Hacked content is confirmed harm: affected pages "can appear with a warning label in search results or an interstitial warning page in the browser", and Google may remove a site entirely. On November 30, 2018 even Search Engine Land vanished from Google for over 12 hours when Google's hacked-site detection misfired. After cleaning up, choose Request Review in Search Console 1 's Security issues report. Injected spam is often served only to Google, so check with the URL Inspection tool or a crawler-like request:
curl -s -A "Googlebot/2.1 (+http://www.google.com/bot.html)" \
-e "https://www.google.com/" https://example.com/ | grep -icE "casino|viagra|loan"A non-zero count on a site that never uses those words signals injected content; see web.dev/articles/hacked (https://web.dev/articles/hacked 2,379 ).