How to Detect SEO Spam on Your Website

• Open Search Console → Pages and compare indexed URLs against your sitemap count.
• Run site:yourdomain.com and page deep into the results, not just page one.
• Look for languages you do not publish in, and for directories your CMS does not create.
• Review Settings → Users and permissions for owners you did not add.

Injected spam is normally cloaked. Fetch a suspect URL twice — once with a browser user agent, once with a crawler user agent — and diff the HTML. Then use Search Console's URL inspection to see the version Google actually received, which defeats IP-based cloaking that a spoofed user agent misses.

curl -s -A "Mozilla/5.0" https://example.com/page > visitor.html
curl -s -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" https://example.com/page > crawler.html
diff visitor.html crawler.html

• Extract external links from templates and compare against domains you intentionally link to.
• Look for anchors with zero size, hidden visibility, or large negative offsets.
• Check footers, widget areas and sidebar templates first — they render on every page.

1. STEP 01

   Find recently modified files

   List files in the web root by modification time. Clusters of changes on one date usually mark the injection.

2. STEP 02

   Look for obfuscation

   Grep for base64_decode, eval, gzinflate and long encoded strings in PHP files.

3. STEP 03

   Query the database

   Search post content, options and metadata for script tags and unfamiliar domains.

4. STEP 04

   Check scheduled tasks

   Review cron jobs and CMS scheduled events used to reinstate deleted files.

Treat it as a compromise, not a content issue. Take a forensic copy, remove the injected content, close the entry point, rotate every credential, then serve 404 or 410 for the spam URLs and resubmit your real sitemap. Re-check indexed page counts weekly for a month.