, where unfamiliar URLs from an injection hack stand out, and alerts post to Slack, Teams or a webhook when clicks drop or spike past your threshold.