# Cleaning up an SEO spam hack (Japanese, gambling or pharmacy spam)

> Google shows Japanese, gambling, pharmacy or other spam pages for your website. Here's how to find the hack, clean it and remove the spam from Google.

Source: https://helpcenter.ruachost.com/ssl-security/website-security/cleaning-up-an-seo-spam-hack/

An **SEO spam hack** adds hidden spam pages or links to your website to boost other sites in Google. Your site may look normal to you, but Google shows spam titles for it, often in Japanese, or about gambling, loans, pharmacy products or replica goods.

## Signs of an SEO spam hack

- Search Google for `site:yourdomain.com`. You see pages you didn't create, with spam titles or foreign text.
- Google Search Console shows a **Security issues** warning or lots of new pages you don't recognise.
- Visitors from Google land on spam or are redirected to other sites, while visiting your address directly works fine.
- New, strange files in your website's folders, or a new sitemap you didn't make.

## 1. Scan and clean your files

1. Run a scan in **Imunify360** and check **Monarx Security** in cPanel, and clean what they find. See [Scanning for malware with Imunify360 and Monarx](https://helpcenter.ruachost.com/ssl-security/website-security/scanning-for-malware-with-imunify360-and-monarx/).
2. In **File Manager**, sort folders by **Last Modified** and look for recently changed files you didn't touch, especially:
   - `.htaccess` files with redirects for search engine visitors
   - `index.php`, `wp-config.php` and theme files such as `functions.php` and `header.php`
   - PHP files in `wp-content/uploads/`, which should only contain images and documents
   - random file or folder names, and extra `sitemap` files

## 2. Clean WordPress

- **Replace WordPress core files** with fresh copies. See [Restoring WordPress core files](https://helpcenter.ruachost.com/wordpress/guides/restoring-wordpress-core-files/).
- **Reinstall plugins and themes** from their original source, rather than trusting existing files.
- **Check Users** and delete admin users you don't recognise.
- **Check the database** for spam: in phpMyAdmin, search the `wp_posts` and `wp_options` tables for spam words or `<script>`.

## 3. Close the way in

- Update WordPress, all plugins and themes. Delete anything you don't use.
- Change passwords for cPanel, WordPress, FTP and the database.
- See [WordPress security](https://helpcenter.ruachost.com/ssl-security/website-security/wordpress-security/).

## 4. Remove the spam from Google

1. Add your site to [Google Search Console](https://search.google.com/search-console) if you haven't. See [Getting your website on Google and Bing](https://helpcenter.ruachost.com/getting-started/guides/getting-your-website-on-google-and-bing/).
2. Check **Security & Manual Actions**. If there's a warning, click **Request Review** once your site is clean.
3. Make sure spam pages now return **404** or **410**, not your home page. Google drops them over the next few weeks.
4. To remove urgent pages faster, use **Indexing → Removals** in Search Console.
5. Submit your real sitemap again under **Indexing → Sitemaps**, and delete any spam sitemaps.

Spam can take a few weeks to disappear from Google, even after your site is clean.

## Faster: restore a clean backup

If you know roughly when the hack happened, restoring files and the database from before then is often quicker. Then do steps 3 and 4. See [Restoring files, email and databases using JetBackup](https://helpcenter.ruachost.com/cpanel/files/restoring-files-email-and-databases-using-jetbackup/).

Need help finding the infection? [Open a support ticket](https://dashboard.ruachost.com/submitticket.php).