Google says "This site may be hacked"

Google found pages on your site that you probably did not put there, often spam pages for pills, casinos or fake shops. It warns searchers until the pages are gone and you ask for a review.

What to do, in order

1. Search Google for site:yourdomain.com. Look for pages in other languages or about things you do not sell. Those are the injected pages.
2. Change every password. Hosting, FTP, the site admin, and the database. Remove admin users you do not recognise.
3. Clean the files. On WordPress, update the core, every plugin and theme, and delete plugins you do not use. Look for recently changed files in the theme and uploads folders. If you have a clean backup from before the hack, restoring it is faster.
4. Check .htaccess and the root folder for redirect rules and odd PHP files that you did not add.
5. Ask Google to review. In Search Console, open Security issues, confirm you fixed it, and request a review. It takes days, not hours.

If it still fails, send me the address and I will tell you which step is broken.

Want the rest of your site checked after it is back? Run a free 40-point check at tinkeraudit.com.