Spam pages on your website: how to find, remove and recheck them

You search your own business name and find pages for products you have never sold. Or a customer sends a screenshot, or a tool flags links on your site that point to casino and pharmacy pages you never wrote. Spam pages on your website like these can mean someone added content without your permission. The way in may be a plugin with a known flaw, a stolen password or another access path.

That is a bad moment, and it is fixable in a set order. Save the list of strange addresses without opening them. Work out which pages are injected. Clean the files, the database and the accounts. Close the way in. Then recheck and ask Google for a review.

Taking down the visible page is only half the job. There are two tracks: cleaning up what Google has indexed, and repairing the weakness that let the content in. If you skip the second one, the spam can return.

What does it mean when strange pages or links show up on my site?

Google describes hacked content as material placed on your site without your permission, through a security weakness. Its hacked content help page lists examples such as pharmaceutical terms, unrelated links and spam text added to existing pages. Google's spam policies cover the cloaking trick that often goes with them.

Cloaking means showing search engines one thing and people another. That is why your own browser can show a normal page while Google lists something else. A clean-looking homepage does not tell you the site is clean.

Search Console's Security issues report can show the type of problem, the date it was detected and sample addresses. The sample may not be the full list. Treat it as a starting point.

Sucuri's 2023 hacked website report looked at 39,594 sites its own incident-response team cleaned and found SEO spam on 20.30% of them. That is Sucuri's figure for its own caseload, not a rate for all websites. It does show that this is a recognized pattern with a known cleanup path.

If the problem is bigger than spam, such as a locked-out admin account or a site that is down, start with our first 24 hours after a hack steps and come back here for the spam cleanup.

How do I find every spam page without opening them?

Start in Google, not on the suspicious pages. A few searches show what Google has indexed for your domain, and you never have to click a result. Replace yourdomain.com with your own address.

Look for unfamiliar titles, descriptions, languages, products, authors and dates. Open a suspicious result only with care. These searches show what is indexed. They cannot prove the files and database are clean.

Then work through Google's own tools, which follow the steps in its hacked site guidance and its page on site: searches and the Page indexing report:

1. Security issues: Open the report in Search Console and read any examples it lists.
2. Page indexing: Compare the indexed addresses with the pages you know you own.
3. URL Inspection: Run it on one suspicious address, then look at both the indexed view and a live test.
4. A link crawl: Crawl your site, export every internal and external link, and review destinations you do not recognize. This is how hidden outbound links show up.
5. Server logs: Check what Googlebot is asked for and what it receives, since cloaked content may not show in an ordinary browser. Google's security guidance recommends keeping an eye on logs.

Copy every suspicious address into a document before you change anything. Once the list is saved, you can prove later that each one is gone.

How do I tell an injected page from one my site created on purpose?

Some unfamiliar pages are legitimate. A plugin, a store or a booking tool can create pages with addresses you never typed. Deleting one of those breaks something real, so identify the page before you remove it. Google's guide to diagnosing a hacked site is a good companion for this step.

A page is more likely injected when it shows signs like these:

• Unrelated subject: A casino or pharmacy page on a plumbing site, for example.
• Unfamiliar address pattern: A string of letters or numbers you have never used.
• Unnatural repetition: The same keyword stuffed into the title and text.
• Foreign-language text: A language your business does not use.
• Mismatched dates or authors: A publish date or author name that does not fit your site.
• Missing from the CMS: The page is in Google but not in your page list.

A page made by a plugin usually has a clear purpose, a consistent template, a recognizable address pattern, working links in your site and a matching plugin or database record.

Compare each address with your CMS, sitemap, database, server files, a clean backup, analytics and your publishing history. A page that appears in the indexing report but cannot be traced to anything you or a tool you installed created deserves a closer look. Do not delete a page only because it is missing from your menu.

What does a full cleanup have to cover?

A cleanup removes the unwanted content and the access that let it in. If only the page goes, the backdoor, the extra account or the altered plugin can bring it back. Google's hacked content help and the WordPress hardening guide describe the same core work.

First, keep a clean backup, plus a copy of the affected files and logs if you can. Then work through this list:

• Remove what does not belong: Unauthorized pages, database records, links, scripts, administrator accounts, scheduled tasks and malicious files.
• Replace altered files: Swap changed core, theme and plugin files for clean copies.
• Prune and update: Delete plugins and themes you do not use, then update everything that stays.
• Repair the way in: Fix the weakness that allowed the content in, whether that was a plugin, a login or a permission setting.
• Rotate credentials: Change hosting, CMS, database, FTP or SFTP, email and administrator passwords.
• Add a second step: Turn on two-factor authentication wherever it is offered.

NIST's incident response guidance, SP 800-61 Rev. 3, published in April 2025, says the same thing in general terms. Cleanup means removing malware, disabling breached accounts and fixing the vulnerability that was exploited, followed by recovery from clean backups and tighter controls.

Plugins deserve special attention. Wordfence's 2024 annual WordPress security report found that 96% of the vulnerable software types disclosed that year were plugins, so an outdated or abandoned plugin is a likely place to look. Keeping them current is the kind of routine job our website maintenance work covers.

If you cannot reach the server files or find a clean backup, your host may be able to help. A hosting plan with backups and file access makes this far less painful, which is a good reason to look at web hosting before the next incident, not during it.

How do I recheck the site, and when do I ask Google for a review?

A normal browser view does not prove the site is clean, because attackers can hide content from owners. Recheck with evidence, using the list you saved earlier.

The status codes matter. A 404 or 410 tells Google a page should not exist, and Google's redirect guidance covers when a redirect fits. A redirect to a real, related page is fine. A redirect that sends spam addresses to your homepage is not a repair.

Do not block spam addresses in robots.txt. As Google's robots.txt introduction explains, the file controls crawling and does not remove a page from the index. Blocking can also stop Google from seeing that the page is gone. If you want help testing forms, redirects and key pages after cleanup, that is what quality assurance testing is for.

When the whole site is clean, open Search Console's Security issues report and select Request a review. Describe what you removed and how you fixed the entry point. Google says hacked-site reviews can take from a few days to several weeks, so plan for a wait. Then watch the Page indexing report for the spam addresses to drop out, and see our Search Console email guide for what the follow-up messages mean. If rankings need a closer look afterward, search engine optimization is the next step.

When is a focused cleanup enough, and when has the job grown?

A focused cleanup, a software update, a credential reset and a round of checks may be all your site needs. If the damage is a few injected records on a platform that can still be supported, that is a reasonable scope, and it does not call for a redesign or an open-ended retainer.

The job is larger when signs like these show up.

No one can promise a fixed price, instant removal from Google or permanent immunity without examining your site. Before you pay for ongoing work, ask for the evidence, the scope, what is included, what is excluded and the follow-up checks in writing. Our malware removal cost guide shows how to read a quote, and our write-up on WordPress EtherHiding malware covers one WordPress malware pattern to check for.

Frequently Asked Questions About Removing Spam Pages From Your Website

Why are random pages appearing on my website?

A weakness or a compromised account may have let someone add pages or links without your permission. Check Search Console's Security issues report and compare indexed addresses with your real pages.

Can a hacked site look normal?

Yes. Attackers can cloak content or place it only on new addresses, so your homepage may look fine while Google lists something else.

Should I just delete the spam pages?

Remove the unauthorized content, but also find and repair the access path that created it. Deleting the page alone leaves the way in open.

Will robots.txt remove them from Google?

No. Robots.txt controls crawling and does not erase indexed pages, and blocking an address can stop Google from seeing that it is gone.

When should I request a Google review, and how long does it take?

Ask after the entire site is clean and the vulnerability is fixed. Google says hacked-site reviews may take from a few days to several weeks.

Do I need to rebuild the site?

Not always. It depends on how far the compromise goes, the condition of the software and whether you have a trustworthy clean backup to restore.

Final Thoughts

Strange pages and hidden links on your domain usually mean someone added content through a weak point. Save the list of addresses, tell injected pages from legitimate ones, clean the files, database and accounts, and fix the way in. Then recheck with a fresh crawl and the status codes, and ask Google for a review once the whole site is clean.

Done in that order, the cleanup gives you a site you can trust again, a record of what changed and a lower chance of the same spam returning. Search results may take a while to settle, but you will know what you did and why.

If you would rather not do the file and database comparison alone, Web Leveling can review your site and tell you what the cleanup needs, with a website security audit that sets out the scope in writing. If a focused fix is all it takes, we will say so. We work with small and medium businesses across the country and overseas. Tell us what you are seeing on your site, and we will help you decide what comes next.

Terms