Spam hacks hide pages for pills or counterfeit goods where only search engines look. Check Search Console and search your own domain, close the way in before cleaning, then ask Google to review the site.

Fine to you, a pharmacy to Google

The owner types the address into a browser and the site appears as it always has: the home page, the services, the contact form.

Meanwhile, Google's index holds hundreds of pages under the same domain selling discount pills, replica watches or counterfeit handbags. Some visitors who click them land on a shop the business has never heard of.

The site was hacked weeks or months ago. It was not defaced, because a defaced site gets noticed and cleaned. It was put to work quietly.

It is one of the commonest things to happen to a small business site behind on its updates, and one of the least visible.

How the spam stays out of sight

The hidden code decides what to show depending on who is asking.

The fourth is why owners are the last to know. They reach their own site by typing its address or clicking a bookmark, which is exactly the route the code leaves alone.

What the hack is for

Nobody chose your business for its customers. The value is the domain itself: years old, linked from other sites, trusted by search engines.

Pages placed on an established domain can appear in search results far sooner than pages on a new one. The spammers borrow that trust to sell whatever they are selling.

The hacking itself is done by automated tools that look for known weaknesses in out-of-date software, on any site they can reach.

Signs it has happened

Search Console's security issues report lists hacked content Google has found, and Google emails the site's verified owners when it detects some. That email often goes to a designer who left years ago.

Search results for the business can carry a note saying the site may be hacked. Customers sometimes mention it, or mention being sent to an odd shop.

Search Console's performance report may list searches for products you have never sold, sometimes in other languages.

And new owners can appear in Search Console. Some hacks add the attacker as a verified owner, so they can submit their own lists of spam pages.

Search your own site

The quickest check takes a minute. Type site: followed by your domain, with no space, into Google, and look through the results.

Look for page titles you did not write, words in other languages, and addresses in folders you never created. Adding a word such as cheap or replica to the search narrows it down.

Look past the first page of results, and repeat the check monthly, since no notification is guaranteed to reach you.

A worked example

A family-run paving and concrete company had a WordPress site built in 2014, with a slider plugin on the home page that had not been updated since.

A customer mentioned that searching for the company's name had turned up a listing about discount medication. Nobody at the company could see anything wrong on the site.

A search of the domain showed several thousand spam pages. Search Console, once the owner regained access to it, listed hacked content and an owner nobody recognised.

The developer found the way in through the old slider, along with a hidden administrator account and a file in the uploads folder that let the attackers back in at will.

The site was restored from a clean copy, everything was updated, the slider replaced, every password changed and the strange owner removed. The spam addresses now return a not found error.

A review request went to Google through Search Console, and over the following weeks the spam pages dropped out of the results.

Cleaning it up properly

Order matters, because cleaning before closing the way in only buys a few days.

Take a copy of the hacked site first, for whoever investigates. Then find how they got in: usually an outdated plugin or theme, a stolen password, or software downloaded from somewhere other than its maker.

Restore from a backup taken before the hack if one exists, or remove the injected files and code by hand. Update the core, plugins and theme, and remove anything unused.

Change every password: the website's administrators, the hosting control panel, FTP, the database and email. Delete accounts nobody recognises, in WordPress and in Search Console.

Let the spam addresses return a not found or gone error, which tells Google plainly that the pages no longer exist. Redirecting them all to the home page does not.

Telling Google it is fixed

Once the site is clean, request a review from the security issues report in Search Console, describing what was found and what was done.

When Google is satisfied, the hacked warning disappears from the search results. The spam pages fall out of the index over time, as Google revisits them and finds nothing.

If the site held form entries or customer accounts, the hack may also be a privacy breach. Depending on which privacy law covers your business, it may need recording or reporting; take advice on whether anyone must be told.

Why it comes back

Hacked sites are often hacked again within days of a clean-up, because something was missed: the original weakness, a second hidden account, or a file that lets the attackers back in.

So the job includes watching the site closely for a month afterwards, with the site: search and Search Console checked weekly.

The counter-case

Not every odd search result is a hack.

Other sites copy content and keep your name in it, a nuisance but not a problem on your server. Old pages and tag archives can also look strange without anything malicious behind them.

A simple site with no plugins and no login has less to exploit, though it still lives on a server that needs looking after.

But spam titles under your own domain, or a warning in Search Console, mean the site needs cleaning by someone who knows how, starting today.

If you suspect it

  1. Search your domain with site: in Google.
  2. Check Search Console for security issues and owners.
  3. Take a copy of the site as it is.
  4. Find and close the way in.
  5. Restore or clean every infected file.
  6. Change every password and remove unknown accounts.
  7. Request a review once it is clean.

Step four decides whether the clean-up lasts. Removing the spam without closing the gap it came through invites the same tools straight back in.

Guessed passwords, the other usual way in, are covered in the login page that gets guessed at all night.

Frequently asked questions

How can a hacked site look normal?

The hidden code shows spam only to search engines and to some visitors arriving from search. Anyone typing the address, including the owner, sees the normal site.

Why would anyone hack a small business site?

For the domain's standing with search engines. Spam pages placed on an established domain can appear in results far sooner than pages on a new one.

How do I check whether my site is affected?

Search Google for site: followed by your domain and look for titles you did not write. Check Search Console's security issues report and its list of owners.

What does cleaning up involve?

Copying the hacked site, finding and closing the way in, restoring or cleaning files, updating everything, changing every password, removing unknown accounts, and letting spam addresses return errors.

How do I get the hacked warning removed?

Clean the site completely, then request a review through the security issues report in Search Console. The spam pages drop out of the index as Google revisits them.

Why do hacked sites get hacked again?

Because the clean-up missed something: the original weakness, a hidden administrator account, or a file that lets the attackers back in. Close the way in before cleaning.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Strange titles when you search your domain?

Tell us the domain. We will check Search Console and the server, and clean the site properly if it needs it.

Start a Conversation