Spam pages on your website: why they're there and what they cost you

Why they're on your site

A brand-new website has no standing with Google. Yours has years of it: other sites that link to you, a history, a real business behind the name. Spam pages planted on your domain borrow that standing to rank for searches you would never want, such as online casinos, cheap pills, payday loans and fake designer goods. The people behind them make their money from the visitors those pages catch.

The pages are made to stay out of your way. They aren't in your menus, some aren't in your site's admin at all, and some are only shown to Google. Google's own help pages describe the common kinds by what they look like, such as the Japanese keywords hack, where pages of Japanese text selling fake brand goods appear on an English site.

It's rarely personal. The usual ways in are software left out of date, a plugin with a known weakness, and a password that leaked or was easy to guess, and the people doing this run tools that try site after site, looking for any of them.

What they cost you

• Your place in Google. Google's spam policies say hacked sites “may rank lower... or not appear in results at all”. The pages you rely on for work can slip down the results, or drop out.
• Your name in the results. People searching for your business can see casino or pill titles under it, and Google may add “This site may be hacked” to your listing.
• Warnings and suspensions. If the hack also serves harmful code, browsers can show a red warning before your site opens, and a hosting company can suspend a site to protect its other customers.
• Trust. A customer who lands on a page selling pills under your name doesn't stop to work out who put it there.
• Worse to come. The way in that let the spam pages on can be used again for something worse, such as code that copies what customers type into a checkout.

How to find them

1. Search Google for site:yourdomain.co.uk, with your own domain, and read the titles. Then add the words spam uses, one at a time: casino, loan, viagra, replica.
2. Read the searches you're found for. In Search Console's Performance report, searches in another language, or for things you don't sell, mean spam pages are getting visits under your name.
3. Watch the page count. In Search Console's page indexing report, a sudden jump in the pages Google holds, when you haven't added any, is the same sign.
4. Check who else has a say. In Search Console's settings, look under Users and permissions for an owner you didn't add, and in the Sitemaps report for a sitemap you didn't submit. Spammers add both.

No Search Console? It's free from Google, and setting it up proves to Google that the site is yours. It's worth doing today, hacked or not.

Clean the site first

Getting the pages out of Google while the hack is still on your site doesn't work, because the code that made them makes them again. Clean the site, close the way in and update everything, then deal with Google. Our guide to the first hour after a hack sets out the order.

How to get them out of Google

1. Let the spam addresses answer “not found”. Once the code is gone they should return 404 (not found) or 410 (gone), which tells Google to drop them. Don't send them all to your home page instead.
2. Don't block them in robots.txt. It feels like the right move, but it stops Google seeing that the pages have gone, so they stay in the results for longer.
3. Remove the spammers' owner and sitemap from Search Console, if they added them, and the verification file or tag they left on your site, or they can verify themselves again.
4. Hide the worst quickly. Search Console's Removals tool takes pages out of Google's results for about six months, and can take out a whole folder at once. It buys time while Google sees the pages have really gone; it isn't a fix on its own.
5. Ask for a review in the Security issues report, if it lists a problem, once the site is clean.
6. Send Google your own sitemap again, so it reads the pages you want found.

Google drops each spam page when it next visits it, so the list shrinks over weeks, not hours. Run the site: search every week until it's clean.

Stop it happening again

Keep the platform, plugins and themes up to date, delete what you don't use, give everyone their own login with two-step login on, and keep a recent backup somewhere other than the site. Then have someone watching: AI Secure Care checks your site day and night for the signs of a break-in and tells you the same day, in plain words, from £49 a month.