SEO spam
SEO spam is unauthorised content or links injected into a website so that attackers can rank and monetise pages on someone else's domain.
Updated 2 Sept 2026
In more detail
SEO spam (also called spamdexing, or a pharma/keyword hack after its most common payloads) is the result of a site compromise rather than a ranking mistake. Once an attacker has write access they publish keyword-stuffed pages, inject outbound links into shared templates, or redirect organic search traffic to an affiliate destination. Because the payload is usually cloaked, owners often learn about it from Google Search Console, a hosting abuse notice or a browser warning rather than from their own pages.
Why SEO spam matters
The injected pages inherit the host domain's existing trust, so they can rank quickly — and the same trust is what gets damaged. Google can apply a manual action for pure spam or hacked content, which removes affected URLs from results until the site is cleaned and a reconsideration request is accepted. Recovery is measured in weeks, and rankings for the site's own pages fall in the meantime.
How it works
Entry is almost always an out-of-date CMS plugin, a reused administrator password, or a stolen FTP/SFTP credential. The attacker then plants a backdoor so access survives a password reset, writes spam templates into a directory Googlebot can reach, and links to them from an existing high-crawl page such as the sitemap or footer. Serving logic checks the user agent or referrer so the spam is shown to crawlers and search visitors but not to the logged-in owner.
Examples
- Japanese-language pharmacy and counterfeit-goods pages appearing under a legitimate business domain (the Japanese keyword hack).
- Hidden anchor links added to a WordPress footer template, pointing at unrelated gambling or loan sites.
- A 302 redirect that fires only when the referrer is a Google search result, sending visitors to an affiliate offer.
How it is detected or measured
Compare a site: query in Google against your real URL list, fetch pages with a Googlebot user agent and again as a normal browser, review Search Console's Security Issues and Pages reports, and diff the file tree against a clean deployment or version control.
Frequently asked questions
- Is SEO spam the same as being penalised for bad SEO?
- No. SEO spam on a legitimate site is evidence of a compromise. The fix is incident response — find the entry point, remove the backdoor and the injected content — not on-page optimisation.
- Can SEO spam exist without any visible change to my site?
- Yes. Cloaked injections serve spam only to crawlers or to visitors arriving from search, so the homepage can look completely normal to the owner while spam URLs are indexed.
Where this matters
- SEO Spam: The Complete Picture
The pillar page for injected search spam: the attack family, how the variants relate, and the detection and remediation path shared by all of them.
- How to Detect SEO Spam on Your Website
A repeatable detection routine: search-side checks first, then crawler-view comparison, then file and database review.
- Japanese Keyword Hack
An SEO spam attack that injects Japanese-language pages into a compromised site to hijack search listings. How it works, how to confirm it, and how to clean up.
- How to Remove Injected Spam Links
Removing injected outbound links without breaking your templates — and making sure they do not come back on the next cache rebuild.
Sources
- Spam policies for Google web search — Google Search Central
How Google classifies hacked content, cloaking and spammy links.
- Hacked content: help for hacked sites — Google Search Central
Recovery and reconsideration process for hacked sites.