Google’s March 20, 2017 website-security review reported three percentages that answer different questions. For 2016 compared with 2015, the company observed approximately 32% more hacked sites. That is a change in its observed count. It does not mean that 32% of websites were hacked, and it supplies no individual site’s chance of being compromised. [google-nohacked]

The 84% figure concerns webmasters who applied for reconsideration: Google said that share successfully cleaned their sites. Applicants are a selected group, not every owner of a compromised website. The statement therefore cannot establish a general recovery probability. It also does not tell an operator how long cleanup would take or what it would cost. A separate caution concerns the work itself: in March 2013, Google warned that recovery tasks were difficult without advanced knowledge of administration commands and experience with source code. That qualitative warning neither explains who applied for reconsideration nor changes the population counted by the 84% figure. [google-nohacked][google-hacked-recovery-2013]

The third figure, 61%, refers to hacked webmasters who did not receive a Google infection notice because their sites were not verified in Search Console. Its subject is notification within that reported population. It is neither a count of all unprotected websites nor evidence that every other notification route failed. [google-nohacked]

For a briefing, our editorial suggestion is a denominator table with three rows: observed hacked-site counts across two years; reconsideration applicants and successful cleanup; hacked webmasters and missing Google notices. Add columns for source and unavailable information. The post provides neither the underlying sample sizes nor a basis for treating these groups as globally representative. Keep the figures attributed to Google, not an independent survey, and do not combine them into a single risk score. [google-nohacked]

Source documents

  1. #NoHacked: A year in reviewhttps://developers.google.com/search/blog/2017/03/nohacked-year-in-review
  2. New first stop for hacked site recoveryhttps://developers.google.com/search/blog/2013/03/new-first-stop-for-hacked-site-recovery