Filing a Reconsideration Request After a Hack

By Glenn Lyvers · Updated September 20, 2026 · 4 min read

There is a difference between an algorithmic problem and a manual action, and it matters enormously. An algorithmic issue resolves itself once the cause is gone. A manual action means a person at Google reviewed your site, decided it violated the guidelines, and applied a penalty that stays in place until another person decides to remove it. Cleaning the site does not lift it. You have to ask.

First, confirm you actually have one

Open Search Console and look at the Manual Actions report. If it says no issues detected, you do not have a manual action, and no reconsideration request is needed or possible — whatever you are seeing is algorithmic or a browser-level warning, and both clear on their own once the site is clean.

If there is an action listed, read exactly what it says. The common ones after a hack are hacked content, pure spam, cloaking and sneaky redirects, and user-generated spam. Note whether it is site-wide or partial, because that tells you the scope of what you need to fix and what to describe. It is a genuinely different report from Security Issues, which is worth understanding — my guide on Search Console security issues covers that one.

Do not file it early

This is where most people lose weeks. A reconsideration request submitted while any part of the problem remains gets rejected, and a rejection costs you far more than the day you would have spent being thorough — reviews are handled by people, they take days, and repeated failed attempts do nothing for your credibility.

So finish the job first. Every spam page gone and returning proper 404 or 410 responses. Every injected script removed from files and database. Every backdoor, rogue admin account and persistence mechanism found. The entry point closed and credentials rotated. Then verify from outside, ideally with the URL inspection tool, so you know what Google actually sees rather than what you hope it sees.

What to actually write

Google's reviewers read a great many of these, and the ones that succeed share a shape. Be specific and factual. State what the problem was, how it happened, exactly what you did about it, and what you changed so it will not recur. Concrete detail is persuasive in a way that reassurance is not.

Something like: the site was compromised through an outdated plugin, which allowed an attacker to publish roughly four thousand spam pages in a subdirectory and inject a redirect into the theme header. The spam pages have been deleted and now return 410. The injected code has been removed from the theme and from two wp_options rows. Two administrator accounts that were not created by us have been deleted. All plugins and core have been updated, all passwords and salts rotated, and two-factor authentication enabled. That is a request a reviewer can act on.

What gets a request rejected

Vagueness above all. We have cleaned the site and believe the issue is resolved tells the reviewer nothing they can verify and reads exactly like every request from someone who has not actually fixed anything. Equally unhelpful is a request that is still true only in part, because the reviewer will find the page you missed.

Also avoid arguing, blaming a previous developer at length, pleading about business impact, or submitting repeatedly while you wait. None of it helps and the last one actively hurts. And do not file before the site is clean in the hope that it will be clean by the time they look.

After you submit

Expect days rather than hours — often several, sometimes a couple of weeks for complex cases. You will get a message in Search Console confirming receipt and later a decision. Do not resubmit in the meantime; it does not accelerate anything and duplicate requests get queued behind each other.

If it is accepted, the manual action is removed and rankings start recovering as Google re-crawls. That is not instant either, and my guide on ranking recovery after a hack covers the realistic timeline. If it is rejected, the response usually indicates what remains — treat that as useful information rather than a verdict, fix what they found, and resubmit.

When to get help

The honest test is whether you can state, specifically, what happened and what you did about it. If you can, you are ready to write the request. If your answer is that you ran a security plugin and it says the site is clean now, you are not ready, because that is not a description of a cleanup — it is a description of a scan.

A rejected request is recoverable but expensive in time, and for a business site the ranking loss while you iterate is usually the largest cost of the whole incident. Getting the cleanup genuinely complete before the first submission is worth real effort, and it is exactly what my malware removal service delivers — including the specifics you will need for the request itself.

Common questions

How do I know if I have a manual action?

Check the Manual Actions report in Search Console. It either lists an action with a description and scope, or states that no issues were detected. If it is clear, no reconsideration request is needed — whatever you are experiencing is algorithmic or a browser warning, and both resolve without human review.

How long does a reconsideration request take?

Typically several days, sometimes up to a couple of weeks for complicated cases. There is no way to expedite it, and resubmitting while you wait does not help — duplicate requests simply queue behind each other and can extend the wait.

What if my request is rejected?

The response usually indicates what is still wrong, which is genuinely useful. Treat it as a findings report rather than a final answer: fix what they identified, verify properly, and submit again. Most sites that get rejected once are approved on the second attempt after addressing the specific gap.

Is a manual action the same as a security warning?

No, and they are reported separately. A security issue concerns malware or deceptive content and is often flagged automatically; a manual action is a human decision that your site violates the guidelines. A site can have one, both, or neither, and each needs its own review request.

Will my rankings come straight back once it is lifted?

Not instantly. The penalty is removed, but Google still has to re-crawl and re-evaluate the site. Most sites see meaningful recovery within a few weeks of the action being lifted, with the pace depending on how long the problem ran and how much of the site was affected.