Spam pages from a hacked WordPress site showing in Google: what to do
By Hamza Rivera, updated
Short answer: Check the Security issues report in Search Console, run a site: search on your own domain for URLs you do not recognize, and test them in URL Inspection, because hackers often cloak spam so it looks like a 404 to you. Back up files and the database, remove the injected code, reinstall core, plugins and themes, close the way in, then select Request Review.
Spam pages for pills, gambling or fake brands appearing under your domain is a common result of a hacked WordPress site. The owner often sees nothing wrong, because the spam is hidden from the people who run the site.
If you want the cleanup handled, see our WordPress hacked SEO spam cleanup.
How the spam hides
Google's guide to the cloaked keywords and links hack says it adds keyword-heavy gibberish pages to your site, and that hackers often sell links on those pages. They use cloaking to make the pages look like part of your site or like a 404 error page. Signs include pages with nonsensical text, visitors redirected to unrelated sites, unusual URLs in search results, and in an .htaccess file a RewriteRule that sends requests to a random-looking PHP file.
How to check
Open the Security Issues report in Search Console. It lists categories such as hacked content, and specific errors including content injection, code injection and URL injection. Then search site: followed by your domain and read several pages of results for URLs you do not recognize. Finally, test suspect URLs with the URL Inspection tool, which lets you see the hidden content.
How to clean it
Google's guide lists these steps: save all your server files offline and back up the database, find and delete the malicious PHP file named in the .htaccess rule, replace .htaccess with a clean default, reinstall CMS core files, plugins and themes, and review suspicious PHP files by modification date and size. It names index.php, wp-load.php, 404.php and view.php as common targets, and says to look for large encoded blocks that use functions such as base64_decode, eval and gzinflate. For database cleanup it points you to your CMS documentation.
Close the way in
The same guide warns that hacked sites are often hacked again, so find the entry point. Update your CMS, plugins and themes, use strong unique passwords and turn on two-factor authentication. If you only clean and do not patch, expect a repeat.
Ask for a review
Fix every affected page first. Google says fixing some pages earns no partial return to search results. Then select Request Review in the Security Issues report and explain the issue, the steps you took and the outcome. Reviews can take days to weeks, and Google says not to resubmit while one is pending.
Related reading
If real pages are missing from search too, see WordPress site not showing in Google. For a hands-on cleanup, see our WordPress hacked SEO spam cleanup service. Passieon is an independent agency and is not affiliated with Google.
Sources
- web.dev: Fix the cloaked keywords and links hack, read November 11, 2026.
- Search Console Help: Security Issues report, read November 11, 2026.
- Google Search Central Blog: #NoHacked 3.0, fixing common hack cases, read November 11, 2026.
Frequently asked questions
How do I know if my WordPress site was hacked for SEO spam?
Look for unusual URLs in a site: search, nonsensical pages, visitors redirected elsewhere, and issues in the Security Issues report in Search Console.
Why do the spam pages look like 404 errors to me?
Google says hackers use cloaking so the injected pages look like part of the original site or a 404 error page. URL Inspection lets you see the hidden content.
What should I back up first?
Google says to save all server files offline and back up your database before removing anything.
Is deleting the spam pages enough?
No. Google says to find the entry point and update your CMS, plugins and themes, because hacked sites are often hacked again.
How do I ask Google to review the site?
After fixing every issue on all pages, select Request Review in the Security Issues report and describe the issue, your fixes and the outcome.
How long does the review take?
Google says days to weeks, and not to resubmit while a request is pending.
Want this done for your site? See what our WordPress hacked SEO spam cleanup page covers, or read the client results.
Read next
- Multi-location business SEO: how to structure the site and profiles One profile per real location, shared naming rules and no duplicates. What Google Business Profile guidelines say about businesses with several locations.
- City service pages without crossing into doorway pages Google lists pages aimed at specific cities that funnel users to one page as doorway abuse. Here is what that means for a service business with several towns.
- How to reply to a negative Google review The steps to reply from your Business Profile, what Google checks before a reply goes live, and when to flag a review instead of answering it.