Quick answer
To request a Google security review: fully clean the site first, verify it in Google Search Console, open Security Issues, confirm you've fixed the problem, and submit the review request. If the site is genuinely clean, the warning is typically lifted within a day or two. Requesting a review before the site is clean will fail.
Key takeaways
- Clean the site completely before requesting a review — a premature request just fails.
- The Security Issues report in Search Console is where you submit the request.
- A genuinely clean site usually clears within one to two days.
Getting your site clean is only half the battle if Google is still showing a "this site may be harmful" warning. The warning is lifted through a security review — but the order matters, and a premature request just wastes time.
Step 1: Clean the site completely
Google will re-scan when you request a review. If any malware, backdoor, or cloaked spam remains, the review fails and the warning stays. Make sure the site is genuinely clean first.
Step 2: Verify the site in Search Console
You need Google Search Console access to request a review. Verify ownership if you haven't already.
Step 3: Open the Security Issues report
In Search Console, go to Security Issues. It will describe what Google detected — useful for confirming you've addressed everything.
Step 4: Confirm and submit
Once you've fixed the issues, check the box confirming the problem is resolved and submit the review request. For a clean site, the warning is usually gone within a day or two.
If it keeps failing
Repeated rejections mean Google still sees something — often a cloaked hack or a leftover backdoor. That's the point to do a deeper, server-level cleanup before trying again.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Follow-up questions
People also ask
For a genuinely clean site, typically a day or two after you submit the request in Search Console. If the malware is still present, the review fails and the warning stays.
Keep reading
How to Detect and Remove a Credit-Card Skimmer in WooCommerce
A card skimmer quietly steals customer payment details at checkout. Here's how to detect and remove one from WooCommerce.
Website Suspended by Your Host? How to Get It Back Online
If your host suspended your account for malware, here's how to clean the site to their standard and get it reactivated.
How to Remove Hacked Spam Pages From Google Search
Hundreds of spam pages indexed under your domain? Here's how to remove them from Google and recover your search presence.