$ cat Hacked Site SEO Spam Cleanup

A hacked site rarely gets defaced anymore. It gets used. Attackers slip thousands of spam pages into a real website, show them only to search engines, and borrow that site's trust to rank for drugs, counterfeit goods, gambling or Japanese shopping terms. The best known version is the Japanese keyword hack; the oldest is the pharma hack. This chapter is the defensive half of SEO poisoning and parasite SEO: how to prove your site is hacked, clean it in the right order, and get Google to trust it again.

1 · The four SEO spam hacks you will actually see

Google documents several hack families by what they do to search results. They share one goal: put attacker pages inside a domain that already ranks. [1] confirmed

The pharma chapter covers why drug spam pays enough to fund this at industrial scale. Gambling spam on public-sector domains follows the same economics. interpretation

2 · Why attackers want your site, not theirs

A fresh spam domain has no links, no history and no trust. Your domain has all three. Injected pages inherit that trust, get crawled quickly because your site already gets crawled, and survive longer because the owner is usually the last to know. It is parasite SEO without asking permission, and the traffic is monetized through affiliate links, counterfeit storefronts or, in the worse cases, malware delivery covered in SEO poisoning. practitioner

Most infections are not targeted. Bots scan for outdated WordPress plugins, themes, stolen admin passwords and exposed upload folders, then plant the same kit on every site they get into. practitioner

3 · How to tell if your website is hacked

Check in this order. Each signal comes from Google's own guidance or from the Search Console data Google already collects about your site. [1] [2] confirmed

1. Search Console → Security issues. If Google has flagged hacked content, it is listed here with sample URLs.
2. Search Console → Settings → Users and permissions. An owner you don't recognize is the strongest single sign. The Japanese keyword hack commonly verifies itself so it can submit its own sitemaps.
3. Search Console → Sitemaps. A sitemap you never submitted, full of URLs you never made.
4. Performance report. Queries in Japanese, drug names or casino terms you have never written about.
5. A site: search. Page through site:yourdomain.com and look for strange folders and titles. Use the builder below for targeted versions.
6. URL Inspection. Inspect a suspicious URL and view the crawled page. If Google sees spam that your browser does not, the site is cloaking.

4 · The cloaking trick: why the owner sees nothing

Hacked pages usually check who is asking. A visitor or the site owner gets redirected to the homepage or a 404; a request with a Googlebot user agent, or one arriving from a Google search result, gets the spam. Google warns that attackers do this on purpose so the owner thinks the page is gone or fixed when it is still live. [1] confirmed That is why you test with Search Console's URL Inspection, which shows what Googlebot actually received, instead of trusting your own browser.

   WHAT YOU SEE                       WHAT GOOGLEBOT SEES
  ┌──────────────────────┐           ┌──────────────────────┐
  │  Joe's Bakery        │           │  激安 ブランド 通販  │
  │  fresh bread daily   │   ≠       │  最大90%OFF 送料無料 │
  │  [ order online ]    │           │  >> 公式 outlet <<   │
  └──────────────────────┘           └──────────────────────┘
        200 OK · human                     200 OK · crawler

5 · Cleanup, step by step

The order matters. Deleting spam pages before closing the way in means they come back, often within hours. This sequence follows Google's documented fix for the Japanese keyword hack and applies to the other families. [1] confirmed

1. Back up first. Take a full copy of files and database so you can study the infection and roll back a bad cleanup.
2. Lock the doors. Change every password: hosting, SFTP, database, CMS admins, and Search Console. Turn on two-factor sign-in. Remove admin users you don't recognize.
3. Remove unknown Search Console owners and delete their verification token (an HTML file in your root or a rule in .htaccess), or they can re-verify.
4. Replace every .htaccess with a clean default. Injected rewrite rules are how cloaking and spam redirects usually work on Apache hosts.
5. Remove rogue sitemaps and spam entries from your real sitemap.
6. Reinstall core, plugins and themes from official sources instead of hunting through them. Then look for leftover PHP files by name, date and size, especially ones containing obfuscated code such as eval, base64_decode or gzinflate.
7. Fix the hole. Update or remove the outdated plugin or theme that let them in. If you can't find the entry point, assume it is still open.
8. Verify with Googlebot's eyes. Re-inspect the spam URLs. They should now return 404 or 410.

[{t}] backup ........................ ok  site-2026-11-02.tar.gz
[{t}] passwords rotated ............. ok  hosting · sftp · db · wp-admin
!REMOVED  unknown owner  seo-helper-91@example.net  (Search Console)
!DELETED  /google8f3a1c2d9b.html  (rogue verification token)
[{t}] .htaccess replaced ............ ok  12 injected RewriteRules gone
!DELETED  sitemap-jp-0001.xml … sitemap-jp-0044.xml
[{t}] core + plugins reinstalled .... ok  1 abandoned plugin removed
!FOUND    wp-content/uploads/2024/03/cache.php  eval(base64_decode(…
[{t}] /ltjmnjp/341.html ............. 404  (Googlebot)  clean
# entry point closed. now ask Google to look again.

6 · Getting the spam out of Google

Once the spam URLs return 404 or 410, Google drops them as it recrawls. Do not block them in robots.txt first: Google has to fetch a URL to see that it is gone. For urgent cases, Search Console's Removals tool hides URLs from results temporarily while recrawling catches up; it does not delete them from the index permanently. [4] confirmed Submitting a clean, accurate sitemap helps Google recrawl the pages that matter. practitioner

7 · Requesting a review

If Search Console shows a security issue or a manual action for hacked content, request a review after the cleanup. Explain what you found, what you removed and how you closed the entry point. Google says reviews for sites hacked with spam can take up to several weeks (malware reviews take a few days), and if the problem isn't fixed the report may list more sample URLs to investigate. Warnings stay on the site in the meantime. [2] [3] confirmed If no issue was ever flagged, there is nothing to request: clean, return 404s and let recrawling do the work.

8 · Keeping it from coming back

• Automatic updates for core and plugins, and delete anything abandoned or unused.
• Two-factor sign-in for every admin, hosting and Search Console account.
• File-integrity monitoring or a scanner that alerts on new PHP files in upload folders.
• A monthly site: check and a Search Console email alert for new owners and security issues.
• Least privilege: editors don't need admin; plugins don't need write access everywhere.

The detection & defense chapter covers file-diffing and crawler-versus-browser comparison in more depth, and Lab 3 demonstrates the cloaking comparison on synthetic fixtures. practitioner

9 · What experts get wrong

"The pages are gone, I checked." You checked as a human. Check as Googlebot. confirmed

"Just disavow the spam links." The spam is on your site, not pointing at it. Disavow does nothing for a hack. interpretation

"Restore last week's backup and you're done." If the backup includes the backdoor, or the hole is still open, the spam returns. Restore, then patch, then rotate passwords. practitioner

"Noindex the spam pages." The attacker controls those pages. Remove them so they return 404 or 410. interpretation

Hacked site SEO spam: common questions

What is the Japanese keyword hack?

An attack that creates pages full of auto-generated Japanese text on a compromised site, usually in random folders, to rank for shopping terms and send visitors to counterfeit or affiliate stores. It often adds the attacker as a verified owner in Search Console.

How do I know if my website has been hacked?

Check Search Console's Security issues report and its list of owners, look for sitemaps you didn't submit, search site:yourdomain.com for strange pages, and inspect suspicious URLs with URL Inspection to see what Googlebot receives.

Why can't I see the spam pages in my browser?

Because they are cloaked. The hacked code shows spam to search engine crawlers and redirects or hides it from normal visitors.

How long does it take to recover from a hack in Google?

Spam URLs drop out as Google recrawls them, which can take days to weeks depending on how many there are. If Google flagged a security issue, its review of a spam-hacked site can take up to several weeks; malware reviews take a few days.

How do I recover a hacked WordPress site?

Back up, rotate every password, remove unknown admins and Search Console owners, replace .htaccess, reinstall WordPress core, plugins and themes from official sources, delete leftover malicious files, update or remove the vulnerable plugin, then verify with URL Inspection.

10 · References

1. Fix the Japanese keyword hack. Google, web.dev. primary
2. Security issues report. Google Search Console Help. primary
3. Request a review. Google, web.dev. primary
4. Removals and SafeSearch reports tool. Google Search Console Help. primary
5. Spam policies for Google web search (hacked content, cloaking). Google Search Central. primary