Has your hotel website been hacked? Signs, what to do and how to get Google to remove the warning

Updated: 10 November 2026

A red Google warning in front of your website, strange links in search results or a booking engine that stops working: that is often how a hotel finds out its website has been hacked. Every day with a warning means lost direct bookings. This guide sums up what we could check on 10 November 2026 in Google's help pages, at INCIBE and in the text of the GDPR, and clearly flags what we could not confirm. We do not recommend any paid service.

The short answer

The essentials:

Check the Security issues report in Search Console: that is where Google tells you if it has detected hacked content, malware or social engineering (phishing).
Clean the site, close the hole the attackers used, and only then request a review from that same report.
Google says a review can take from a few days to a few weeks; if the site is clean, browser and search warnings are removed within 72 hours.
In Spain, INCIBE's 017 line is free and confidential, 8:00 to 23:00 every day, businesses included.
If customer data may have been exposed, the GDPR (art. 33) sets a 72-hour deadline to notify the data protection authority.

Signs your website has been hacked

What Google describes:

A full-page warning in the browser before visitors reach your site, or a warning label next to your site in Google results. Google describes both in its Security issues report help page.
Pages you never created (for example selling products or gambling) showing in Google under your domain: Google calls this hacked content.
Downloads that Chrome flags as harmful, or forms asking for information you never ask for (social engineering).
Practical signs, our tip: admin users you do not recognise, changes to your booking page or payment button, or guests saying your website redirects them elsewhere.

What to do in the first hours

Practical steps:

Change every password: content management system, web hosting, FTP, database, email and Search Console. Use strong, different passwords, as Google recommends.
Review the users in your content management system and hosting account and delete any you do not recognise.
Update the content management system (for example WordPress), the theme and plugins, and remove what you do not use: Google cites outdated software and third-party add-ons as ways in.
Restore a clean backup from before the hack and update everything again afterwards: if you restore without fixing the flaw, attackers can get back in.
Check your booking engine: make sure the Book buttons lead to your real engine and the payment page has not changed. If the engine comes from an external provider, tell them. Our tip.
Run an up-to-date antivirus on the computers used to manage the website: Google recommends securing those devices too.

How to get Google to remove the warning

According to Google's help:

Requirements: the site is verified in Search Console, the malicious content is removed, the vulnerability is fixed and the site is back online.
Check that your homepage and a page that was hacked now load clean and that Google can crawl them (no blocking and no noindex).
In the Security issues report, select Request Review and explain the issue, what you did and the outcome. Do not resubmit while a request is pending.
Timelines Google publishes: hacked with spam, up to several weeks; malware, a few days; phishing, about a day. If the site is clean, warnings are removed within 72 hours.

Guest data and the GDPR: the 72-hour rule

General information, not legal advice:

Article 33 of the GDPR says the controller must notify a personal data breach to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people.
If notification comes later, the reasons for the delay must be given.
If your booking engine or web provider processes data for you (as processor), art. 33 requires them to tell you without undue delay.
Each EU country has its own data protection authority. We have not reviewed their notification procedures: check their website or ask a professional. This is not legal advice.

Free help by country

What we could check:

Spain: INCIBE's 017 line, free and confidential, 8:00 to 23:00 every day; also WhatsApp 900 116 117 and Telegram @INCIBE017 (La Moncloa, 14 July 2026). It gives advice; it is not for filing complaints.
Italy: ACN's guide (July 2024) allows businesses that are not legally required to report to notify an incident to CSIRT Italia voluntarily through the form at csirt.gov.it/segnalazione.
Portugal: CERT.PT, hosted by the National Cybersecurity Centre (CNCS), covers Portuguese cyberspace and the .pt domain. We found no form for small businesses that we could read: not confirmed.
Greece: EL-CSIRT, part of the National Cybersecurity Authority, serves critical, essential and important entities; we have not confirmed that it serves a small hotel.

How iQuota helps

iQuota makes independent properties available to AI assistants with direct booking, payment at the property and 0% commission, with the price and terms each property sets. We cannot guarantee that an AI assistant will recommend you.

Want AI to give your real details, with direct booking and no commission? The first 30 hotels join free until 30 June 2027.

See the Founding Hotels programme

Frequently asked questions

How long does Google take to remove the red warning?

Google says a review can take from a few days to a few weeks (phishing about a day, malware a few days, spam up to several weeks). If the site is clean, warnings are removed within 72 hours.

Where do I request the review?

In the Security issues report in Search Console, once you have cleaned the site and fixed the flaw.

Is there free help?

In Spain, yes: INCIBE's 017 line, free and confidential, 8:00 to 23:00 every day. In Italy, CSIRT Italia accepts voluntary reports. For Portugal and Greece we did not confirm an equivalent for small businesses.

Do I have to notify the data protection authority?

If there was a personal data breach likely to put people at risk, art. 33 of the GDPR sets 72 hours. This is general information, not legal advice.

Do I have to pay a clean-up company?

Not necessarily. Google publishes the steps for free and requesting a review is free. If you cannot do it yourself, ask your web provider for help.

Sources

More guides for hotels

More guides for hotels →

Español · Italiano · Português · Ελληνικά