Hidden casino or pharmacy spam on your website: the cleanup
A family restaurant's WordPress site looked normal to every visitor. Underneath, someone had slipped about seventy mentions of online casinos and thirty links to them into the home page, inside a block styled to be invisible. People could not see it; Google could. Searches for the restaurant's own name started showing casino words under its listing, and its ranking slid. The owner found out only when a customer mentioned it. Here is what was there, what was done, and what stops it coming back.
| Where | Before | After |
|---|---|---|
| Home page | a hidden block (display:none) with 68 casino mentions and 30 links out, added to the theme's footer file | removed; the footer file matches a clean copy of the theme line for line |
| Plugins | 14 installed; one abandoned slider plugin with a known hole, 3 more out of date, WordPress itself 5 releases behind | the abandoned plugin replaced, everything current, unused plugins deleted |
| Logins | 2 admin accounts nobody recognised; the owner's password reused from another site | unknown admins removed, every password changed, two-step login on |
| Files and database | a leftover file in the uploads folder that let anyone add content again | removed; uploads folder can no longer run code; a scan finds nothing |
| Before, Google showed casino words under the listing. After the cleanup, the home page was re-submitted in Google Search Console and the security report checked, so the spam drops out of results at Google's next crawl instead of whenever it gets round to it. | ||
What was wrong
This is not a design fault; it is a break-in. An out-of-date plugin let an automated script write to the site, and it did what these scripts are paid to do: plant links that borrow a real business's good name to push gambling or pharmacy sites up Google. Hiding them from visitors is deliberate, so the owner does not notice and the links stay up for months.
Before (in the page source, invisible on screen):
<div style="display:none">
<a href="https://casino-site.example/">best online casino</a> ... x30
</div>
After:
(nothing - the block, the file that re-added it, and the way in are gone)
How it was cleaned up
- Back up first, files and database, so nothing the business needs can be lost in the cleanup.
- Find every planted piece. Compare the site's files with clean copies of WordPress, the theme and each plugin, and search the database for the spam words and links. Planted spam rarely sits in just one place.
- Remove it, and the way back in. Delete the spam, the leftover file that re-added it, and any admin account nobody can account for.
- Close the hole. Update WordPress, the theme and every plugin, replace anything abandoned, delete what is unused, change every password and turn on two-step login.
- Tell Google. Re-submit the cleaned pages in Search Console and check its security report, so the listing recovers sooner.
- Check again a week later: page source, a site scan and the Google search above, to be sure nothing came back.
What it costs
A fixed price, quoted before anything is touched, and you pay only after the spam is gone and the re-check is clean. No password needed: WordPress lets you add a helper account, which you delete afterwards. Not on WordPress? Wix, Squarespace and Shopify sites can carry planted links too (usually through an embedded script or an app), and the same steps apply. If you would rather do it yourself, the steps above are all of it, and I will send you the list of what I found on your site, and where, for free.
The site in the table is a composite built for this demo, not a real business; the spam, the way in and the steps are the ones found on real small-business sites in October 2026. More before/after examples, and who I am: all demos.