WordPress Pharma Hack: Removing Hidden Drug Spam Pages and Cloaking

What matters first: A pharma hack injects or generates pages about medicines, often showing different content to search crawlers and normal visitors. The incident includes the payload, persistence, entry point and indexed URLs.

What this symptom actually tells you

Search results can remain polluted after the visible site looks normal. You need to map where the spam is generated, what recreates it and which URLs Google has discovered.

Capture evidence before changing anything

• Export affected URLs and query patterns from Search Console.
• Compare crawler and normal-browser responses for representative URLs.
• Search files, database options, posts, rewrite rules, mu-plugins and cron.
• Record unexpected users, modified files and vulnerable components.

Most common causes

• Database injection: Spam titles, links or templates are stored in posts or options.
• Dynamic cloaking: PHP generates pharma content only for search referrers or crawler user agents.
• Rewrite generator: Rules turn arbitrary keyword paths into indexable responses.
• Persistent backdoor: A scheduled task or hidden loader restores deleted spam.

Safe diagnostic and repair sequence

1. Preserve a database and file snapshot before cleanup.
2. Remove the generator and persistence, then replace compromised code with clean packages.
3. Close the entry point and rotate WordPress, hosting, SFTP and database credentials.
4. Return correct 404 or 410 responses for removed spam URLs and clean the sitemap.

How to choose between the likely causes

Do not treat Database injection and Dynamic cloaking as interchangeable. Spam titles, links or templates are stored in posts or options. By contrast, pHP generates pharma content only for search referrers or crawler user agents. Use two checks to separate them: Export affected URLs and query patterns from Search Console; and compare crawler and normal-browser responses for representative URLs. Those observations usually show whether the next safe move is to preserve a database and file snapshot before cleanup or to preserve the current state and widen the investigation.

On a compromised site, containment and cleanup are separate decisions. Preserve the suspicious artefact and access logs before removing persistence, then rotate credentials only after the active path has been closed. Record the exact timestamp, affected URL or transaction, last known good state and every change made during diagnosis. That handover is often what separates a repeatable repair from a temporary disappearance of the symptom.

What not to do

Do not request a search review until live inspection is clean under the same crawler conditions that revealed the spam.

How to verify the repair

• No new pharma URLs are generated.
• Representative spam URLs return the intended status and are absent from sitemaps.
• File integrity, users and cron remain stable through several cycles.

A visible symptom disappearing is not enough. Close the incident only when the original failing action, the surrounding business journey and the relevant logs all agree that the fault is gone.