: Website marked as "may be hacked" by google My website is marked by google as "may be hacked". Through the admin panel of google search console, I see several links that are list as "URL

@Harper822

How does google determine these pages are compromised if there are no malicious code can be found from both my browser or google's "fetch as google"?


Google may be using a separate IP address that is not the same as that used when the "fetch as google" operation is performed. For example, someone actually working at google might be randomly manually scanning your page and could find something different.


How does the hackers take advantage of these "injected URLs" if there are no actual malicious content or script on them? Or is the malicious content/script only visible to some certain people(not including me obviously)?


The latter. Your server is programmed to deliver different content based on IP address and/or group of IP addresses. Look for configuration files like .htaccess if you have apache and remove any lines that look like IP addresses. You want to serve the same guest content to all guests to your site.

Also, check the opencart PHP code and look for anything in there that would cause different content to load based on remote IP address. It's likely that your .htacccess or the PHP code itself is modified to the hackers needs.

Vote Up Vote Down