WordPress SEO Spam Cleanup: The Step-by-Step Playbook

What WordPress SEO spam actually is

WordPress SEO spam is an attack that injects hidden pages, links, or redirects into your site so it ranks for someone else's keywords, usually pharmacy, casino, replica goods, or loan spam. The attacker is not trying to break your site. They are borrowing your domain's reputation to rank their own content, which is why the infection is built to stay quiet.

That quietness is the whole problem. A defacement gets noticed in an hour. SEO spam can sit on a site for months, quietly poisoning the domain, until Google flags it or a client asks why the firm's website shows up in a search for sportsbooks.

How to know you actually have it

The fastest check is a site search. Open Google and search site:yourdomain.com with no space after the colon. You are looking for pages you never created, titles in another language, or product names that have nothing to do with your business. Page two onward is where it usually hides.

Then check Google Search Console. Look at Pages, then Indexed, and sort for URLs you do not recognise. Also open Security Issues. If Google has already caught it you will see a Hacked Content warning there, which tells you the clock is running.

A detail that catches people out: the spam is often cloaked. The page looks completely normal in your browser and only serves spam to Googlebot or to visitors arriving from a search result. So "I looked and the page is fine" is not evidence of anything. Use the URL Inspection tool in Search Console and choose View Crawled Page, because that shows what Google actually received.

Where the injection usually hides

In the sites we have cleaned, SEO spam lives in a small number of predictable places. Checking these in order finds it most of the time.

The single most useful habit is to stop thinking of it as one file. Most real infections have a payload, a backdoor that re-adds the payload, and often a second backdoor that re-adds the first. Removing the visible spam and stopping there is why sites get reinfected within days.

The cleanup, step by step

Work in this order. Skipping the early steps is what turns a two hour job into a repeat job.

1. Take a full backup before you touch anything, files and database both. You are about to delete things, and you want the ability to go back and re-examine the infection if the cleanup goes wrong.
2. Get a known-good baseline. Download clean copies of WordPress core, and of every plugin and theme at the exact versions installed, then compare them against the live files. Anything that differs is a candidate. This finds modified core files immediately.
3. Remove the payload. Delete injected posts and pages, clear the spam out of wp_options, and restore modified theme and core files from the clean copies rather than hand-editing them.
4. Hunt the backdoors. Search the whole install for the usual suspects, eval(, base64_decode(, gzinflate(, str_rot13(, assert(, preg_replace with the /e modifier, and any PHP file inside uploads. Read what you find. Not every match is malicious, which is exactly why this step cannot be automated blindly.
5. Check for rogue accounts. Look for administrator users you did not create, and for legitimate accounts whose role was quietly escalated.
6. Rotate every credential. All admin passwords, the database password, hosting and SFTP passwords, and the WordPress salts in wp-config.php. Rotating the salts logs out every existing session, including the attacker's.
7. Update everything. The entry point was almost always an outdated plugin, so patch core, plugins, and themes before you reopen the doors.

Getting back into Google's good books

Cleaning the site does not restore your rankings by itself, because the spam pages are still in Google's index. Those URLs are gone now, so they should return a 404 or a 410. A 410 is the stronger signal, since it tells Google the page is permanently gone rather than temporarily missing.

Then go to Search Console, open Security Issues, and request a review. Say plainly what happened, what you removed, and what you changed to prevent it. Reviews typically come back within a few days. Submit your sitemap again afterwards so Google re-crawls the pages you actually want indexed.

Expect a dip. Even after a clean review, rankings take time to recover, and how much you lose usually tracks how long the spam sat there before anyone noticed. That is the real cost of a quiet infection.

Stopping it happening again

Almost every SEO spam case we have handled traces back to the same short list: an outdated plugin, a weak or reused admin password, or an abandoned plugin that no longer receives security fixes. The fixes are unglamorous and they work.

• Update core and plugins weekly, not when you remember
• Remove plugins and themes you do not use, because dormant code still runs
• Use unique passwords and turn on two-factor authentication for every admin
• Keep off-site backups you have actually tested restoring
• Block PHP execution inside wp-content/uploads
• Watch Search Console, since it often tells you before you notice anything yourself

When to call someone

Do it yourself if the site is small, you are comfortable with SFTP and the database, and you have time to be thorough. Get help if the site earns money, if it has already been cleaned once and came back, if you cannot find the backdoor, or if Google has flagged you and every day of the warning is costing trust.

We have recovered more than 50 hacked WordPress sites, including a coordinated casino spam cleanup across 25 law firm sites at once. If you would rather hand it over, our hacked site repair is a flat price and we find the backdoor, not just the symptom.