Your site looks fine. The pages load, the design is right, nothing strange in wp-admin. Then a customer mentions that your Google results show pharmacy ads, or your traffic drops for no reason, or Chrome starts warning visitors away.
That's how a growing kind of WordPress infection works: it is built to hide from the site owner. Security researchers have tracked campaigns that install fake plugins, inject spam only when a search engine visits, and redirect only some visitors to scam sites. This guide shows how to check your site, clean it properly and keep it clean.
Key takeaways
- Hidden SEO spam shows pharmacy or casino content only to search engines, so the site looks normal to you.
- A common trick is a fake plugin named after your own domain, such as example-com/example-com.php.
- Check Google with site:yourdomain.com plus spam words, and look in Search Console for pages you didn't create.
- Cleaning means replacing files, resetting every password and removing hidden admin users, not just deleting one file.
- Once clean, ask Google for a review so warnings and spam results disappear.
How hidden SEO spam works
The malware looks at each request before deciding what to show:
- For search engine crawlers, it adds spam: links, pages or text about pharmacy, casinos, loans or replica goods. Google indexes it under your domain, which lends the spam your site's reputation.
- For you and your logged-in team, it shows the real site, so nothing looks wrong.
- For some visitors, often only those coming from Google on a phone, it redirects to a scam site, then stops for a while so the problem is hard to reproduce.
A favourite hiding place is a plugin named after your own site. On example.com, the folder and file might be example-com/example-com.php, which looks like something your developer made. Other campaigns pose as security or SEO plugins, use heavily scrambled code that's hard to read, or hide themselves from the Plugins screen altogether.
Signs your site may be affected Spam words or foreign-language pages in Google results for your domain; a 'Deceptive site ahead' or 'This site may be hacked' warning; customers reporting redirects you can't reproduce; a sudden drop in search traffic; or new admin users nobody created.
Step 1: check what Google sees
Search Google for your domain together with typical spam words. If results come back for pages you never wrote, Google has indexed spam on your site.
site:yourdomain.com viagra
site:yourdomain.com casino
site:yourdomain.com replica
site:yourdomain.com "buy" "online" "cheap"Then open Google Search Console for your site. Check Security & Manual Actions › Security issues for warnings, and the Pages report for URLs you don't recognise. The URL Inspection tool shows a page the way Googlebot sees it, which is the quickest way to catch content that only crawlers are shown.
Step 2: look for the intruder
In wp-admin, check Plugins and Users. But because some malware hides from wp-admin, also look at the files directly, in cPanel's File Manager or over SSH:
# Plugin folders on disk (compare with the Plugins screen)
ls -la wp-content/plugins/
# Must-use plugins load automatically and don't need activating
ls -la wp-content/mu-plugins/
# PHP files don't belong in uploads
find wp-content/uploads -name "*.php"
# Core files that differ from the official release
wp core verify-checksums
# Plugins whose files differ from the wordpress.org versions
wp plugin verify-checksums --all
# Every administrator account
wp user list --role=administratorLook for a plugin folder named after your domain, anything in mu-plugins you didn't add, PHP files inside uploads, and admin users you don't recognise. On WebGee cPanel hosting, run a scan from cPanel's malware scanner too, and check cPGuard's CMS Threats report, which also flags infected files and database content in each WordPress installation.
Step 3: clean it properly
The most common mistake is deleting the one bad file and stopping there. Attackers almost always leave a second way back in. Work through all of it:
Clean-up, in this order
- Take a snapshot backup of the infected site first, so you can compare and nothing is lost
- Reinstall WordPress core files (wp core download --force --skip-content), keeping wp-content and wp-config.php
- Delete every plugin and theme, then reinstall fresh copies from the official source; delete anything you don't recognise
- Remove PHP files from wp-content/uploads and anything unexpected in mu-plugins
- Delete unknown admin users, and check wp-config.php and .htaccess for added code or redirects
- Check cron jobs in cPanel and email forwarders for anything you didn't create
- Reset every password: WordPress admins, cPanel, database, FTP/SSH and email; then change WordPress's security keys in wp-config.php
- Update everything that was outdated, including PHP, to close the hole the attacker used
If you have a clean backup from before the infection started, restoring it can be faster. Restore the files and database, then still do the password resets and updates, or the attacker simply comes back the same way. Our malware clean-up guide covers each step in more detail.
Step 4: tell Google it's fixed
Once the site is clean, go back to Search Console. Under Security issues, select Request review and briefly describe what you removed and how you closed the entry point. Use the Removals tool to hide the spam URLs from results while Google recrawls them, and re-check the site: searches over the following weeks.
Stop it coming back Keep plugins and themes updated, delete what you don't use, give admin rights only to people who need them, use strong unique passwords, and keep regular backups. Most reinfections come through the same outdated plugin as the first one.
Security that doesn't wait for you to notice
Hidden spam is designed so you won't find it by looking at your site. On WebGee cPanel hosting, cPGuard scans every WordPress installation in your account for vulnerable plugins, malicious files and infected database content, and emails you a weekly report. Malware scanning, a web application firewall and JetBackup restores are included, and our engineers on live chat 24/7 will look at it with you if something turns up.
Frequently asked questions
How can my site show spam to Google but not to me?
The malware checks who is asking. When the visitor looks like a search engine crawler, it adds spam content or links. When it's a logged-in admin or a normal browser, it shows the real page, so the infection goes unnoticed for weeks.
How do I check if Google sees spam on my site?
Search Google for site:yourdomain.com together with words like viagra, casino or replica. In Google Search Console, check the Pages report for URLs you never created, and the Security Issues report for warnings.
Is deleting the fake plugin enough?
Usually not. Attackers leave backdoors: extra admin users, modified core files, cron jobs or code in the database. Follow the full clean-up, including replacing core files and resetting all passwords, or the site is often reinfected within days.
How did the attacker get in?
Most often through an outdated plugin or theme with a known vulnerability, or a stolen or weak admin password. Find and close that entry point, or the clean-up won't last.
How long until Google stops showing the spam?
After you clean the site and request a review in Search Console, warnings are often lifted within a few days. Spam pages drop out of results as Google recrawls them, which can take longer; you can speed it up with Search Console's removals tool.
