SEO Spam in Google Results — How Hackers Destroy Your Rankings
What is SEO spam, and why is it so dangerous?
SEO spam (also known as Japanese SEO spam, a pharma hack, or SEO poisoning) is a type of attack in which hackers create hundreds or thousands of fake pages on your server. Google indexes them, and they rank for search terms related to medicines, gambling, luxury products, or adult content.
Why is this dangerous? Because Google associates your domain with this content. Even after the spam has been removed, the effects of the infection can last for weeks or months — lost rankings, security warnings, and user trust are difficult to recover.
How can you recognize SEO spam?
The most common signs are:
- When you search Google for
site:yourdomain.com, thousands of unfamiliar pages appear
- Google Search Console reports mass indexing of new URLs that you did not create
- Pages contain random strings in their URLs, e.g.
yourdomain.com/wp-content/7x8gh/casino-online
- Links or content in foreign languages (Japanese, Chinese, Cyrillic) appear on the website
- Analytics records a sudden increase in traffic from countries with which you have no business ties
Where do hackers create these pages?
SEO spam is created by scripts running on your server. They most often work in the following ways:
Dynamic page generation with PHP
Hackers add a code snippet to wp-config.php or index.php that intercepts requests matching a URL pattern and dynamically serves spam content — without creating physical files on disk. Google indexes these pages, but you cannot see them over FTP.
Physical files in the uploads directory
The wp-content/uploads directory is often writable and is not protected by WordPress. Hackers create folders there containing PHP files that generate spam pages.
Infected theme files
Code is injected into functions.php or header.php to serve different content to Google bots than to ordinary users (cloaking).
How do you remove SEO spam from WordPress?
- Find and remove infected files — look for PHP files in the
uploads directory (they should not normally be there):
find wp-content/uploads -name "*.php"
- Check wp-config.php and index.php — compare them with the original WordPress versions.
- Remove indexed URLs from Google — in Google Search Console, use the “Removals” tool to report spam pages. This speeds up their disappearance from search results.
- Request a review in GSC — after cleaning the site, submit a review request in the “Security issues” section.
- Update everything — WordPress, themes, and plugins.
How long does it take to recover rankings?
It depends on the scale of the infection and how long the spam was indexed. After a short attack (a few weeks), rankings return to normal within 1–3 months. With a prolonged infection, the process can take 6–12 months.
That is why detecting and removing the spam as quickly as possible is essential — every day brings new spam URLs into Google’s index. If your website is showing signs of SEO spam — tell us about the situation, and we will assess the extent of the infection and clean it up.