SEO Spam Hack: Finding and Removing Injected Pages on WordPress

An SEO spam hack means someone got into your WordPress site and stuffed it with spammy pages, links or text. The fix, in short: find every injected page, delete it, close the hole the attacker came through, then ask for a review in Google Search Console. How do most owners find out? Usually it’s strange URLs showing up under their domain in Google, or a warning landing in Search Console. And all the cleanup happens on your own WordPress install and origin server. Nowhere else.

What does an SEO spam hack look like on a WordPress site?

It adds spammy links or text to your site. Often it’s pharma keywords or some other junk that has nothing to do with what you actually write about. Sometimes it shows up as brand-new pages, sometimes it’s tucked inside pages you already have. You’ll mostly run into two flavours:

• Japanese keyword hack: auto-generated pages written in Japanese that sell goods and sit under your domain.
• Cloaked keywords hack: pages that show spam to search engines and normal content to visitors, so a quick look in your browser can suggest nothing is wrong.

The injected code can sit in plain HTML files or in the files that build your pages, like PHP. How do they get in? Very often through a hole in outdated software. An old WordPress version is the classic example.

How to confirm spam pages in Google results and Search Console

Three checks do most of the work: the Security Issues report, a site:yourdomain.com search, and fetching suspect pages to look for content you never put there. Go through it like this:

1. Open the Security Issues report and write down the example URLs.
2. Search [site:example.com] on Google to list indexed pages you never created.
3. Fetch pages and search the responses for spam terms such as “viagra” or “earn money”.
4. Open the URL Inspection tool to see pages the way Google sees them.

Don’t skip that last one. With cloaked spam, your own browser may get a perfectly clean page while Googlebot gets the garbage. Sneaky, right? Google’s Security Issues report documentation walks through every issue type the report can flag.

Where injected pages hide on WordPress and your origin server

The usual hiding spots: theme and plugin PHP files, extra files dropped into the web root, the database, and server config. I’d start here:

• files modified recently, especially outside your own update dates
• PHP files you do not recognise
• admin users you never created
• rewrite rules in the server configuration that send spam URLs somewhere unexpected

Your access logs saw it all happen. Every request that created or served the spam is in there, so dig for suspicious requests in server logs around the dates the pages first appeared. One catch, though. Behind a proxy, the logs may only show the proxy’s address unless you restore the real client IP (and that’s the only way you’ll ever trace attacker IPs behind a proxy). Google is pretty blunt that malware cleanup needs someone who can read code and web server configuration. Not your thing? No shame in it. Get someone who can.

Hacked site cleanup: removing the SEO spam hack step by step

The order goes: back up as evidence, rip out every injected file and page, close the vulnerability, change credentials, check again. Like so:

1. Back up the files and database as they are now, so you keep a record of the attack.
2. Remove the spam content and every injected file.
3. Update WordPress core, themes and plugins.
4. Reset the passwords for WordPress admins, hosting, FTP and the database.
5. Check again with a site: search and the URL Inspection tool.

Clean the whole site. All of it. Fixing some pages won’t get you a partial comeback in search results, that’s not how it works. Restoring from a backup with a proxy in front? Then check the site URL and redirect settings afterwards, because WordPress configuration behind proxies slips out of sync after a restore more often than you’d think.

Requesting a review in the Security Issues report

Only once the entire site is clean, request a review in the Security Issues report and spell out exactly what you fixed. Be specific. According to Google’s help page on security issues, a review can take anywhere from a few days to a few weeks. Bought the site recently and inherited the mess? Say so in the review request, and confirm it now follows Google’s spam policies. After the review, keep watching Search Console and your site: results. If spam pages come back, the door is still open somewhere.

What a reverse proxy does and does not change after a hack

A reverse proxy changes the route traffic takes to your origin. That’s it. The spam, the vulnerability and the cleanup all still live on your WordPress install. Injected PHP files, rogue admin accounts, a stale plugin - none of that cares whether there’s a proxy in front, and that’s exactly what a proxy cannot fix. Jalvo is an NGINX reverse proxy with EU and USA IP addresses, with a panel for pointing domains and IP rotation for your domains on sites you run.

Staying clean after an SEO spam hack is mostly boring routine. Keep WordPress and its extensions updated, look at the Security Issues report regularly, and keep running those site: searches so you spot new spam pages before your visitors do.

FAQ

Read also:

• Broken Backlinks: How to Reclaim Links Pointing to Dead Pages
• Reverse Proxy Caching and SEO: No Stale Pages for Crawlers
• Back Button Hijacking: Google's New Spam Policy Is Now Enforced
• Google Spam Reports Can Now Lead to Manual Actions