How I recovered a hacked site after Google flagged it for phishing

In late 2023 I took back a client site that Google had flagged for serving injected phishing pages. It was still online. That was part of the problem: every visitor who typed the address in got a full-screen browser warning telling them the site was dangerous.

I disinfected it, rebuilt it, and the organic keyword footprint recovered 9.7 times over from its floor to roughly 80% of the site’s all-time peak. Those are third-party estimates.

What Google actually said

On 14 July 2023, Search Console sent this:

Social engineering content detected on https://itsdone.com.au/. Google’s Safe Browsing systems have detected that some pages on your site might be hacked. To protect your site’s visitors, affected pages have been demoted in Google’s search results, and browsers such as Google Chrome now display a warning when users visit your site.

The sample URL Google supplied was /action/MyGov/. An injected MyGov phishing page, on a Melbourne rubbish removal site.

Google’s classification was social engineering, its category for deceptive and phishing content.

Three consequences, each worse than the last

The demotion was the least of it.

1. Affected pages were demoted in search results.
2. Chrome showed an interstitial warning, so even people typing the address in directly were stopped at the door.
3. Direct traffic died with it. On a local services business that is the traffic least likely to forgive you: these are people who already knew the name, typed it in, and were told by their browser to turn back.

The third point is the one that decides the order of the work. A browser warning attached to the business name is not a ranking problem, and no amount of SEO reaches it, so the warning has to go first.

The state I inherited

The decline did not start with the hack. It started about eleven months earlier, in August 2022, while the site was under other management. What caused it is outside the scope of what I picked up and I am not going to speculate about work I did not do.

What I can describe is the condition of the thing when it landed on my desk:

When	State (keyword counts are DataForSEO estimates)
July 2021	All-time peak, 689 organic keywords
February 2023	Homepage returning HTTP 500
June 2023	82 keywords
14 July 2023	Safe Browsing notice
August 2023	Floor: 57 keywords
October 2023	Chrome still warning visitors away
November 2023	I take over. 63 keywords

Keyword counts here are DataForSEO estimates, not measured traffic. I label them every time, because the difference between an estimate and a measurement is the difference between a claim and evidence.

What the recovery took

Disinfect, then rebuild, then re-earn the crawl. In that order, and the order is not negotiable. Requesting a review before the injected pages are actually gone burns the review, and the queue gets slower each time you waste one.

The site was serving HTTP 200 again by December 2023. A new homepage shipped in March 2024.

When	Keywords (DataForSEO estimate)	What was happening
November 2023	63	Handover
December 2023	not yet indexed	Back to HTTP 200
January 2024	116	Disinfection and rebuild underway
March 2024		New homepage live
May 2024	209	Recovery accelerating
December 2024	484
June 2025	554	Recovery peak

From the August 2023 floor of 57 to the June 2025 peak of 554, that is a 9.7x recovery in keyword footprint over 22 months, reaching roughly 80% of the site’s all-time high. Third-party estimate, as above.

The shape is the part worth looking at rather than the endpoints. The line is flat for the first three readings after the floor, which is the nine months below, and only then starts climbing.

Eighty per cent, not the full peak. It is worth stating precisely, because a recovery quoted as complete is the kind of claim that falls over the first time somebody checks it.

Keyword counts are a third party’s estimate of visibility, though, so here is the same period in first-party GA4, measured, filtered to Australian users and to organic search. Lead definitions and the filtering come from the reporting pipeline I built for this client:

Australian organic, monthly average	Sessions	Leads
Oct to Dec 2023, the trough	34	14
Apr to Jun 2025, the peak	182	49

Sessions up 5.3 times and leads up 3.5 times, on data the business owns rather than a model of it. Two independent sources, one estimated and one measured, moving the same way over the same months is a good deal more convincing than either on its own.

Search Console cannot corroborate this one. It holds sixteen months, so the whole recovery has aged out of it, and August 2023 now returns nothing at all. Worth knowing before you promise a client a long-run recovery chart from it.

How long recovery actually takes

Handover was November 2023 and the site was technically healthy again in December, but organic did not move meaningfully until May 2024. Nine months between fixing the problem and seeing the result.

That gap is the number to give a client at the start. Disinfection, rebuild and re-crawl are the fast part; earning the rankings back is measured in quarters, and a recovery promised inside one quarter is a second quarter spent explaining yourself. Knowing that up front is what lets you set an expectation you can actually meet, which is most of the job on work like this.

A year later I rebuilt the same site for conversion, which doubled its organic traffic and its leads: how I rebuilt a rubbish removal site and doubled its organic traffic.