Check this page with an assistantOpens a chat asking it to summarise this article and name the evidence behind each claim.
Claude opens with the prompt on your clipboard: Anthropic does not support prefilled prompts on the web, and we would rather copy it than ship a button that drops it.
The Attack That Targets Search Specifically
Most site compromises want your visitors. SEO spam injection wants your standing: it publishes pages on your domain because your domain has accumulated something worth borrowing. The pages sell pharmaceuticals, counterfeits, or gambling, and they rank partly on your reputation.
The reason it goes unnoticed is cloaking. Injected pages are often served only to crawlers, or only to people arriving from search results, while a direct visit from the owner returns a normal site. Owners insist nothing is wrong, because from where they are looking nothing is.
When it does surface, it surfaces hard. A warning beside your result in search removes most of your click-through immediately, well before any ranking effect, because people do not click results labelled as possibly hacked. That is why this is an incident rather than a project.
Confirming It, Without Trusting Your Browser
Your own view of the site is the least reliable evidence available. Check the index and the crawler's view instead, because that is where the injected content lives.
- Read the Security Issues report.
Search Console reports detected hacked content, malware, and deceptive pages here. It is definitive when populated and inconclusive when empty, since detection is not instant.
- Search your own domain and read every result.
A site query listing pages you do not recognise is the fastest confirmation available. Watch particularly for foreign-language pages and product categories you have never sold.
- Check indexed page count for a jump.
A site with two hundred pages showing forty thousand indexed has been used to publish something. This is frequently the first hard number that makes the problem undeniable.
- Fetch as Google rather than loading in a browser.
URL Inspection shows what the crawler received. Cloaked content appears here and nowhere else, which is exactly why owners miss it for months.
- Look for queries that are not your business.
The performance report will show impressions for terms you have never targeted. That is the injected content earning attention on your domain.
Close the Door Before You Clean the Room
This is the step almost everyone skips, and skipping it is why recoveries take months. Deleting spam pages while the vulnerability is open means the attacker restores them, often within hours, and you clean the same site repeatedly until you find the way in.
The common entry points are unglamorous: an outdated plugin or theme, a reused administrator password, a compromised hosting account, or a file upload that was never restricted. Finding it usually means reading server logs around the date the first spam page appeared and looking for what changed, which is one of the genuinely diagnostic uses of log data covered in log file analysis.
Once identified, close it and assume everything is compromised. Rotate every credential including hosting, database, and any administrator account. Remove unknown users, which attackers create for re-entry. Update everything. If you cannot establish the entry point with confidence, restoring from a known-good backup taken before the compromise and patching before returning it to the internet is the safer path.
Cleaning What Google Already Has
Removing files from your server does not remove pages from the index. Those URLs remain until Google recrawls them and discovers they are gone, which on thousands of pages takes considerable time and needs to be managed rather than waited out.
| Situation | Right response | Why not the alternative |
|---|---|---|
| Injected page, permanently gone | Return 410 Gone | States deliberate removal more clearly than a 404 |
| Thousands of injected URLs | 410 plus a temporary removal request for urgent ones | Removal requests are temporary; the 410 does the real work |
| Legitimate page with injected content | Clean the page, keep the URL | Deleting throws away a page that was genuinely yours |
| Injected pages in your sitemap | Regenerate the sitemap immediately | Otherwise you are actively re-submitting the spam |
| Spam redirect on a real page | Remove the redirect, verify as crawler | Browser checks miss conditional redirects entirely |
Do not redirect thousands of spam URLs to your homepage. It is a common instinct and it turns a spam problem into a mass of irrelevant redirects pointing at your most important page. These URLs should cease to exist, which is what a 410 states.
Requesting Review, and What to Say
Once the site is genuinely clean and the entry point closed, request a review through Search Console. Google explicitly distinguishes sites that used spam techniques deliberately from sites compromised against the owner's will, and the review is where that distinction gets made.
Write it as an incident report rather than an appeal. State how the compromise happened, what you found, what you removed, what you closed, and what you changed to prevent recurrence. Reviews fail most often because the site is not actually clean, so verify before submitting rather than hoping the reviewer misses something.
Expect the warning to clear well before performance recovers. Removing a Safe Browsing flag is fast once a review succeeds; clearing thousands of URLs from the index and rebuilding standing is slow. If rankings remain depressed long after the site is clean, diagnose it as an ordinary decline rather than assuming lingering punishment, using the sequence in indexing diagnostics.
Questions People Ask About Hacked Sites
- How do I know if my site has been hacked for SEO?
The clearest signals are in Search Console: a Security Issues report, or pages appearing in your index that you never created. Others include a sudden rise in indexed pages, queries in your performance report that have nothing to do with your business, warnings shown beside your result in search, and visitors reporting redirects you cannot reproduce yourself.
- Why can I not see the spam pages on my own site?
Because many attacks cloak: the injected content is served only to search crawlers or only to visitors arriving from search, while a direct visit from the site owner looks normal. This is why owners often insist nothing is wrong while the index fills with pages they cannot find. Use the URL Inspection tool to fetch as Google rather than trusting your browser.
- What should I do first?
Find and close the entry point before removing anything. Cleaning spam pages while the vulnerability remains open means the attacker restores them, frequently within hours, and you spend weeks cleaning the same site repeatedly. Identify how they got in, close it, rotate credentials, and only then start removal.
- Will Google penalise me for being hacked?
Google distinguishes deliberate spam from a site compromised against its owner's will. Search Console may still show a manual action because the spam is live regardless of who placed it, but once the site is genuinely clean and the compromise is explained in a reconsideration request, those actions are typically lifted.
- How long does recovery take?
Safe Browsing warnings usually clear within days of a successful review. Getting the spam pages out of the index takes considerably longer, because Google has to recrawl each one, and rankings recover more slowly still. The longer the compromise ran and the more pages were indexed, the longer the tail.
