---
title: "Spam pages on your website: how to find, remove and recheck them"
description: "Spam pages or hidden links can mean someone got into your site. Search your domain, save the list, clean the files, fix the way in, then request a review."
url: "https://webleveling.com/blog/spam-pages-and-links-injected-into-your-website/"
lang: "en"
published: "2026-10-18"
modified: "2026-10-18"
author: "Cal Hewitt"
tags: ["website-security","small-business","website-maintenance"]
image: "https://webleveling.com/og/blog-spam-pages-and-links-injected-into-your-website.jpg"
alternates:
  es: "https://webleveling.com/es/blog/paginas-de-spam-en-su-sitio-web-como-eliminarlas.md"
---

# Spam pages on your website: how to find, remove and recheck them

Spam pages or hidden links can mean someone got into your site. Search your domain, save the list, clean the files, fix the way in, then request a review.

![A brass padlock and a magnifying glass resting on a closed laptop beside a blank stack of index cards on a wooden desk.](https://webleveling.com/blog/spam-pages-and-links-injected-into-your-website/spam-pages-cleanup-featured.jpg)

You search your own business name and find pages for products you have never sold. Or a customer sends a screenshot, or a tool flags links on your site that point to casino and pharmacy pages you never wrote. Spam pages on your website like these can mean someone added content without your permission. The way in may be a plugin with a known flaw, a stolen password or another access path.

That is a bad moment, and it is fixable in a set order. Save the list of strange addresses without opening them. Work out which pages are injected. Clean the files, the database and the accounts. Close the way in. Then recheck and ask Google for a review.

Taking down the visible page is only half the job. There are two tracks: cleaning up what Google has indexed, and repairing the weakness that let the content in. If you skip the second one, the spam can return.

**Key Takeaways**

**Save the list first**

Search your domain with site: plus words like casino or pills, check Search Console, and keep every suspicious address in a document before you delete anything.

**A missing menu link proves nothing**

Compare each address with your CMS, sitemap, database, files and a clean backup, because a plugin can create pages on purpose.

**Cleaning has two tracks**

Remove injected pages, links, accounts and files, then repair the way in with updates, clean replacement files and new credentials.

**Recheck, then ask Google**

Request the Security issues review only after the whole site is clean. Google says reviews may take a few days to several weeks.

## What does it mean when strange pages or links show up on my site?

Google describes hacked content as material placed on your site without your permission, through a security weakness. Its [hacked content help page](https://support.google.com/webmasters/answer/9044101) lists examples such as pharmaceutical terms, unrelated links and spam text added to existing pages. Google's [spam policies](https://developers.google.com/search/docs/essentials/spam-policies) cover the cloaking trick that often goes with them.

Cloaking means showing search engines one thing and people another. That is why your own browser can show a normal page while Google lists something else. A clean-looking homepage does not tell you the site is clean.

Search Console's Security issues report can show the type of problem, the date it was detected and sample addresses. The sample may not be the full list. Treat it as a starting point.

[Sucuri's 2023 hacked website report](https://sucuri.net/reports/2023-hacked-website-report/) looked at 39,594 sites its own incident-response team cleaned and found SEO spam on 20.30% of them. That is Sucuri's figure for its own caseload, not a rate for all websites. It does show that this is a recognized pattern with a known cleanup path.

If the problem is bigger than spam, such as a locked-out admin account or a site that is down, start with our [first 24 hours after a hack](https://webleveling.com/blog/website-hacked-first-24-hours/) steps and come back here for the spam cleanup.

## How do I find every spam page without opening them?

Start in Google, not on the suspicious pages. A few searches show what Google has indexed for your domain, and you never have to click a result. Replace yourdomain.com with your own address.

Searches that show injected pages

| Search | What it can show |
| --- | --- |
| site:yourdomain.com | Every page Google has indexed, to compare with the pages you know you own |
| site:yourdomain.com casino | Gambling pages added to your domain |
| site:yourdomain.com pills | Pharmacy pages, and the same for words like viagra or loans |
| site:yourdomain.com plus an unfamiliar foreign-language word | Pages in a language you never published in |
| site:yourdomain.com intitle:casino | Pages whose titles carry the spam term |
| site:yourdomain.com inurl:wp- | Addresses containing wp- to compare with your own WordPress setup |

Look for unfamiliar titles, descriptions, languages, products, authors and dates. Open a suspicious result only with care. These searches show what is indexed. They cannot prove the files and database are clean.

Then work through Google's own tools, which follow the steps in its [hacked site guidance](https://support.google.com/webmasters/answer/6347750) and its page on [site: searches and the Page indexing report](https://support.google.com/webmasters/answer/7440203):

1.  **Security issues**: Open the report in Search Console and read any examples it lists.
2.  **Page indexing**: Compare the indexed addresses with the pages you know you own.
3.  **URL Inspection**: Run it on one suspicious address, then look at both the indexed view and a live test.
4.  **A link crawl**: Crawl your site, export every internal and external link, and review destinations you do not recognize. This is how hidden outbound links show up.
5.  **Server logs**: Check what Googlebot is asked for and what it receives, since cloaked content may not show in an ordinary browser. Google's [security guidance](https://developers.google.com/search/docs/monitor-debug/security/prevent-malware) recommends keeping an eye on logs.

Copy every suspicious address into a document before you change anything. Once the list is saved, you can prove later that each one is gone.

![A closed notebook and a pencil lying beside a neat stack of blank index cards on a wooden desk.](https://webleveling.com/blog/spam-pages-and-links-injected-into-your-website/saved-list-of-spam-urls.jpg)

Write the full list down first, so you can check each address off at the end.

## How do I tell an injected page from one my site created on purpose?

Some unfamiliar pages are legitimate. A plugin, a store or a booking tool can create pages with addresses you never typed. Deleting one of those breaks something real, so identify the page before you remove it. Google's [guide to diagnosing a hacked site](https://developers.google.com/search/blog/2015/08/nohacked-identifying-and-diagnosing) is a good companion for this step.

A page is more likely injected when it shows signs like these:

- **Unrelated subject**: A casino or pharmacy page on a plumbing site, for example.
- **Unfamiliar address pattern**: A string of letters or numbers you have never used.
- **Unnatural repetition**: The same keyword stuffed into the title and text.
- **Foreign-language text**: A language your business does not use.
- **Mismatched dates or authors**: A publish date or author name that does not fit your site.
- **Missing from the CMS**: The page is in Google but not in your page list.

A page made by a plugin usually has a clear purpose, a consistent template, a recognizable address pattern, working links in your site and a matching plugin or database record.

Compare each address with your CMS, sitemap, database, server files, a clean backup, analytics and your publishing history. A page that appears in the indexing report but cannot be traced to anything you or a tool you installed created deserves a closer look. Do not delete a page only because it is missing from your menu.

![Two blank cardboard folders side by side on a desk with a closed laptop behind them.](https://webleveling.com/blog/spam-pages-and-links-injected-into-your-website/injected-page-or-plugin-page.jpg)

Match each unfamiliar address to something you or a plugin created before you delete it.

## What does a full cleanup have to cover?

A cleanup removes the unwanted content and the access that let it in. If only the page goes, the backdoor, the extra account or the altered plugin can bring it back. Google's hacked content help and the [WordPress hardening guide](https://developer.wordpress.org/advanced-administration/security/hardening/) describe the same core work.

First, keep a clean backup, plus a copy of the affected files and logs if you can. Then work through this list:

- **Remove what does not belong**: Unauthorized pages, database records, links, scripts, administrator accounts, scheduled tasks and malicious files.
- **Replace altered files**: Swap changed core, theme and plugin files for clean copies.
- **Prune and update**: Delete plugins and themes you do not use, then update everything that stays.
- **Repair the way in**: Fix the weakness that allowed the content in, whether that was a plugin, a login or a permission setting.
- **Rotate credentials**: Change hosting, CMS, database, FTP or SFTP, email and administrator passwords.
- **Add a second step**: Turn on two-factor authentication wherever it is offered.

NIST's [incident response guidance](https://csrc.nist.gov/pubs/sp/800/61/r3/final), SP 800-61 Rev. 3, published in April 2025, says the same thing in general terms. Cleanup means removing malware, disabling breached accounts and fixing the vulnerability that was exploited, followed by recovery from clean backups and tighter controls.

Plugins deserve special attention. [Wordfence's 2024 annual WordPress security report](https://www.wordfence.com/blog/2025/04/2024-annual-wordpress-security-report-by-wordfence/) found that 96% of the vulnerable software types disclosed that year were plugins, so an outdated or abandoned plugin is a likely place to look. Keeping them current is the kind of routine job our [website maintenance](https://webleveling.com/services/website-maintenance/) work covers.

If you cannot reach the server files or find a clean backup, your host may be able to help. A hosting plan with backups and file access makes this far less painful, which is a good reason to look at [web hosting](https://webleveling.com/services/web-hosting/) before the next incident, not during it.

![A small brass padlock and a ring of new keys resting on a sealed envelope on a worn wooden surface.](https://webleveling.com/blog/spam-pages-and-links-injected-into-your-website/new-keys-after-cleanup.jpg)

Fresh credentials matter as much as deleting the spam, because the old ones may still work.

## How do I recheck the site, and when do I ask Google for a review?

A normal browser view does not prove the site is clean, because attackers can hide content from owners. Recheck with evidence, using the list you saved earlier.

Signs the cleanup worked

| Check | What a good result looks like |
| --- | --- |
| Each saved spam address | Returns a 404 or 410, or redirects only to a legitimate replacement page |
| A fresh crawl of your links | No unexpected outbound destinations |
| Users, files, records and scheduled tasks | No unauthorized items remain |
| Software | Core, plugins, themes and server components are current |
| Credentials | Passwords and sessions have been rotated |
| Forms, analytics and key pages | Everything still works as before |

The status codes matter. A 404 or 410 tells Google a page should not exist, and Google's [redirect guidance](https://developers.google.com/search/docs/crawling-indexing/301-redirects) covers when a redirect fits. A redirect to a real, related page is fine. A redirect that sends spam addresses to your homepage is not a repair.

Do not block spam addresses in robots.txt. As Google's [robots.txt introduction](https://developers.google.com/search/docs/crawling-indexing/robots/intro) explains, the file controls crawling and does not remove a page from the index. Blocking can also stop Google from seeing that the page is gone. If you want help testing forms, redirects and key pages after cleanup, that is what [quality assurance](https://webleveling.com/services/quality-assurance/) testing is for.

When the whole site is clean, open Search Console's Security issues report and select Request a review. Describe what you removed and how you fixed the entry point. Google says hacked-site reviews can take from a few days to several weeks, so plan for a wait. Then watch the Page indexing report for the spam addresses to drop out, and see our [Search Console email guide](https://webleveling.com/blog/google-search-console-emails-explained/) for what the follow-up messages mean. If rankings need a closer look afterward, [search engine optimization](https://webleveling.com/services/search-engine-optimization/) is the next step.

![A magnifying glass resting on top of a closed laptop beside a blank checklist pad on a clean desk.](https://webleveling.com/blog/spam-pages-and-links-injected-into-your-website/magnifier-on-closed-laptop-recheck.jpg)

The recheck is what shows the cleanup worked, so do not skip it.

## When is a focused cleanup enough, and when has the job grown?

A focused cleanup, a software update, a credential reset and a round of checks may be all your site needs. If the damage is a few injected records on a platform that can still be supported, that is a reasonable scope, and it does not call for a redesign or an open-ended retainer.

The job is larger when signs like these show up.

Focused fix or bigger job?

| Situation | Likely scope |
| --- | --- |
| One outdated plugin and a handful of injected pages | Focused cleanup, update and recheck |
| Spam keeps coming back after cleanup | Larger: a backdoor or hidden access remains |
| No trustworthy backup | Larger: a rebuild from a clean baseline may be needed |
| Several unauthorized accounts | Larger: credentials and access paths need a full review |
| Unsupported or abandoned software | Larger: replace components, not just clean them |
| Server-level access concerns | Larger: involve the host |
| Nobody can say how far it goes | Start with a written audit to define the scope |

No one can promise a fixed price, instant removal from Google or permanent immunity without examining your site. Before you pay for ongoing work, ask for the evidence, the scope, what is included, what is excluded and the follow-up checks in writing. Our [malware removal cost](https://webleveling.com/blog/website-malware-removal-cost/) guide shows how to read a quote, and our write-up on [WordPress EtherHiding malware](https://webleveling.com/blog/wordpress-etherhiding-malware/) covers one WordPress malware pattern to check for.

**Quiz: Check your spam cleanup plan**

1. You find a casino page on your domain in Google. What should you do first?
   - Delete it from the CMS and move on
   - Block the address in robots.txt
   - Save the full list of suspicious addresses before deleting anything **(correct answer)**
   - Open every result on your office computer
2. A page is in Google but not in your menu. What does that prove?
   - It is definitely spam
   - Nothing yet; compare it with the CMS, sitemap, database and files **(correct answer)**
   - It is safe to ignore
   - It was created by a competitor
3. When should you request a Security issues review?
   - As soon as you see the first spam page
   - After you remove the visible page only
   - After the whole site is clean and the way in is fixed **(correct answer)**
   - Never; Google finds out on its own

## Frequently Asked Questions About Removing Spam Pages From Your Website

**Why are random pages appearing on my website?**

A weakness or a compromised account may have let someone add pages or links without your permission. Check Search Console's Security issues report and compare indexed addresses with your real pages.

**Can a hacked site look normal?**

Yes. Attackers can cloak content or place it only on new addresses, so your homepage may look fine while Google lists something else.

**Should I just delete the spam pages?**

Remove the unauthorized content, but also find and repair the access path that created it. Deleting the page alone leaves the way in open.

**Will robots.txt remove them from Google?**

No. Robots.txt controls crawling and does not erase indexed pages, and blocking an address can stop Google from seeing that it is gone.

**When should I request a Google review, and how long does it take?**

Ask after the entire site is clean and the vulnerability is fixed. Google says hacked-site reviews may take from a few days to several weeks.

**Do I need to rebuild the site?**

Not always. It depends on how far the compromise goes, the condition of the software and whether you have a trustworthy clean backup to restore.

## Final Thoughts

Strange pages and hidden links on your domain usually mean someone added content through a weak point. Save the list of addresses, tell injected pages from legitimate ones, clean the files, database and accounts, and fix the way in. Then recheck with a fresh crawl and the status codes, and ask Google for a review once the whole site is clean.

Done in that order, the cleanup gives you a site you can trust again, a record of what changed and a lower chance of the same spam returning. Search results may take a while to settle, but you will know what you did and why.

If you would rather not do the file and database comparison alone, [Web Leveling](https://webleveling.com/) can review your site and tell you what the cleanup needs, with a [website security audit](https://webleveling.com/services/website-security-audit/) that sets out the scope in writing. If a focused fix is all it takes, we will say so. We work with small and medium businesses across the country and overseas. [Tell us what you are seeing on your site](https://webleveling.com/contact/), and we will help you decide what comes next.

## Terms

Spam cleanup words in this post

Tap a term to see what it means.

**Hacked content.** Content placed on your site without your permission through a security weakness.

**Cloaking.** Showing search engines different content from what people see, which can hide spam from the site owner.

**Injected page.** A page added to a site by an attacker, often missing from the CMS page list.

**Security issues report.** A Search Console report that lists hacked-content problems, with sample addresses and a way to request a review.

**URL Inspection.** A Search Console tool that shows how Google sees one address, including a live test.

**Robots.txt.** A file that tells crawlers which addresses they may fetch; it does not remove indexed pages.

- [AI agents tried 1,200 websites: what to check on yours first](https://webleveling.com/blog/ai-agents-hacked-100-websites-what-to-check/): Reuters reported AI agents attempting intrusions on more than 1,200 websites in one week. Start with admin accounts, updates, backups and logs.
- [WordPress EtherHiding malware: how to check your site](https://webleveling.com/blog/wordpress-etherhiding-malware/): Worried about the WordPress EtherHiding malware? Check wp-content/mu-plugins, your admin users and four database options, then know when to get help.
- [Contact Form Spam? Fix It Without Blocking Real Customers](https://webleveling.com/blog/contact-form-spam/): Contact form spam burying real leads? Start with your form's free built-in spam filter, then add a low-friction check, and keep every real inquiry visible.