Someone searches for your business name and the results underneath your domain are for discount pills, online casinos or replica handbags. Your home page still loads normally. Your WordPress dashboard shows nothing new. Yet Google clearly believes your site hosts hundreds, sometimes thousands, of pages you never wrote.
That is SEO spam, and it is one of the most common reasons owners come to us. It belongs to the wider group of problems we cover on our hacked website repair and emergency help page, but it needs its own kind of attention, because the damage is spread across two places at once: your server and Google’s index.
Why an attacker wants your site for spam
Spammers cannot easily get a brand-new domain to rank. Your domain already has a history, links from real sites and some trust in Google’s eyes. By placing their pages on it, they borrow that standing for products and sites that could never earn it themselves.
The money is in the traffic. Each spam page either links out to the attacker’s shop or forwards visitors there. Your site is just the vehicle, which is why the attacker works hard to keep you from noticing anything.
The three shapes SEO spam takes
Not every infection looks the same, and the cleanup depends on which kind you have. Often a site has more than one.
Generated pages that do not exist in WordPress
A script on the server answers requests for made-up URLs with freshly built spam. Nothing is saved as a post, so the Pages screen in WordPress stays empty of it. Rewrite rules in .htaccess or a modified index.php route those URLs to the script. The Japanese version of this is common enough that we wrote a separate explainer on how the Japanese keyword hack works and how to spot it.
Spam injected into pages you already have
Here the attacker edits your real content. Drug names appear in a page title only Google sees, a paragraph of casino links sits inside a hidden div, or the meta description of your services page is rewritten. This version usually lives in the database rather than in files, so a file scanner alone can miss it.
Hidden outbound links
The quietest form adds a handful of links to other sites, styled so a visitor cannot see them. There may be no new pages at all. The only clue might be a jump in outbound links in an SEO tool, or a manual action from Google for unnatural links.
Cloaking is what keeps it hidden from you
Most SEO spam scripts check who is asking before they decide what to send. A request that looks like Googlebot gets the spam. A request from a logged-in administrator, or from a browser with no search referrer, gets your normal site. Some scripts also look at the visitor’s country or device.
This is why owners are often told by a customer or a competitor before they see it themselves. It is also why a cleanup has to be checked from Google’s point of view, not just from your own browser. The URL Inspection tool in Search Console, run as a live test, fetches a page the way Google does and is one of the most useful checks we have.
How we approach an SEO spam cleanup
Our work runs in a fixed order, because doing it out of order wastes effort. Cleaning up Google’s index while the spam generator is still running just means the pages come straight back.
First, a backup and a snapshot of what Google sees
Before anything is changed, we take a full copy of the files and database. Then we record a sample of the spam URLs, the queries showing in Search Console and what each URL returns today. That record lets us prove, later, that every one of them now returns a “not found” or “gone” response.
Then the server side
We trace how spam URLs are being served, follow the rewrite rules or the code path to the script that builds them, and remove it. We go through the database for injected titles, links and hidden blocks. Because the generator is rarely the only thing the attacker left, this stage also includes the hunt for the way they get back in, which we describe in more depth on our WordPress backdoor removal page.
Then Search Console
Attackers who run spam campaigns often verify themselves as owners of your Search Console property, so they can submit sitemaps of their own pages. We check the list of owners and users, remove anyone who should not be there, and remove the verification token they used. If the token is left in place, they can simply verify again.
Finally, the index
Once the site itself is clean, the remaining job is getting Google to drop the spam URLs and recrawl your real pages. That stage is its own piece of work, and we cover it in detail on the removing hacked pages from Google page. In short, spam URLs need to return a 404 or 410, your sitemap needs to list only real content, and a review request goes in if Google has flagged the site.
What you can do right now, before anyone touches the site
A few things help, and a few things make the cleanup harder. If you have just found spam under your domain, this is where to start.
- Take screenshots of the search results. A
site:yourdomain.comsearch, plus one with a spam word added, shows the scale of the problem and gives us examples to test. - Look at Search Console, but do not delete anything yet. Note any owners, users or sitemaps you do not recognise. Removing them is right, but do it as part of the cleanup, so the attacker does not notice early and dig in deeper.
- Do not redirect all the spam URLs to your home page. It feels tidy, but Google tends to treat that as a soft 404, and the spam can linger longer.
- Do not block the spam URLs in robots.txt. If Google cannot crawl them, it cannot see that they are gone.
- Do not restore an old backup on its own. If the backup is from after the break-in, the generator comes back with it. If it is from before, the hole that let the attacker in is still open.
- Change your passwords from a clean device. Hosting panel, WordPress admins, FTP or SFTP, and the email account that receives password resets.
If the Security Issues report in Search Console already lists hacked content, our guide to reading the Security Issues report and Manual Actions explains what each entry means and which ones need a review request.
Rankings after the spam is gone
Owners usually ask whether their real pages will recover. The honest answer is that it depends on how long the spam ran, how much of it Google indexed and whether there was a manual action. Removing the spam stops further damage. It does not instantly restore what was lost, and no one can promise a particular ranking afterwards.
What helps is a clean, fast, accurate site that Google can crawl without hitting spam at every turn. Our post on getting traffic back after a website hack covers what to watch in the weeks after a cleanup and what is worth doing to speed things along.
How SEO spam usually gets in
We look for the entry point on every job, because cleaning without closing it invites the same campaign back. On WordPress sites, the usual suspects are an outdated plugin with a known flaw, a pirated “premium” theme or plugin, a reused or leaked password, or another site on the same hosting account that was already infected and spread across.
Spam campaigns are also patient. Some attackers create the pages slowly, a few at a time, so the change in Search Console looks gradual. Others wait weeks after the break-in before switching the spam on. Either way, the date you noticed is rarely the date it started, which is why we read back through file dates and logs where the host keeps them.
When the database is part of the problem
Pharma and casino spam that rewrites your existing titles and descriptions often sits in the database, inside post content, SEO plugin fields or theme settings. A careless search-and-replace in the database can break serialized settings and take parts of the site down with it. When the spam is spread through many tables, the work overlaps with our hacked WordPress database cleanup service, and we treat it with the same care.
Getting help
If you would like us to look, message us on WhatsApp and start the message with the word HACKED, so it is picked out from routine requests. Send your domain and, if you can, one of the spam search results. We will look at what is visible from the outside, tell you plainly what we think is going on and when we can start, and keep you updated on WhatsApp as the work moves. If the site has other symptoms too, such as redirects or a Google warning, our WordPress malware removal service covers the full cleanup, and the spam work fits inside it.