SEO spam: how to clean and protect your WordPress site

How to remove SEO spam from your WordPress site

A heads-up before you start: cleaning SEO spam properly involves direct file editing, database changes, and command-line work in places. If you’re not comfortable with this, hire a WordPress security professional. The cost of a botched cleanup is usually higher than paying someone to do it right. A bad cleanup that leaves even small remnants of malicious code often results in reinfection within days.

If you’re handling it yourself, here are the steps.

Step 1: Back up your site

Before changing anything, take a full backup of your site as it currently exists, infected or not. Kadence Security can do this automatically. If you’re working manually, back up both the file system (via FTP) and the database (via phpMyAdmin or a backup plugin).

You want the backup for two reasons: in case you accidentally break something during cleanup, and in case you need to compare the infected version against a clean version later.

Step 2: Run a full security scan

A WordPress security plugin with site scanning will identify most known vulnerabilities and malware signatures. The scan will flag suspicious files, outdated plugins with known vulnerabilities, and any modified core files. Note the results before doing anything else, since you’ll want a reference point to compare against once cleanup is complete.

Step 3: Identify and remove infected files

Go to your /wp-content/ folder via SFTP or your hosting provider’s File Manager. Look for files that don’t belong: unfamiliar PHP files, files with unusual names like .cache, .class, or .old (which attackers use to disguise malicious files as legitimate plugin files), and recently modified files in folders you haven’t touched.

Pay particular attention to:

• The folder:/wp-content/uploads/. This shouldn’t contain PHP files at all. Any PHP file here is almost always malicious.
• Folder: /wp-content/plugins/. Look for plugins you don’t recognize or didn’t install.
• The folder: /wp-content/themes/. Check your active theme’s functions.php for unfamiliar code, especially near the top or bottom of the file.

When in doubt, replace plugin and theme files with fresh copies downloaded from WordPress.org or the original developer.

Step 4: Clean your .htaccess file

The .htaccess file in your WordPress root directory controls server-level rewrites and redirects. Attackers love it because they can hijack search engine traffic through it. Open the file and look for unexpected rewrite rules.

A typical SEO spam .htaccess injection looks something like this:

RewriteEngine On
RewriteCond %{ENV:REDIRECT_STATUS} 200
RewriteRule ^ - [L]
RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing) [OR]
RewriteCond %{HTTP_REFERER} (google|yahoo|msn|aol|bing)
RewriteRule ^(.*)$ somehackfile.php?$1 [L]

What this code does: it checks whether the visitor is a search engine crawler or arrived from a search result. If so, it redirects them to an attacker-controlled file (somehackfile.php). Regular visitors see your normal site. Search engines see whatever the attacker wants them to see. This is classic cloaking.

To clean it, delete any rewrite rules you don’t recognize. If you’re not sure which rules are legitimate, rename your current .htaccess to .htaccess.old, then go to your WordPress dashboard, go to Settings > Permalinks, and click Save Changes. WordPress will regenerate a clean .htaccess file.

Step 5: Check your database for injected content

Connect to your database through phpMyAdmin (most hosting control panels include this) and look for injected content in two places:

The wp_posts table. Search for suspicious content in your existing posts, especially tags, base64-encoded strings, or links to unfamiliar domains. Pay attention to posts with statuses you didn’t set or authors you don’t recognize.

The wp_options table. Look for unusual entries, particularly anything that contains JavaScript or links to external sites. The siteurl and home values should both match your actual domain.

Code injected to hide its purpose often uses base64 encoding. A URL like aGFja2VyZG9tYWluLmNvbQ== is base64 for hackerdomain.com. If you see base64 strings in places that shouldn’t contain them, that’s a red flag worth investigating.

Step 6: Search for base64 encodings across files

If you have SSH access to your server (or you’ve downloaded your site files locally), you can find base64-encoded content across all PHP files with this command:

find . -name "*.php" -exec grep -l "base64" {} \; > b64-detections.txt

This searches every PHP file in the current directory and below for any reference to “base64” and saves the results to b64-detections.txt. Not every match is malicious (some plugins use base64 legitimately), but the output gives you a starting list of files to review.

Step 7: Remove unauthorized users

Go to Users > All Users in your WordPress dashboard and delete any user accounts you don’t recognize. Pay particular attention to admin and editor accounts. Some 2025 backdoor variants recreate deleted admin accounts automatically, so monitor your user list for the next few days after cleanup.

Step 8: Update everything

Update WordPress core, every plugin, and every theme to the latest version. Most successful SEO spam attacks exploit known vulnerabilities that have patches available. Updating closes the door behind you.

Step 9: Reset all credentials

Change passwords for every admin account, your database user, your hosting account, and your FTP credentials. Use strong, unique passwords for each one. If you weren’t using a password manager before, now is the time to start.

Step 10: Scan again

Run a second full security scan once cleanup is complete. Compare the results against your pre-cleanup scan. If new issues appear that weren’t there before, you may have introduced something during the cleanup process or missed an injection. If old issues are still there, repeat the relevant steps until the scan comes back clean.

Step 11: Request a Google review

If your site was flagged in Google Search Console, submit a reconsideration request once cleanup is complete. Include a brief description of what happened, what you removed, and what you’re doing to prevent it from happening again. Google typically responds within a few days.