Search site: followed by your domain each month, read Search Console's messages, and if spam pages appear, remove the code behind them and the way in, not just the pages, then request a review.

Fine in the browser, wrong in Google

The site looks normal. The home page loads, the contact form works, and nothing has changed since last month.

But search for the business name and some of the results are not yours: page titles about cheap pills, replica handbags or loans, or whole lines of text in Japanese, all at your address.

Click one of those results from a phone and you may land on an online pharmacy instead of your own site.

Owners usually hear about it from a customer, weeks or months after it started.

Why the owner never sees it

These hacks are built to stay hidden from the people most likely to remove them.

The last is why owners are so often the final people to find out. Some of this code checks for an administrator's login, or remembers a visitor's address, and stays quiet for both.

What the spammers want

Your site has something they lack: years of standing with Google. Pages placed on it can rank for searches that a brand-new spam site never would.

So the hack borrows your reputation to sell pills, counterfeit goods or links. Your business pays for it, in customers who stop trusting the site and in rankings that slide.

Google may also add a line under your results warning that the site may be hacked, and a searcher who sees that has every reason to choose another result.

Checking from the outside

Type site:yourbusiness.ca into Google, using your own domain, and scroll through every page of results. Look for pages you never wrote, foreign text, and words like pharmacy, casino or replica.

Then search for your business name on a phone, outside your office network, and click through from the results rather than typing your address.

Do both once a month. It takes five minutes and shows the site the way Google shows it.

What Search Console tells you

Google's free Search Console sends a message when it detects hacked content on a verified site, and its Security Issues section lists sample addresses of the affected pages.

Fetch as Google shows a page the way Google's crawler receives it. If the crawler gets spam where your browser gets your home page, that is the hack, in plain sight.

The search queries report can help too: searches for products you have never sold, showing your pages, are a strong sign.

None of it helps if nobody has verified the site or reads the messages, which is common on small business sites.

A worked example

A geotechnical engineering firm with a dozen staff had a WordPress site built five years ago. Nobody had updated it since the developer who built it moved on.

During a site visit, one of the firm's clients, a property developer, mentioned that searching the firm's name brought up results in Japanese selling handbags.

At the office the site looked exactly as it always had, and even clicking the odd results from an office computer showed the normal home page.

A site search showed thousands of pages the firm had never written. Search Console, set up at launch and never opened since, held a message about hacked content from two months earlier.

The way in was an outdated slider plugin with a known weakness. The code creating the pages was hidden in the uploads folder and in an added line in the server's configuration file.

The cleanup restored clean files, removed the plugin, updated everything else and changed every password. The spam addresses were set to return a page-gone response, a review was requested, and the odd results dropped out over the following weeks.

Cleaning up properly

Deleting the spam pages is not a cleanup. They are usually generated by code elsewhere on the site, and they come back within days if that code stays.

The code can sit in theme files, plugins, the uploads folder, the database or the server's configuration. Restoring from a backup taken before the hack is often fastest, if one exists and its date is known.

Then update WordPress, every plugin and the theme, delete anything unused, and check the user list for administrator accounts nobody recognises.

Change every password connected to the site: administrators, the hosting control panel, file transfer accounts and the database.

Find the way in

A cleanup that does not find the entry point is a pause, not a fix.

The usual causes are an outdated plugin or theme, a pirated theme with hidden code, a guessed password, or an old test site forgotten in the same hosting account.

That last one catches many owners out. Every site in one account can reach the others' files, so a neglected copy from years ago can reinfect a clean site.

Your host can often help here, since its logs show which files changed and when.

Telling Google it is fixed

Once the site is clean, the spam addresses should return "not found" or "gone", not redirect to your home page.

Then request a review in Search Console's Security Issues section, which lifts the warning label after Google rechecks the site and finds it clean.

The spam results take longer to drop out, so repeat the site search weekly for a while.

The counter-case

Not every site faces the same risk.

A small site on a current version of its platform, with few plugins, automatic updates and strong passwords, is a much harder target. A plain HTML site with no login offers far less to attack.

Even then, the monthly check costs five minutes. A site search, a look at Search Console and a click through from a phone are worth doing for every site.

The monthly check

  1. Run a site search for your domain.
  2. Search your name on a phone and click through.
  3. Get the site verified in Search Console.
  4. Read the messages and Security Issues section.
  5. Update everything that has an update waiting.
  6. Remove old test sites from the hosting account.
  7. Call for help before deleting anything.

Step four is the one that turns a hidden problem into a visible one. Google often knows about the hack weeks before the owner does, and the message sits unread in an account nobody opens.

Keeping the office computers themselves up to date is covered in the ransomware outbreak and the computers that missed an update.

Frequently asked questions

Why does my site look normal to me?

These hacks show spam only to search engine crawlers or to visitors arriving from search results, and some stay hidden from logged-in administrators and repeat visitors.

How do I check for this kind of hack?

Search site: followed by your domain in Google and scroll through every result, then look up the business on a phone and open your own results from there.

What does Search Console show?

A message when Google detects hacked content, sample affected addresses in Security Issues, and Fetch as Google, which shows what the crawler actually receives from a page.

Is deleting the spam pages enough?

No. They are generated by code elsewhere on the site and return within days. The code, the way in, and every password all need dealing with.

How do hackers usually break in?

Through outdated plugins or themes, pirated themes with hidden code, guessed passwords, or an old test site forgotten in the same hosting account.

How do I tell Google it is fixed?

Make the spam addresses return not found or gone, then request a review in Search Console. Google removes the warning after it checks and finds the site clean.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Strange results under your business name?

Send us the address. We will find what Google is being shown and clean it out properly.

Start a Conversation