Fix today

Your page is advertising something that is not yours

What it means

EverThread read the text and links on your page and found content that has nothing to do with your business: gambling, pharmacy offers, payday loans, counterfeit goods, essay writing or crypto giveaways. Attackers add this. It does not appear by accident.

The target is usually search engines, not your visitors. Spammers borrow your site's reputation with Google by adding their text and links to your pages, or by creating pages under your domain that you never see. It is often hidden from you on purpose, shown only to search engines, to visitors arriving from Google, or to people who are not logged in.

Why it matters

Google treats this as a hacked site. Once it notices, it may show "This site may be hacked" under your listing, drop pages from results, or send a warning to Search Console.

The spam is a symptom. Whoever added it can change your site, and the same access can be used for worse, such as scripts that steal card details. That is why the cleanup includes closing the way in, not just deleting text. The good news: this is one of the most common hacks, and most sites recover fully.

How to check your own site

1. Open the page in a private or incognito window, where you are not logged in. Look for unfamiliar text, especially near the footer.
2. View the page source (Ctrl+U, or Cmd+Option+U on a Mac) and search it for words like casino, viagra or loan. Spam hidden with styling still shows up there.
3. Search Google for site:yourdomain.com casino, using your own domain and other spam words. Results with titles you never wrote mean spam pages exist under your domain.
4. In Google Search Console, open Security & Manual Actions, then Security issues. URL Inspection, then Test live URL and View tested page, shows what Google sees, even when spam is hidden from you.

How to fix it

Any website

1. Back up the site as it is now, files and database, before changing anything.
2. Change every password tied to the site: admin, hosting, FTP or SFTP, database, and the email used for password resets. Make each one unique and turn on two-step login where offered.
3. Remove admin users you do not recognize. Restoring a backup from before the spam appeared is often the quickest clean copy. It does not close the hole, so keep going.
4. Remove the spam and delete pages you did not create. Google drops deleted pages from results over time.
5. Find how they got in. Usually it is an outdated plugin, theme or app, a reused password, or a forgotten old copy of the site. Update everything and delete what you do not use.
6. In Search Console, check Users and permissions for owners you did not add, and Sitemaps for any you did not submit. Then, if Google flagged the site, request a review under Security issues. Reviews can take from a few days to a few weeks.
7. Bring in a professional if the spam returns, if you find files you cannot explain, or if your site takes payments. Spam that keeps coming back usually means a hidden backdoor is still there.

WordPress

1. Update WordPress, plugins and themes, and delete the ones you do not use. Inactive plugins can still be attacked.
2. Under Dashboard, Updates, reinstall the current version. This replaces core files with clean copies but does not remove extra files an attacker added.
3. Replace plugins and themes with fresh copies from wordpress.org or the vendor. Never use "nulled" (pirated) premium plugins. They often come with a backdoor.
4. Look for a Must-Use tab on the Plugins screen you did not create, and for .php files inside wp-content/uploads. Both are favorite hiding places.
5. Check functions.php, header.php, footer.php and .htaccess for code you did not add. Replace the security keys in wp-config.php with fresh ones to sign everyone out, including the attacker.

Shopify, Squarespace, Wix and other hosted builders

1. The platform secures its servers, so spam usually comes through your account: a stolen password, a staff account, an app, or custom code.
2. Change your password, turn on two-step verification, and remove staff or collaborators you do not recognize.
3. Check custom code: theme code on Shopify (especially theme.liquid), Code Injection on Squarespace, Custom Code on Wix. Menu names change, so search the help center if needed. Remove apps you did not add.
4. Contact platform support. They can see sign-in activity you cannot.

cPanel hosting

1. Download a full copy with Backup first, and ask your host what backups they keep.
2. In File Manager, turn on "Show Hidden Files" in Settings, then sort by Last Modified to find files changed around the time the spam appeared.
3. Change the cPanel, FTP and database passwords. If you change a database password, update it in your site configuration too.
4. Remove unfamiliar entries under Cron Jobs, which attackers use to put spam back, and old site copies in folders like /old or /test.

Cloudflare

1. Cloudflare does not clean your site. The spam lives on your server or platform.
2. After cleaning, choose Purge Everything under Caching, Configuration so stored copies of the spam stop being served. Check Rules, Workers and the Audit Log for changes you did not make.

What to send your developer

The finding comes from the rendered page text, title and link text, judged as spam unrelated to the site. Test for cloaking with a crawler User-Agent and a search-engine Referer. Check templates, the database, .htaccess rewrites, cron and recently modified files. On WordPress, verify checksums with WP-CLI.

curl -s -A "Googlebot" https://example.com/ | grep -iE "casino|viagra|loan"
curl -s -e "https://www.google.com/" https://example.com/ | grep -iE "casino|viagra|loan"
wp core verify-checksums
wp plugin verify-checksums --all
wp db search "casino" --all-tables
find . -name "*.php" -mtime -14

Common questions