What does the Security Issues report show?

The Security and Manual Actions > Security issues report lists cases where Google believes your site is hacked or is serving content harmful to visitors. An empty report is the normal state, and it is one of the few reports worth checking even when nothing looks wrong.

The categories

• Hacked content - content injected into existing pages, spam pages added to directories you never use, or text and links hidden with cloaking.
• Malware and unwanted software - files that install software the visitor did not ask for.
• Social engineering - phishing pages, fake download or update buttons, and deceptive third-party ads.
• Harmful or uncommon downloads - files flagged by Google Safe Browsing.

What it costs you

Unlike a ranking problem, this one is visible to users immediately. Chrome and other browsers show a full-page interstitial warning, results may be labelled in Search, and traffic can fall to near zero in a day. A security issue is not the same as a manual action, which is a policy penalty applied by a human reviewer, though a site can have both.

Working through one

1. Open the report and read the sample URLs. They are examples, not the full list.
2. If active malware is being served, take the site offline or into maintenance mode first.
3. Find the entry point: outdated CMS or plugin versions, stolen FTP or admin credentials, a compromised server or a hijacked third-party script.
4. Clean every instance, including database content, .htaccess rules, cron jobs and uploaded files. Restoring a known-clean backup is usually faster than hunting.
5. Rotate all passwords, API keys and access tokens, and patch what was exploited.
6. Click Request review and describe what happened, what you fixed and what stops it recurring. Reviews typically take a few days, and a review that finds remaining infected pages fails and has to be repeated.

Tip: you need owner or full-user access to request a review, and the request needs the fix to be live first. Requesting a review while infected pages are still reachable is the most common reason a site stays flagged for weeks.

Search Console does not expose this report through its API, so it has to be checked in the interface or watched through email notifications, which is why keeping a monitored address on the property matters.