Google has flagged my site / my host suspended it.

What you’re seeing

Google says your site may be harmful, your host has suspended it, visitors are being redirected somewhere strange, or unfamiliar pages have appeared in search results. You might also see new administrator accounts, security warnings, modified files or a sudden spike in server use. Sometimes the website simply stops loading and the first clear explanation comes from the hosting company.

A hacked site is stressful because it affects both the business and the people visiting it. The priority is to contain the problem, preserve useful evidence and restore a site you can trust—not just make the warning disappear for a day.

What usually causes it

The common entry points are vulnerable or abandoned plugins and themes, stolen passwords, outdated WordPress installations and hosting accounts that were never secured properly. Once inside, an attacker may add hidden administrators, scheduled tasks, database content or backdoors across several files. Removing the first suspicious file you notice is rarely enough.

Search-engine warnings and host suspensions are symptoms. If the original access path and persistence mechanisms remain, the malware can return after the site is switched back on. Shared hosting can add another complication because multiple sites or old copies may sit in the same account.

What I’d do

I begin by taking the affected site out of harm’s way where possible and making a protected copy for investigation. I review WordPress users, plugins, themes, core files, uploads, configuration, scheduled jobs and the database. I compare replaceable software with clean upstream copies and inspect custom files rather than deleting them blindly.

The clean-up removes malicious code and unauthorised access, updates or replaces vulnerable components, rotates relevant credentials and hardens the practical weak points. I also check other sites in the same hosting account when they could reinfect the one we are repairing. Before relaunch, I test the public site and its important forms or transactions.

I explain the scope and price before remediation begins. A contained infection may be cleaned in a day; a large, old or repeatedly compromised setup needs more investigation. Google review and host reinstatement operate on their own timelines, so I cannot promise when a third party will clear a warning, but I can prepare the evidence, request the appropriate review and respond to follow-up checks.

Afterward, you receive a plain-English summary of what was found, what changed and what needs monitoring. Backups, updates, least-privilege accounts and basic uptime or security checks are put in sensible order.