Your name, somebody else's pages
A customer mentions that your site showed up in Google with a strange title. You search for your company and see results under your domain in Japanese characters, or about cheap medication, or casino bonuses. Clicking one might show your normal homepage, or might redirect to another site entirely. Visiting the site directly from your office, everything looks fine.
That last detail is what confuses people. Much of this kind of malware shows spam only to search engine crawlers or to visitors arriving from Google, so the owner sees nothing wrong.
How the spam got there
Attackers are not interested in your business. They want a domain Google already trusts, so they can use it to rank their pages. WordPress sites are targeted in bulk by automated tools looking for a known weakness.
| Common way in | Why it works |
|---|---|
| Outdated plugin or theme with a published vulnerability | Automated scans find it and exploit it without anyone logging in |
| Weak or reused admin password | Password lists from other breaches are tried against the login page |
| Nulled (pirated) premium plugin | It often ships with a backdoor already inside |
| Old admin accounts for former staff or developers | Nobody notices an extra login using them |
| Other sites on the same hosting account | One compromised site spreads to its neighbours |
Once in, the attacker typically leaves several backdoors, hidden files that let them back in, so deleting the obvious spam without finding those just means it returns.
What it is costing you
Google may label the site as hacked in results, or show a warning before visitors reach it. Search Console can report a security issue and your genuine pages can lose ranking while thousands of spam pages compete with them. Customers who see the results lose trust. Your host may suspend the account, and email from your domain can start landing in spam if the server has been used to send it.
How we clean it up
- Take a full copy of the site as it is, for evidence and so nothing is lost if something goes wrong during the clean.
- Scan the files and database for malicious code, unknown files, modified core files and injected content, comparing against clean copies of WordPress, plugins and themes.
- Replace WordPress core, plugins and themes with fresh copies from their official sources rather than trying to patch infected ones.
- Remove backdoors, rogue admin users, malicious scheduled tasks and injected database entries.
- Find the way in by checking server logs and versions, and close it: update or remove the vulnerable component, reset every password and security key.
- Harden the site: two-factor login, limited admin accounts, file editing disabled in the dashboard, and sensible file permissions.
- In Search Console, request a review if Google has flagged the site, submit a clean sitemap and have the spam URLs return a gone status so they drop out of results.
- Set up monitoring for file changes and new admin accounts, so any return is spotted quickly.
If the site is too badly compromised to trust, we rebuild it on clean hosting from the content, which is sometimes quicker and safer than cleaning.
What you are left with
A clean site with the way in closed, fresh software and a short record of what happened and what changed. Spam URLs return an error and drop out of Google over time as it recrawls. Your team has their own logins with two-factor, and someone is alerted if files change unexpectedly.
Signs your site has been hijacked
- Google results for your domain show foreign or spam titles
- Search Console reports a security issue or thousands of unfamiliar URLs
- Visitors from Google are redirected somewhere else
- Admin users appear that nobody created
- Your host has warned about malware or suspended the account
- Plugins have not been updated in a long time