A pharma hack is SEO spam that hides links and pages for cheap drugs on your website, shown to Google but not to you. Your site looks normal in your browser, while Google sees ads for pills and quietly trusts your site less. You find it by looking at your site the way Google does: through search results and Google Search Console.
Key takeaways
- Pharma and other SEO spam is built to stay hidden from the owner. Looking at your home page proves nothing.
- Google’s own tools show what its crawler sees: a site: search, the Security issues report and URL Inspection.
- Google’s spam policies say affected sites may rank lower or drop out of results.
- The spam is a symptom. A proper fix finds the backdoor and the way in, not just the links.
What is a pharma hack?
It’s a type of SEO spam. Attackers break into a website and use its good name in Google to promote pages selling erectile dysfunction pills, weight-loss drugs and other dodgy products. The same trick sells casinos, fake designer goods and loans.
Google’s Search Console names the main forms. Content injection is when “a hacker has added spammy links or text to your site’s pages”. URL injection is when “a hacker has created new pages on your site, often containing spammy words or links” (Google Search Console Help).
It’s common. Sucuri, a website security company, detected SEO spam on 42.22% of the infected websites it saw in 2023 (Sucuri).
Why can’t I see the spam on my own website?
Because it’s designed that way. The malicious code checks who is asking for each page before it answers. Google calls this cloaking: “presenting different content to users and search engines” (Google Search Central).
Some versions skip cloaking and hide links with code instead, such as text set to be invisible. Google’s spam policies list hidden text and links, and links injected through CSS or HTML, as forms of spam and hacked content. Others go further and send visitors who click through from Google to a pharmacy site, which our article on the WordPress redirect hack covers.
What does it do to my business?
Google’s spam policies are blunt. Sites that break them “may rank lower in results or not appear in results at all”. Google can also show “a warning label in search results or an interstitial warning page in the browser” for hacked sites, according to the same Search Console help page.
In our experience, the first sign is usually a slow slide in enquiries, or a customer asking why your Google listing mentions pills. The same break-in can also be used to plant other things, such as a phishing page on my website, so treat SEO spam as a full compromise.
How do I check for SEO spam from Google’s side?
None of these checks needs technical skill beyond logging in to Google Search Console.
- Search your own site. In Google, type
site:yourdomain.com.au viagra, then repeat with words like cialis, casino, pills and loans. Any result means spam has been indexed. - Scan all your results. Search
site:yourdomain.com.auand look for titles you didn’t write and long, random addresses. - Open the Security issues report. In Google Search Console, this lists any hacked content Google has found on your site.
- Check the Performance report. Look at the search queries your site appears for. Drug names or casino terms are a strong sign.
- Use URL Inspection. Inspect a suspect address, click View crawled page, and read the HTML Google stored. Then click Test live URL to see what Google gets today (Search Console Help).
- Check users and sitemaps. An owner you don’t recognise in Search Console, or a sitemap you didn’t add, means someone else has been helping Google find their pages.
Don’t trust a “Not Found” page. Google warns that hackers try “to trick you into thinking the page is gone or fixed when it’s still hacked” (web.dev). If your site shows Japanese text in results rather than drug names, our guide to the Japanese keyword hack covers that variant.
Why isn’t deleting the spam links enough?
Because something put them there, and it will do it again. The spam usually comes from a backdoor file, malicious code in the database or a rogue admin account. Sucuri’s 2023 report found backdoors on 49% of compromised sites and malicious admin users in 55% of infected databases.
Google’s guide to this hack cites a study finding that “20% of hacked sites get hacked again within one day”. A clean-up has to remove the spam, the code that creates it and the hole the attacker used, usually an out-of-date plugin or a stolen password.
Our step-by-step guide for when a website hacked situation hits explains the full recovery. If you’re weighing up a clean-up yourself, read how to remove malware from WordPress first. Cloaked spam is hard to clean by hand, because you can’t see it working.
What happens after the clean-up?
The spam addresses should return a “not found” or “gone” error, so Google drops them as it recrawls. If Search Console flagged a security issue, request a review once every page is clean. Google says a security review “can take from a few days to a few weeks to complete”.
Then keep plugins updated, turn on two-factor login and remove anything unused. Secure web hosting helps too, with account isolation, a firewall and server-level scanning.
If you’d rather not do this yourself, our hacked website repair service handles the clean-up. Ongoing website maintenance plans then keep watch, with daily malware scans and blacklist monitoring. Sites on Maintain & Protect are covered by “hack-free or we fix it free”.
Frequently asked questions
Why does Google show drug names for my website?
Usually because the site has been hacked with SEO spam. Attackers add pages or hidden links about pharmaceuticals and show them only to Google. Your site can look normal to you while Google indexes the spam. Check the Security issues report and URL Inspection in Search Console to see what Google sees.
Can SEO spam be on my site without a security warning?
Yes. Google doesn’t flag every hacked site straight away, and some spam stays below the radar for months. A clean Security issues report isn’t proof the site is clean. Run site: searches for spam words and check your search queries in the Performance report as well.
Will my rankings come back after the spam is removed?
Usually, though it isn’t instant. Google needs to recrawl the site and, if a security issue was flagged, complete a review, which can take days or weeks. Rankings tend to recover as the spam pages drop out and Google trusts the site again. There’s no guaranteed timeline.
Does a security plugin catch pharma hacks?
Sometimes. Scanners catch known patterns, but cloaked spam may only appear for Google’s crawler or be stored in the database. A plugin also runs inside the site it’s protecting, so a serious infection can tamper with it. Combine scanning with Search Console checks and server-level monitoring.
Is a pharma hack only a WordPress problem?
No. Any website that runs code, such as Joomla, Drupal or a custom PHP site, can be hit. WordPress sees it most because it runs so many sites and has so many plugins. The way in is usually an out-of-date plugin, theme or extension, or a stolen password.
Sources
- Security issues report, Google Search Console Help, accessed 13 November 2026
- Spam policies for Google web search, Google Search Central, accessed 13 November 2026
- Fix the cloaked keywords and links hack, web.dev (Google), accessed 13 November 2026
- URL Inspection tool, Google Search Console Help, accessed 13 November 2026
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024