A WordPress pharma hack adds pharmacy-related spam pages or links to your site, usually while hiding them from you and regular visitors. Google may index drug names, product pages, or outbound links that are absent from the WordPress editor. Fix it by confirming what search engines received, removing the code and database changes that create it, then making the spam URLs return a proper not-found response.
What a WordPress pharma hack looks like
A pharma hack borrows your domain's reputation to promote prescription drugs, supplements, or online pharmacies. The content may appear as full pages, hidden keyword-rich blocks, footer links, or links injected into existing posts. The attacker may show it only to recognized crawlers, visitors from a search engine, or visitors who are not logged in.
That selective behavior is called cloaking. It explains a frustrating pattern: the site looks normal in the dashboard and in your everyday browser, yet Google result pages show pharmacy terms under your brand. An apparently clean home page is useful evidence, but it is not a cleanup result.
If the problem is visible in search, document a few examples before changing anything. Save the result title, URL, date, and any unexpected destination it links to. Take a full backup of files and database as well. This gives you a recovery reference and prevents a hurried edit from erasing the trail to the original entry point.
Check the version Google crawled
Search Console URL Inspection is the best starting point because it separates what your browser sees from Google's recorded crawl. Paste a suspicious URL into URL Inspection, then open the page's crawl details. Look for the crawled page or rendered content option, if available, and compare the text, links, and response with what you see in a private browser window.
Search your domain in Google too. Start with site:yourdomain.com and then try site:yourdomain.com viagra, site:yourdomain.com cialis, or a drug term shown in the suspicious results. Look for unexpected titles, descriptions, paths, and cached-looking product pages. These searches are not complete inventories, but they help identify patterns and affected URL prefixes.
Use different conditions when checking a URL. Try a signed-out private window, a phone, and a visit from a Google result. Do not repeatedly click unknown pharmacy destinations. You are testing your own domain's response, not validating the spam advertiser. Record differences such as a changed title, extra links in page source, or content that appears only after the page loads.
Search Console's Pages report can reveal groups of discovered URLs that were never part of your site. Check Security Issues too, but do not assume an empty Security Issues report means the site is clean. Its purpose is warnings Google has detected, not a complete malware scan.
Find the code that serves the spam
The location depends on the infection, so inspect files and the database together. Start with WordPress integrity: wp core verify-checksums will identify modified core files when run from the site directory through WP-CLI. Replace altered core files with fresh WordPress files, and reinstall plugins and themes from their original trusted downloads.
Check the database, especially wp_options or the equivalent table if your site uses a custom prefix. Attackers often store encoded JavaScript, remote URLs, autoloaded payloads, or settings that regenerate links. Review unusual recent options, options with misleading names, and any large value that does not belong to a known plugin. Also check post content, widgets, and user records for injected links or unfamiliar administrators.
Review the active theme's functions.php, plus any child theme and mu-plugins directory. Theme functions can add content to every page and are an effective place to hide spam links. Search for unfamiliar callbacks, obfuscated strings, code that checks the visitor's user agent or referrer, and code that fetches content from another domain. A legitimate plugin can have complex code, so compare it with a fresh official copy before declaring a line malicious.
Fake plugins are common persistence. Look for plugin folders and entries in the Plugins screen that you cannot identify, plugins named to resemble WordPress components, and inactive plugins left behind from old work. A plugin directory can run code even when its name looks harmless. Check wp-content/plugins, wp-content/mu-plugins, and PHP files in wp-content/uploads, where PHP is generally out of place.
Do not overlook scheduled tasks and server-level configuration. A cron event can reinsert database spam, and a web-server rule can route bots to a different script. Review .htaccess, wp-config.php, active crons, and the hosting account for unfamiliar users or deployment credentials.
Remove the infection without leaving a backdoor
Cleanup needs to remove both the visible pharmacy text and the mechanism that creates it. Deleting a spam post is not enough if a malicious option, plugin, or hidden PHP file recreates it overnight. Work methodically.
- Restrict access to trusted administrators and make a complete backup of the current state.
- Reset all WordPress administrator, hosting, SFTP or SSH, database, and control-panel credentials. Rotate application keys where relevant.
- Remove unknown WordPress administrators, hosting users, API keys, scheduled tasks, and Search Console users. Check that no valid admin account has an unfamiliar email address.
- Replace WordPress core, plugins, and themes with clean copies. Remove unused themes and plugins instead of leaving old code installed.
- Remove the malicious database values, injected links, and PHP or JavaScript after confirming their source. Check whether a cron or another file recreates them.
- Update every retained component and fix the weakness that provided access, such as a vulnerable extension or reused password.
- Test representative pages while logged out and in a private browser. Recheck the URLs in Search Console after Google has recrawled them.
If you cannot account for every suspicious file and database change, treat the cleanup as incomplete. Finding WordPress backdoors is particularly important after cloaked spam because attackers often want ongoing access. For a site that processes orders or customer data, an independent security audit can validate that the application and hosting configuration are not still exposed.
Clear the spam pages from search results
Once the server returns a clean response, make fake pharmacy URLs return 404 Not Found, or 410 Gone when they are permanently removed. Do not redirect every spam URL to the home page. A generic redirect can make it harder for search engines to understand that the old page is gone.
Use Search Console's Removals tool to temporarily hide urgent result pages or a well-defined spam prefix. This is a short-term visibility measure, not a repair. Google will remove the indexed content as it recrawls the clean URLs, and URL Inspection can help you monitor key examples.
Review submitted and discovered sitemaps. Remove spam sitemaps and ensure your legitimate sitemap does not list fake URLs. Check Search Console over the following weeks for fresh pharmacy terms or newly discovered paths. A recurrence is evidence that persistence or the original access route remains.
Prevent another pharma hack
The practical defense is routine maintenance and narrow access. Apply WordPress, plugin, and theme updates promptly after testing them. Remove unused extensions, especially abandoned ones, and do not install nulled themes or plugins. Use unique credentials and multi-factor authentication for hosting and WordPress where available.
Keep backups that are separate from the production account and test restoring them. Monitor administrator accounts, file changes, scheduled tasks, and Search Console permissions. The WordPress hardening checklist is a useful baseline for turning those items into scheduled work.
When to get help
Get help if the spam is cloaked, comes back after removal, or you cannot trace every modified component. West Oakbridge provides WordPress malware removal and WordPress hardening for sites that need a complete cleanup and a safer configuration.