What Happens to Your Rankings After the Cleanup

By Glenn Lyvers · Updated September 20, 2026 · 4 min read

The hard part is over. The malware is gone, the warnings are cleared, the site is secure. And your traffic is still a fraction of what it was, which is a peculiarly demoralizing place to be — you have done everything right and the scoreboard has not noticed. Here is what is actually happening, and what the honest timeline looks like.

What the hack actually damaged

It helps to separate the causes, because they recover at different speeds. A browser or search warning on your listing destroys click-through rate almost completely while it is showing, but the moment it clears, that effect ends — those clicks come back immediately because your position never changed.

Ranking loss is different. If spam pages diluted your site, if cloaking made Google see something other than your real content, or if a manual action was applied, your actual positions moved. That takes re-crawling and re-evaluation to undo. And a third category is indirect: pages that went missing or returned errors during the incident may have been dropped and need rediscovering.

The honest timeline

Warnings and blacklist entries clear within days of a successful review, and the traffic effect of that is essentially immediate. Manual actions take a reconsideration request plus review time — several days to a couple of weeks — and then recovery begins from there rather than completing at that moment.

Position recovery is the slow part, typically noticeable within two to four weeks and substantially complete within one to three months. What drives the variation is mostly duration: a hack caught in a week recovers faster than one that ran for six months, because the longer it ran, the more Google re-evaluated your site on the basis of what it was seeing.

What normal recovery looks like

It is gradual and uneven rather than a single step change. Impressions usually return before clicks and positions climb in stages, with your strongest pages recovering first because they get crawled most often. Long-tail pages lag, sometimes by weeks, purely because Google visits them rarely.

Watch impressions rather than traffic in the early weeks — impressions tell you Google is showing your pages again, which is the leading indicator. Clicks follow. A steady upward line with ordinary weekly variation is exactly what success looks like, even when the absolute numbers are still disappointing.

When it is not recovery, it is a problem

Some signs mean something is still wrong rather than still slow. Impressions flat at the floor after a month. Spam URLs still appearing in a site search weeks after cleanup. A security warning that returns. The indexed page count rising again. Any of those means the cleanup is incomplete or the site has been reinfected.

Use the URL inspection tool to see what Google is actually fetching from a few key pages — that single check resolves most doubt, because it shows you the real served content rather than what you see logged in. If it does not match your pages, you have a live cloaking problem, and if spam URLs persist, removing them from the index is the next job.

What actually speeds it up

Not much, honestly, and that is worth saying plainly because the internet is full of people selling the opposite. What genuinely helps: making sure the cleanup is complete so no further damage accumulates; submitting a correct sitemap and requesting indexing for your most important pages; getting any manual action lifted promptly via a good reconsideration request; and making sure deleted spam URLs return proper 404s.

What does not help: republishing content to look fresh, rebuilding the site, buying links, or making structural changes in the hope of triggering a re-evaluation. Changing things during recovery mostly makes it harder to tell whether recovery is happening.

The part nobody wants to hear

Most of this is waiting, and the waiting is genuinely the work. The sites that recover worst are usually the ones whose owners kept intervening — rebuilding, restructuring, redirecting, chasing advice — because each change resets the clock on Google's re-evaluation and adds noise to a signal you are trying to read.

Clean it properly once, fix the signals, submit what needs submitting, then monitor and leave it alone. If you are a month in with no movement at all and you cannot tell whether that is patience or a missed backdoor, that is the right moment to have someone verify the site is genuinely clean — which is what my malware removal service does.

Common questions

How long until my rankings come back?

Most sites see noticeable improvement within two to four weeks of a complete cleanup, and substantial recovery within one to three months. The biggest factor is how long the hack was live — a compromise caught quickly recovers much faster than one that ran for months.

My traffic is still down a month later. Is something wrong?

Not necessarily, but it is worth checking rather than assuming. Look at impressions rather than clicks: if impressions are trending up, recovery is underway. If they are flat at the bottom, or spam URLs still show in a site search, the cleanup is probably incomplete.

Will I get all my rankings back?

Usually most of them, and often all. Search engines are reasonably forgiving toward compromised sites that get cleaned properly, because being hacked is not the same as being a spammer. Permanent loss is uncommon and tends to follow very long-running infections or repeated reinfection.

Should I rebuild the site to recover faster?

No. Rebuilding introduces a large set of new variables — changed URLs, changed content, changed structure — at exactly the moment you need a stable site for Google to re-evaluate. It usually slows recovery rather than accelerating it, and it makes diagnosing any remaining problem much harder.

Does it help to request indexing for my pages?

For your most important pages, yes, modestly. It encourages a crawl sooner than might happen naturally. It does not override Google's evaluation of the page, so it accelerates discovery rather than manufacturing rankings, and doing it for a handful of key URLs is more useful than doing it for hundreds.