Hacked Site and Injected Spam: Clean Up and Protect Rankings
emergency guide, defense onlyIf an intruder adds spam pages, hidden links or redirects to your site, treat it as an emergency. Do not delete anything yet. Back up the infected state, change every password, ask your host for a malware scan, then clean up and close the door that was used. Then fix every issue Google lists and request a review.
- back up before cleaning
- close the door that was used
- review request last
| line | what it is |
|---|---|
| copyright line | normal |
| a hidden link to pills-example.xyz | injected spam |
// the kind of line hacks leave behind: a hidden link inside a normal file. Made-up example.
First Move: Do Not Delete Yet
Back up the infected state, change passwords, ask for a scan.
Hacked pages and injected spam are the one negative SEO tactic that lives on your own domain, so they can do real harm quickly. Cleaning up before you collect evidence destroys the proof. The order below keeps both your evidence and your rankings safe. The full pillar guide is on negative SEO attacks.
Signs of Injected Spam
Look for two or more together.
- Pages or products you never created, often in another language.
- A Security Issues warning in Search Console.
- Search results for your site showing pharmacy or casino titles.
- Visitors on mobile sent to other sites.
- Hidden links in theme or plugin files.
Rule out a plugin or developer who added pages on purpose, and a temporary redirect from a campaign.
The Cleanup in Seven Steps
Order matters more than speed.
- Back up the infected state. Evidence first. You may need it for the host and for Google.
- Change every password. Hosting, WordPress, database, FTP, registrar, and the Google account that owns Search Console.
- Remove unknown users. Check every admin account.
- Ask the host for a malware scan. Hosts can often see what you cannot.
- Clean up. Remove injected pages, hidden links and malware, then update everything.
- Close the door that was used. Without that, the hack returns.
- Request a review. Fix every issue on every affected page, then use Request Review in the Security Issues report.
Make Sure the Clean Pages Are Reachable
A fix can fail for dull reasons.
No login wall
Clean pages must be reachable without a login.
No robots block
Check robots.txt is not blocking the clean pages.
No stray noindex
A leftover noindex tag keeps clean pages out of results.
Redirects removed
Remove injected redirects that sent visitors elsewhere.
For the robots rules, see my guide to the robots meta tag and X-Robots-Tag.
Stop It Happening Again
Four habits do most of the work.
- Updates. The WordPress hardening guide says to keep WordPress current. Update plugins and themes too, and delete the ones you do not use.
- Backups. Keep regular backups and older copies. A hack is often found weeks after it happened. Test a restore.
- Two-step login. Turn it on for WordPress admins, hosting, the registrar and the Google account.
- Alerts. Switch on Search Console email notifications and an uptime monitor.
The monthly routine is in my negative SEO protection checklist.
Questions People Ask Me
What should I do if my site was hacked?
Open the Security Issues report in Search Console. Fix every issue on every affected page, not just the example URLs, and then request a review. A review can take from a few days to a few weeks, and I do not promise a date.
Should I delete the spam pages right away?
Not yet. Back up the infected state first, change every password and ask your host for a malware scan. Then clean up and close the door that was used.
How do I stop a second hack?
Keep WordPress, plugins and themes updated, delete the ones you do not use, keep tested backups and use two-step login. The WordPress hardening guide covers these basics.
Is injected spam the same as negative SEO?
It can be one form of it. The attacker changes your own domain, so it can do real harm quickly. That is why it is the first emergency in my negative SEO guide.
Send Me the Warning. I Will Walk You Through It.
Send me the address of the site and the warning or odd result you saw. I will tell you the first move, calmly and in order. A cheap SEO expert can handle the search side while your host cleans the server. See my negative SEO recovery services.
Sources and Last Check
- Search Console Help: Security issues report (what hacked content is, fix every issue, request review)
- WordPress Advanced Administration Handbook: Hardening WordPress (keep WordPress current, backups, hardening)
- Google Search Central: Spam policies for Google web search (hacked content as a spam practice)
// last checked 12 Nov 2026. The cleanup order is my own method; the Security Issues statements come from Google.