Home / Single Post
If your Google Business Profile is suspended, Google has found something it believes breaks its guidelines. Common causes are keywords in the business name, an ineligible address, or duplicate profiles. Fix the cause first. Then submit one appeal through the official appeals tool with documents showing your business name and address.
Take your digital marketing to the next level with data-driven strategies and innovative solutions. Let’s create something amazing together!
An SEO spam hack happens when attackers quietly add spam pages, links or keywords to your website so they show up in Google under your domain. Common signs include Japanese or pharmacy text in search results, unknown pages in Search Console and sudden traffic drops. Fixing it means removing the infection, closing the entry point and requesting a Google review.
You search your business name on Google and something feels off. Under your domain you see listings for discount handbags, online casinos or pages written entirely in Japanese. Your homepage looks perfectly normal when you visit it, so what is going on?
This is one of the most confusing problems a small business owner can face. The site looks fine to you, but Google sees something completely different. Meanwhile your rankings slide, your leads dry up and customers may see warnings before they ever reach you.
In this guide we explain what an SEO spam hack is, how to confirm your site has one, how cleanup works step by step and how to stop it from coming back. We see this issue regularly during website audits, especially on WordPress sites running on shared hosting, so the advice below comes from real recovery work and Google’s own documentation.
An SEO spam hack is a website compromise where an attacker injects content, pages or links meant to manipulate search engines rather than steal data directly. The attacker borrows your domain’s trust and ranking power to promote their own products, usually counterfeit goods, unlicensed pharmacies, gambling sites or adult content.
Unlike ransomware or a defaced homepage, this kind of hack is designed to stay hidden. The longer it goes unnoticed, the more money the attacker makes from your site’s reputation.
Small business sites are attractive because they often have older plugins, shared hosting and nobody watching security daily. Your domain also has something valuable: age, local trust and backlinks. Attackers don’t care about your business specifically. Automated bots scan millions of sites looking for any known weakness.
Most SEO spam falls into a few recognizable patterns. Knowing which one you have helps you find where it is hiding.
| Hack Type | What You See in Google | Where It Usually Hides |
|---|---|---|
| Japanese keyword hack | Pages with Japanese text selling brand name goods | New random folders, database entries, rogue files |
| Pharma hack | Listings for Viagra, Cialis or online pharmacies | Database, theme files, injected plugin code |
| Casino and gambling spam | Slot, betting or casino pages under your domain | New pages, hidden links in footer or posts |
| Gibberish hack | Pages filled with nonsense keyword strings | Auto generated pages in subfolders |
| Cloaked keywords and links | Spam shown only to Google, normal site shown to you | .htaccess rules, PHP files that check visitor type |
| Hidden outbound links | Nothing obvious in search, but rankings slip | Footer, widgets, old posts, database |
The Japanese keyword hack is one of the most widespread versions. According to Google’s own guide, it creates new pages filled with automatically generated Japanese text inside randomly named folders, and those pages earn money through affiliate links to stores selling fake brand products. Google also notes that attackers often add themselves as an owner in your Search Console account so they can change settings like sitemaps.
Cloaking means showing one version of a page to search engines and a different version to human visitors. In a cloaked spam hack, Googlebot sees spam while you see your normal website. This is exactly why so many owners don’t believe their site is hacked at first. The infection is built to hide from them.
The fastest check is a Google site search. Type site:yourdomain.com into Google and scroll through several pages of results looking for titles, URLs or languages you never created.
Here are the warning signs we look for during audits:
site:yourdomain.com and add spam words like site:yourdomain.com viagra or site:yourdomain.com casino to surface hidden pages.Tip: Searching your own site in Google while logged into WordPress can hide the problem. Some infections only show spam to visitors who arrive from a search engine, so test from a private browser window and from search results, not by typing your URL directly.
The damage goes far beyond a few ugly search listings. Here is what typically happens if the hack is left alone:
In our experience, the business impact often shows up first as a slow decline in calls and form fills, long before the owner realizes the site is compromised.
Most infections come through a small number of predictable openings. Understanding the entry point matters, because cleaning the spam without closing the door means it comes back, often within days.
| Entry Point | Why It Happens | How Common |
|---|---|---|
| Outdated plugins or themes | Known vulnerabilities get exploited by automated bots | Very common |
| Nulled or pirated plugins | Cracked premium plugins often ship with backdoors built in | Common |
| Weak or reused passwords | Brute force or leaked credentials give direct admin access | Common |
| Shared hosting cross infection | One hacked site on an account spreads to others in the same account | Common on budget hosting |
| Abandoned admin accounts | Old developer or employee logins never removed | Moderate |
| Outdated PHP version | Older server software has unpatched weaknesses | Moderate |
One pattern we see often: a business owner hosts five or six sites on one shared hosting account, one old test site gets hacked, and within weeks every site on that account is serving spam. Separating sites and isolating accounts is one of the most overlooked security steps.
Cleanup has two goals: remove every trace of the infection and close the entry point. Here is the process we follow, in order.
Put the site in maintenance mode if possible, then change every password connected to it. That includes hosting, the WordPress admin, the database, FTP or SFTP accounts and your email for the domain.
This sounds strange, but a copy of the hacked version helps you or a professional trace how the attacker got in. Store it offline and never restore from it.
Look for:
The safest approach is to reinstall WordPress core files, themes and plugins from clean official sources rather than trying to edit infected copies line by line.
Many spam hacks store their pages and links inside the database. Search the posts and options tables for spam keywords, hidden links and scripts. Remove unknown admin users at this stage too.
Update everything, delete unused plugins and themes, replace any nulled software with licensed versions and update your PHP version through your host.
Once removed, spam URLs should return a 404 (not found) or 410 (gone) status code. Do not redirect spam URLs to your homepage, and avoid blocking them in robots.txt, because Google needs to recrawl them to see they are gone.
Use the Removals tool in Search Console to temporarily hide the worst spam URLs from results. Submit a clean, updated sitemap so Google focuses on your real pages.
If the Security Issues report listed problems, fix every one of them across all pages, then select Request Review. Google states that reviews for sites hacked with spam can take up to several weeks. Explain what you found, what you removed and how you closed the entry point.
There is no fixed timeline, and anyone promising one is guessing. Recovery depends on how long the hack ran, how many spam pages Google indexed and how quickly the cleanup was completed.
As a general pattern:
Sites cleaned quickly tend to bounce back faster. Sites infected for many months with tens of thousands of spam pages usually need more time and sometimes additional SEO work.
| Factor | DIY Cleanup | Professional Cleanup |
|---|---|---|
| Best for | Small, recent infections with a clear cause | Reinfections, cloaking, large spam footprints |
| Technical skill needed | Comfort with file managers, databases and code | None on your side |
| Risk | Missing a backdoor leads to reinfection | Lower, if done thoroughly |
| Time | Can take days for a non technical owner | Usually faster |
| Cost | Your time plus any security tools | Paid service, often with follow up monitoring |
Our honest opinion: if you have cleaned the site once and the spam came back, stop and bring in a professional. Reinfection almost always means a hidden backdoor or an unclosed entry point that DIY cleanups miss.
Prevention is far cheaper than recovery. These habits close the doors attackers use most:
A regular technical review catches most of these warning signs early, often before Google ever flags the site.
Your site is most likely affected by the Japanese keyword hack. Attackers create auto generated pages in random folders on your server, filled with Japanese text and links to counterfeit product stores. Check the Security Issues report in Google Search Console and run a site search to see how many pages are affected.
Many spam hacks use cloaking, which shows spam only to search engine crawlers or to visitors arriving from Google. When you type your URL directly or browse while logged in, the site looks normal. Use the URL Inspection tool in Search Console to see exactly what Googlebot sees on a suspicious page.
Usually not, if you act quickly and clean the site completely. Once spam URLs return 404 or 410 status codes and Google approves your review, rankings often recover gradually. Longer infections with thousands of indexed spam pages tend to take more time, and some sites need extra SEO work to regain lost ground.
First delete the spam pages so they return a 404 or 410 status code. Then use the Removals tool in Google Search Console to temporarily hide the worst URLs while Google recrawls. Submit a clean sitemap and request a review in the Security Issues report if Google flagged your site.
A security plugin can detect many infections and remove some of them, but it doesn’t always catch deeply hidden backdoors, database injections or rogue Search Console owners. Treat plugins as one tool in the process. A complete cleanup also includes reinstalling clean files, reviewing the database and closing the original entry point.
Only if you are certain the backup was made before the infection began, and even then you must close the vulnerability first. Many hacks sit quietly for weeks before spam appears, so recent backups are often already infected. Restoring without fixing the entry point usually leads to the same hack returning.
Watch for new unknown pages in a Google site search, rising indexed page counts in Search Console, new admin users or new Search Console owners. Set up uptime and file change monitoring through a security plugin or firewall. Checking Search Console monthly catches most reinfections early.
Not by itself. If you move infected files to a new host, the infection moves with them. A host change can help when the original account was poorly secured or shared with other infected sites, but the files and database must be cleaned first.
An SEO spam hack is frustrating because it hides in plain sight. Your site looks normal, yet Google is showing casino pages, pharmacy listings or Japanese text under your brand name. The good news is that it is fixable. Confirm the problem with a site search and Search Console, clean the files and database, close the door the attacker used and ask Google for a review.
The real win, though, is catching it early or preventing it altogether. Regular updates, strong access controls and a routine technical check go a long way.
If you are seeing strange pages under your domain or your traffic has dropped without explanation, the team at Optimistx Tech Lab is happy to take a look. A quick technical review can show you what Google is really seeing on your site and what to do next. Reach out anytime at +1 (347) 878 0923 or through our contact page.