Hacked Site SEO Spam: How to Spot It and Clean It Up

Key takeaways

• Hacked spam is often cloaked, so your own browser may show a normal site while Google sees thousands of spam pages.
• Remove unknown Search Console owners and their verification files early in the cleanup.
• Let spam URLs return 404 or 410; redirecting them to your home page keeps them alive.

Impressions for words you never wrote, your domain shown next to Japanese text or casino offers, a warning email from Search Console: these are classic signs that someone broke into your site to borrow its reputation for spam. This defensive guide covers how to confirm the problem, clean it, get Google to re-evaluate the site, and prevent a repeat.

What does SEO spam on a hacked site look like?

It usually takes the form of injected pages, hidden links or redirects that use your domain's trust to rank spam.

Google's spam policies describe four kinds of hacked content: code injection (malicious scripts added to pages), page injection (new spam pages), content injection (hidden text or links on existing pages) and sneaky redirects that send some visitors elsewhere based on referrer or device.

Cloaking is why owners miss it: hacked pages may look clean in your browser while serving spam to crawlers.

How do you confirm your site has been hacked?

Check Search Console's Security Issues report, run a site: search, and compare what Googlebot sees against what you see.

Steps from Google's guidance on the Japanese keyword hack:

1. Open the Security Issues report in Search Console. It flags hacked content such as URL injection and content injection.
2. Search site:yourdomain.com and scan several pages of results for odd titles, foreign scripts or folders you did not create. Try another search engine too.
3. Check Search Console users and owners. An owner you do not recognize is a strong sign of compromise.
4. Use the URL Inspection tool on a suspicious URL to see the content Google actually received.
5. Look at the Performance report for queries unrelated to your business.

How do you clean up hacked spam?

Back up first, then remove attacker access and injected code, reinstall clean software, and make every spam URL return an error.

A cleanup order that avoids most rework:

1. Take a full backup of files and database, even though it contains the infection. You may need it for forensics.
2. Remove unknown Search Console owners and delete their verification tokens (an HTML file, DNS record or rewrite rule).
3. Change every password: hosting, CMS admin accounts, database, FTP or SFTP.
4. Replace .htaccess or server config files with known clean versions; attackers often add rewrite rules there.
5. Reinstall CMS core, themes and plugins from official sources rather than editing infected files by hand.
6. Look for recently modified or unfamiliar PHP or script files, especially ones using obfuscated strings with functions like eval or base64_decode.
7. Remove spam URLs from your sitemaps and delete any sitemap files the attacker added.
8. Confirm spam URLs now return 404 or 410. Google treats both the same way and drops indexed URLs after recrawl.

Do not redirect spam URLs to your home page. A redirect tells crawlers the address still points somewhere useful, which slows the cleanup and connects your most important page to thousands of spam URLs.

How do you get Google to review the site?

After every issue in the Security Issues report is fixed on all affected pages, use Request Review and describe exactly what you did.

Google asks the request to name the issue, list the steps taken and describe the outcome. Most reviews take several days or weeks, and submitting again while one is pending can slow things down.

How do you stop it from happening again?

Most hacks come through outdated software, stolen passwords or abandoned plugins, so prevention is mostly routine maintenance.

• Apply CMS, theme and plugin updates promptly, and remove plugins you no longer use.
• Turn on multi-factor sign-in for hosting, CMS, domain registrar and Search Console accounts.
• Give each person their own account with the lowest role they need.
• Keep off-site backups and test restoring one.
• Monitor Search Console email alerts and run a periodic site: search.

While you are reviewing server config, make sure the cleanup did not accidentally block legitimate search and AI crawlers. The GEO readiness checker tests robots.txt access for AI bots. If you would rather have a specialist go through the site, our technical SEO audit covers security signals in Search Console, and our piece on negative SEO explains outside attacks that do not involve a break-in.

Frequently asked questions

What is the Japanese keyword hack?

Attackers create large numbers of auto-generated pages in Japanese, usually selling counterfeit goods, on your domain. They often verify themselves as owners in Search Console and hide the pages from you with cloaking.

Should I return 404 or 410 for spam pages?

Either works. Google's documentation says it treats 404 and 410 the same way and removes previously indexed URLs; choose whichever your server handles cleanly.

How long does a Google security review take?

Google says most reviews take several days or weeks. Do not resubmit while a request is pending, because that can slow the next review.

Can a hacked site recover its rankings?

Usually, once the spam is gone and the hole is closed. Spam URLs can linger in results until they are recrawled, so keep monitoring for several weeks.

Sources

1. Fix the Japanese keyword hack (web.dev)
2. Security Issues report (Search Console Help)
3. Spam policies for Google web search (Google Search Central)
4. How HTTP status codes and network errors affect Google Search