WordPress Pharma Hack: How to Find and Fix It

The WordPress pharma hack is a strange crime. Nobody steals anything and your site looks normal to you. But in Google, your clothing shop or plumbing business quietly sells pills.

It is called the pharma hack because the usual product is cheap drugs, though the same trick is used for casinos, watches and loans. This guide covers how it works, how to see it even when it is hidden from you, where it lives, the order to clean it, and how to get Google to recheck your site afterwards.

How the WordPress Pharma Hack Works

Attackers get into your site, usually through an outdated plugin, a weak password or a stolen login. Then they plant code that does one or both of these:

• Injects pages. Hundreds or thousands of generated pages stuffed with drug names, sometimes with their own URLs on your domain.
• Injects links. Hidden links to the attacker's shops, placed in your existing pages, your footer or your posts.

The point is your site's reputation. A domain with years of history and good links is valuable. Spam on it ranks faster than spam on a brand new site.

Why You Cannot See It

The clever part is cloaking: showing different content to different visitors. Google's spam policies list cloaking as presenting different content to users and to search engines, and treat hacked content as a separate problem.

The planted code checks who is asking. If it looks like Googlebot, or the visitor arrived from a search result, it serves the spam. If it looks like a logged-in site owner, it serves the normal page. So you can browse your site all day and see nothing, while Google sees a pill shop.

That is also why the pharma hack lasts for months. The owner finds out when traffic falls, or when a customer sends a screenshot of a search result that says something strange.

Key takeaway: If the infection hides from you, checking your site in your own browser proves nothing. You have to look the way Google looks.

How to Detect a WordPress Pharma Hack

These checks go from fastest to most thorough. Do the first three before you touch anything.

1. Search Google for your site plus a drug term. Type site:yourdomain.com pharmacy and try a few others, such as viagra or cialis. Google's own guidance suggests searching for terms like these. Real results from your domain mean pages exist that you did not write.
2. Scan the plain site: listing. Search site:yourdomain.com alone and scroll. Look for titles that have nothing to do with your business, or for odd URL patterns such as /?p= followed by a strange string.
3. Open the Security Issues report in Search Console. If Google has spotted the injection, the report lists it with example URLs. Google's Security issues report help describes the "content injection" category and what to do about it. If the report is empty, that does not prove you are clean, because not every infection is flagged.
4. Use URL Inspection. Paste a page address into Search Console and view the page as Google sees it. Google recommends this for cloaked spam, instead of looking at the page in a normal browser. This is the single most useful check, because it shows what the code serves to a crawler.
5. Fetch the page yourself with a Google user agent. Using curl with a Googlebot user agent and a search engine referrer, you can see what the server returns. For example:

curl -s -A "Googlebot" -e "https://www.google.com/" https://yourdomain.com/ | grep -i -E "pharmacy|viagra|cialis"

Some pharma hacks also check the visitor's IP address, so a clean result here does not rule it out. A positive result is conclusive.

6. Check Search Console's Performance report. Look at the queries over the last few months. Impressions for drug names, for a site that has nothing to do with them, are a strong sign.

If you find injected pages, take a note of the URLs and move on to the cleanup. For other signs worth checking in the same sitting, see the signs your WordPress site has been hacked.

Where the Pharma Hack Hides

You are looking for the code that generates and hides the spam, and the way back in. These are the usual places.

The code is usually scrambled, with functions such as base64_decode, eval or gzinflate. It may be nowhere near a plugin you use. If you find one hiding spot, assume there are more, because attackers plant several at once. Our guide to the WordPress backdoor walks through each hiding spot and how to hunt it.

The pharma hack has a close relative in the Japanese keyword hack, which does the same injection with Japanese product spam. Most of the cleanup is the same.

What a Scan Can Tell You

A scan is a good first sweep. Stack Guard's malware scanning compares every WordPress core file with the official copy, looks for known signatures of back doors, web shells, hidden redirects and injected code, and flags extra PHP files in the WordPress folders. Manual scans with these checks are in the Free plan.

Pro adds scheduled scans, a record of every code file so you can see what was added or changed, and quarantine, which moves a suspicious file somewhere it cannot run. The guide to scanning WordPress for malware shows how to read the results.

No scan finds everything. It is a way to find leads quickly, not a verdict.

Cleaning Up the WordPress Pharma Hack in the Right Order

Order matters. Clean in the wrong order and the spam regrows before you finish.

1. Back up the infected site. Files and database, labelled clearly as infected. It is your evidence and your safety net.
2. Put the site in a safe state. If you can, take it offline or behind a maintenance page while you work, so visitors and Google stop hitting the spam.
3. Change the passwords. WordPress administrators, hosting, SFTP and the database. Do this first, so the attacker cannot undo your work while you do it.
4. Replace WordPress core. Reinstall core files from WordPress.org. Leave wp-content and wp-config.php for the next steps.
5. Replace plugins and themes. Delete and reinstall from official sources. Remove anything you do not use.
6. Hunt the rest by hand. Check the folders and files in the table above. Delete generated spam folders. Clean .htaccess back to the WordPress default.
7. Clean the database. Remove injected rows and spam posts, and check for unknown users. Be careful: delete only what you have confirmed.
8. Close the entry point. Work out how they got in, usually an old plugin or a reused password. If you do not close it, the hack returns.
9. Rotate the security keys. This signs out every session, including any the attacker still holds.
10. Rescan and re-test. Run a fresh scan and repeat the URL Inspection check on a spam page.

Google says much the same in its content injection guidance: you can restore from a good backup, or remove the spam content and links page by page, fix every example in the report, and search for other compromised pages. If you have a clean backup from before the infection, restoring it and updating everything can be faster. Our guide to recovering a hacked WordPress site covers the full process, and the backups page explains how Stack Guard backups are verified before they count.

Pro tip: Do not just delete spam pages in WordPress and stop there. Pages generated by a script on your server will come back. Find and remove the script first.

Search Console Steps After Cleanup

Once the site is clean, you need to tell Google. Otherwise the warnings and the spam results can sit there for a long time.

1. Verify the site in Search Console if you have not already, using the same property Google has been reporting on.
2. Open Security Issues and check the categories listed.
3. Re-test example URLs with URL Inspection to confirm they now return the clean page.
4. Remove spam URLs from results. For pages that no longer exist, make sure they return a proper "not found" or "gone" status so Google drops them.
5. Request a review. In the Security Issues report, choose the option to request a review and describe what you fixed, for example that you removed the injected pages and updated an outdated plugin.
6. Wait. Google says a review can take from a few days to a few weeks, and that you should not resubmit until you receive a decision.

If the review is rejected, Google sends example URLs again. Go back and look harder, because something is still there. If you see the "This site may be hacked" label in search, our guide to removing the "This site may be hacked" warning covers that process.

Preventing the WordPress Pharma Hack from Coming Back

Most of this attack comes down to one thing: it gets in through something you could have updated, removed or locked.

• Update everything, and delete what you do not use. Old plugins and themes are the usual way in. See WordPress plugin vulnerabilities for how to stay ahead of them.
• Use strong, unique passwords and two-factor sign-in. A stolen password then stops being enough.
• Switch off the code editors. Stack Guard's hardening settings can remove the built-in theme and plugin editors in Free, so a stolen admin account cannot be used to write code through the dashboard.
• Watch for new files and users. File change monitoring (Pro) flags files added or changed since the last scan. The activity log shows new users and role changes.
• Close the comment door. Spam links often arrive through comments first. Our guide to WordPress comment spam shows how to shut that route.
• Scan on a schedule. Scheduled scans are part of Pro. They find a new infection while it is still small.
• Keep a clean backup. It is how you recover fast. Take one before you do anything risky.

If this has already happened to you, you have learned what a hack looks like when it hides well. The aim now is to make sure you hear about the next one in days, not months.