Cleaning up an SEO spam hack (Japanese, gambling or pharmacy spam)

An SEO spam hack adds hidden spam pages or links to your website to boost other sites in Google. Your site may look normal to you, but Google shows spam titles for it, often in Japanese, or about gambling, loans, pharmacy products or replica goods.

Signs of an SEO spam hack

• Search Google for site:yourdomain.com. You see pages you didn’t create, with spam titles or foreign text.
• Google Search Console shows a Security issues warning or lots of new pages you don’t recognise.
• Visitors from Google land on spam or are redirected to other sites, while visiting your address directly works fine.
• New, strange files in your website’s folders, or a new sitemap you didn’t make.

1. Scan and clean your files

1. Run a scan in Imunify360 and check Monarx Security in cPanel, and clean what they find. See Scanning for malware with Imunify360 and Monarx.
2. In File Manager, sort folders by Last Modified and look for recently changed files you didn’t touch, especially:
   • .htaccess files with redirects for search engine visitors
   • index.php, wp-config.php and theme files such as functions.php and header.php
   • PHP files in wp-content/uploads/, which should only contain images and documents
   • random file or folder names, and extra sitemap files

2. Clean WordPress

• Replace WordPress core files with fresh copies. See Restoring WordPress core files.
• Reinstall plugins and themes from their original source, rather than trusting existing files.
• Check Users and delete admin users you don’t recognise.
• Check the database for spam: in phpMyAdmin, search the wp_posts and wp_options tables for spam words or <script>.

3. Close the way in

• Update WordPress, all plugins and themes. Delete anything you don’t use.
• Change passwords for cPanel, WordPress, FTP and the database.
• See WordPress security.

4. Remove the spam from Google

1. Add your site to Google Search Console if you haven’t. See Getting your website on Google and Bing.
2. Check Security & Manual Actions. If there’s a warning, click Request Review once your site is clean.
3. Make sure spam pages now return 404 or 410, not your home page. Google drops them over the next few weeks.
4. To remove urgent pages faster, use Indexing → Removals in Search Console.
5. Submit your real sitemap again under Indexing → Sitemaps, and delete any spam sitemaps.

Spam can take a few weeks to disappear from Google, even after your site is clean.

Faster: restore a clean backup

If you know roughly when the hack happened, restoring files and the database from before then is often quicker. Then do steps 3 and 4. See Restoring files, email and databases using JetBackup.

Need help finding the infection? Open a support ticket.