WORD SECURITY
SERVICESMalware RemovalHacked Site RecoverySecurity HardeningOngoing Security RESOURCESWordPress Security GuidesHacked Site Recovery GuideSecurity ChecklistEmergency Checklist COMPANY PricingAboutContact REQUEST MALWARE CLEANUP
GUIDE

Casino and Pharmacy Spam on WordPress: Cleanup Guide

By Word SecurityUpdated

Gambling and pharmacy spam are the most common payloads of WordPress SEO hacks. The attacker borrows your domain's reputation to rank their pages and links. The visible pages are often the smallest part of what's installed.

What it looks like

  • Google results for your domain with titles about slots, betting, casino bonuses, or prescription drugs.
  • Pages that open normally for you but show spam to search engines (cloaking).
  • Hidden links inside your own pages, placed so visitors don't notice them.
  • Thousands of generated URLs, sometimes in other languages, such as the Japanese keyword variant.

See How to Tell if Your WordPress Site Has Been Hacked for the broader set of signs.

How the spam gets onto the site

  • Injected PHP that generates pages or inserts links when a search crawler visits.
  • Modified theme and plugin files that add hidden links to the footer or content.
  • Database content: spam posts, widget text or options with links.
  • Rogue users who publish content and keep access.
  • Sitemap manipulation to speed up indexing.

Cleanup steps

  1. Preserve a copy of files and database.
  2. See what crawlers see. Compare a normal visit with how the page responds to a search-engine request. Search Console's URL Inspection shows Google's view of a page.
  3. Verify core, plugin and theme files against official copies and replace what differs.
  4. Find the generator. Look for recently modified PHP files, unknown files in uploads and mu-plugins, and unfamiliar code in functions.php and header.php/footer.php.
  5. Clean the database. Review recent posts, widgets and options for links to casino, pharmacy or unknown domains.
  6. Review users and scheduled tasks, since these usually restore the spam.
  7. Fix the entry point and rotate credentials.
  8. Clean up the index. See How to Remove Spam Pages From Google After a WordPress Hack.

Pitfalls

  • Deleting spam posts without removing the code that creates them. They come back.
  • Blocking the spam URLs in robots.txt. That stops Google from re-crawling them and seeing they are gone. Return a proper 404/410 instead.
  • Cleaning only the site that's visible when others share the hosting account.

Need it handled?

Our SEO spam cleanup is part of malware removal, from $199. For the complete approach, see the The Complete WordPress Hacked Site Recovery Guide.

Further reading

Dealing with this on a live site?

Send us the details and we'll tell you what we'd do and what it would cost.

Request Malware Cleanup

Related services

PROBLEMWordPress Spam Links & SEO Spam HackCasino, pharmacy and Japanese keyword spam: finding and removing injected pages.SERVICEWordPress Malware RemovalFind the infection, remove it, review access and close the way in. From $199.

Related guides

GUIDEHow to Remove Spam Pages From Google After a WordPress HackClean up the index once the site itself is clean.GUIDEHow to Tell if Your WordPress Site Has Been HackedSymptoms, quick checks and what separates a hack from a glitch.GUIDEWordPress Malware Cleanup ChecklistA technical checklist for files, database, users, tasks and verification.GUIDEWordPress Malware Keeps Coming Back: Why Reinfections HappenThe usual reasons a site is clean for a week and infected again.