Nothing can be more harmful to a website, and hence to the business that owns it, than having good old Google Inc. assume (be it correctly or otherwise) that your website harbors malware or has some suspicious activities going on in the background.

As soon as they sense something fishy about your site, you will be alerted via email that your site has been compromised (especially true if you subscribe to Google apps like AdSense or use their webmaster tools). They will offer you a chance to redeem yourself by cleaning your website out (whatever way you choose to do it, they don’t care) – and resubmit its link for reconsideration. This process will loop until you get it right and they say you are now malware-free.

The next thing you will notice after the email notifications is that your website will start to lose traffic almost immediately. If it is a revenue-generating site (through ecommerce or even just advertisement) you will also see your income and revenues dropping – fast!

The reason is that Google has dropped your ranking and is slowly burying your site so deep that you will never be found any time soon.

Finally, if things go on for long enough, Google will assume that your site was built for the sole purpose of attacking and/or harming people and start placing a warning page whenever visitors try to access your site – those that can find it, that is. Although it may seem like a harmless hindrance, there is almost no way anyone will click on a link that is underneath a message that is akin to, “Please proceed at your own risk: the page you are about to go to is full of malware and could really hurt you. But, if you want to… just click here and go to it.”

You can rest assured everyone is going to make an about-turn as fast as they can and leave you in the wake of their dust.

So, what do you need to do when Google has flagged your website for malware? Here is what:

1. The first thing you need to do is to stop panicking and find out if you really have been singled out as a malware site. A good way to do so is to have a go at Google’s own testing tool. Enter your website (both with and without the leading “www”) and click on the button.

If you receive the message “Not dangerous: Safe Browsing has not recently seen malicious content on [Your Website Link]” – then you can stop reading at this point and just go on with your life.

2. If on the other hand you get a message that reads: “Dangerous: [Your Website Link] is not safe to visit right now,” continue panicking until you’re sensible enough to proceed.
3. Ok, now that that is over, it is time to talk to your hosting providers. You need to report the flagging, let them know that you are bleeding traffic and money and things need to be resolved immediately.
4. You need to change your passwords immediately. Hackers need access to your website and they gain that by stealing your password. So, change all of them: your domain hosting password, your server password, even your local computer/laptop password should be changed.
5. While your hosting providers are dealing with the problem on their end, you should try and look for a clean copy (a recent back up will do) of your website and start testing it to see that it can be restored and will work as it is supposed to.

We should take the time here to remind you that this is exactly one of the reasons why you should always have a backup of your website.

6. With the backup secured (or concurrently while looking for the backup), you can start to go through the codes on your website to identify which page and what code is triggering the flagging. The usual methods of attack (where the hackers tend to attack you most) include modifying your site’s pages and inserting rogue code there, by putting the codes into your database tables, editing your .htaccess file and editing your HTML/JavaScript codes so that your site automatically redirects to another malicious website. They can also attack pages that are linked to your site (property “src=http://somewebsitelink” in HTML) and that can turn your site into a malicious site too.
7. Have your best people sift through the code line by line and get them to drop all and any code they find suspicious. Comb through the site at least thrice before you re-submit it for checking with Google.
8. Once you are sure you have got it all out you can request for a reconsideration of your website.
9. If the results are still the same (you are still infected and remain flagged), you have two options: either go through the code again (until you think you have cleared it) or,
10. Restore your backup and hope it was from the time before you were infected or hacked. Otherwise, it is back to the drawing board for you: build your site from ground up.

Good luck!