If you’re reading this, chances are your website has been hacked or you’re suddenly seeing:
- Fake pages indexed in Google
- Japanese/Chinese spam
- Casino/pharmacy redirects
- Spike of strange URLs in Google Search Console
- A user added to your Google Search Console
- Your rankings suddenly dropped
You’re not alone — 2025 continues to be the worst year for WordPress SEO hacks, especially with:
- Outdated plugins
- Cheap hosting
- Password reuse
- No MFA on admin
- Malware hiding inside themes/uploads
This guide explains exactly what a website owner can do, even without coding or server skills.
1. Understand Why You Got Hacked
Hackers don’t target you, they target:
- outdated WordPress versions
- vulnerable plugins
- pirated themes
- weak passwords
- hosts that don’t isolate websites
SEO spam hacks are the most common because hackers want:
- free backlinks
- free traffic
- free hosting to run illegal pages
- access to your Google Search Console
This is why Google suddenly shows foreign pages or redirects.
2. Immediate Actions (Do These First)
Step 1: Set your site in “Emergency Mode”
Do one of these quickly:
- Activate maintenance mode
- Temporarily block the site with Cloudflare
- Remove public access for 24–48 hours
This stops the hacker from continuing damage.
Step 2: Change ALL passwords
Change passwords for:
- WordPress admin
- Hosting account
- cPanel/Plesk
- FTP/SFTP
- Database
- Cloudflare
- Google account
Use MFA (2-step authentication) everywhere.
Step 3: Remove any new admins in WordPress
Go to:
Users → All Users → Sort by Administrator
Delete anything suspicious.
3. Clean Up Google Search Console After a Hack
Most owners miss this part.
Hackers sometimes add themselves to your Google Search Console to:
- request indexing
- hide hacked pages
- submit bad sitemaps
How to check:
- Go to Google Search Console
- Settings → Users and Permissions
- Remove anyone you don’t recognize
- Make sure you are the ONLY owner
Check for bad sitemaps
Go to Indexing → Sitemaps
Delete:
- unknown XML files
- spammy sitemaps
- auto-generated sitemaps by hackers
Check for Injected URLs
Go to:
Indexing → Pages → View “Crawled — currently not indexed”
Look for:
- /japanese/…
- /casino/…
- /wp-content/uploads/…php
- /weird-keywords/
These are hacked pages.
4. Scan Your Site (Easy, Non-Technical Tools)
Use at least two of these free scanners:
- Wordfence Scan (Free)
- Sucuri SiteCheck
- Patchstack Security
- Cloudflare Security Events
If they detect malware, you will see:
- injected JS
- backdoor PHP files
- hidden admin users
- SEO spam templates
- redirect code
5. How to Repair Your WordPress Site (Without Developer Skills)
Option A: Restore a clean backup
If you have:
- host-provided daily backups
- plugin backups (UpdraftPlus, JetBackup, etc.)
Restore the latest clean version.
Option B: Use a 1-click cleaning plugin (2026 editions)
The best cleaning plugins for website owners:
- Wordfence → “Repair File”
- iThemes Security Pro Cleanup
- Patchstack Auto-Patching
- Malcare Auto-Clean (paid)
6. Notify Google That the Hack Is Fixed
Once your site is clean:
Request Google to re-crawl
Google Search Console → URL Inspection → Request Indexing
Remove bad URLs
Use:
Indexing → Removals
Add the bad URLs you found.
Submit your main sitemap again
/sitemap.xml
/wp-sitemap.xml
7. Prevent This From Happening Again (Best Practices)
✔ Weekly Updates
Update:
- WordPress
- Plugins
- Themes
✔ Delete unused plugins/themes
Most hacks come from plugins you don’t use.
✔ Turn on MFA on WordPress login
Use:
- Wordfence MFA
- Google Authenticator
- Jetpack MFA
✔ Use Cloudflare Security
- Bot protection
- Firewall rules
- Rate limiting
- Country blocking (optional)
✔ Switch to secure hosting
Bad hosting = guaranteed hacks.
Choose:
- Cloudflare + VPS
- Kinsta
- WP Engine
✔ Automatic backups kept offsite
- Backblaze
- AWS S3
- Google Cloud
✔ Limit login attempts
Stops brute force attacks.
? FAQ: WordPress Hacked & SEO Spam Issues
1. How do I know if my WordPress site is hacked?
Common signs include redirects to spam websites, new admin accounts you didn’t create, unknown files in wp-content/uploads, Japanese/foreign text pages, and sudden drops in Google traffic.
2. Why is Google showing Japanese or casino pages for my site?
This is an SEO spam hack where attackers inject hidden pages to hijack your rankings. These pages often live inside /uploads/ or use fake sitemaps to trick Google.
3. How do I remove a hacker from Google Search Console?
Go to:
Search Console → Settings → Users & Permissions
Remove any unknown users and make sure you are the ONLY verified owner.
4. Can a hacked site hurt my Google SEO?
Yes. Google may deindex your pages or rank you lower if it detects spam, malware, or redirect hacks. Cleaning the site quickly helps prevent long-term damage.
5. What’s the first thing I should do when my WordPress site gets hacked?
Change all passwords, remove suspicious admins, put the site in maintenance mode, and scan with Wordfence or Sucuri.
6. Do I need to reinstall WordPress to fix a hack?
Not always. Many hacks can be cleaned by removing infected files, repairing core files, and restoring clean backups. Reinstallation is recommended only when the infection is severe.
7. Why do hackers target WordPress websites?
Because outdated plugins, weak passwords, and cheap hosting environments give them easy access. They usually don’t target you — they target thousands of vulnerable sites at once.
8. How do I remove spam URLs from Google search results?
Use the “Removals” tool in Search Console and then fix the site. Removing URLs without fixing the hack will not solve the issue.
9. How do I stop my WordPress site from getting hacked again?
Enable two-factor authentication, keep everything updated, delete unused plugins, switch to better hosting, activate Cloudflare WAF, and keep daily off-site backups.
10. Should I hire a professional to clean a hacked site?
If you’ve already been hacked multiple times, or Google still shows spam after cleanup, a professional can remove deep infections that automated tools may miss.
If you’ve been hacked repeatedly, you may need a professionally supervised cleanup and long-term security setup.
Ali Khansari @webconsultant247
WordPress Security • Malware Cleanup • SEO Damage Repair