This one is a little embarrassing to write, because it happened to us.
When we rebuilt web-tronix.com this year, we went through Google Analytics to see which old pages people were still landing on. Our home page, careers and the about page were there, as expected. So was "club player casino no deposit bonus codes for free spins". And "free slot games with bonus rounds". And dozens more like them.
None of those pages were ours. At some point our old WordPress site had been broken into, and someone had quietly planted spam pages on it. They didn't deface anything or lock us out. They just used our domain, which Google had trusted for years, to rank their casino pages.
How it usually happens
We can't say for certain which door they came in through, but on WordPress it's nearly always one of three things:
- an old plugin or theme that hadn't been updated, with a known hole in it
- a weak or reused admin password
- a "nulled" (pirated) premium plugin with something extra baked in
The nasty part is that this kind of hack is designed not to be noticed. The pages often don't appear in your menus or your admin. Some only show up for Googlebot, so when you visit the site yourself, everything looks normal.
What we did
Rebuilding the site on new technology took the hacked WordPress install out of the picture completely, so the infection itself was gone. But Google still remembered all those spam addresses, and people were still clicking them. Cleaning up search took a few more steps.
1. We listed every old address. We pulled the pages people had visited from Analytics, and the full list of addresses the Internet Archive had ever seen on our domain. That gave us both the real old pages and the spam.
2. Real old pages got a permanent redirect. Things like /about-us.html and /careers/2/ now send people (and Google) to the matching new page with a 301 redirect. That keeps whatever ranking those pages had built up.
3. Spam pages now answer "410 Gone". A normal missing page answers 404, which tells Google "not found, maybe check again later". A 410 says "this is gone for good, stop asking". Google drops 410 pages faster. We matched the spam by the words it used (casino, slots, bonus, roulette and so on), so new spam addresses we haven't seen yet get the same answer.
4. We asked Google to hide the worst ones right away. In Search Console, the Removals tool hides a page from results for about six months. We submitted the spam pages that were getting traffic, and the 410 answer takes care of removing them for good while they're hidden.
5. We checked for penalties. Search Console has a Security issues report and a Manual actions report. Both were clean, which means Google had never flagged the site. If yours shows a problem, fix it first, then use the "Request review" button on that report.
If you think it's happened to you
Search Google for site:yourdomain.com casino (try "viagra" and "loan" too). If pages come up that you never wrote, you've got the same problem. Don't just delete the pages you can see: whoever got in can usually get back in. Find out how they got in, close that hole, change every password, then deal with search.
If you'd rather not do it alone, our urgent help team does this kind of cleanup, and you can usually reach someone the same day.