Website security
SEO Spam: The Complete Picture
The pillar page for injected search spam: the attack family, how the variants relate, and the detection and remediation path shared by all of them.
Published 4 Jun 2026 · Updated 28 Aug 2026 · 2 min read
Short answer
SEO spam is the family of attacks in which a compromised website is used to publish search-optimised content the owner never created — injected keyword pages, hidden outbound links, cloaked crawler-only content and spam redirects — in order to rank for the attacker's keywords and monetise the site's authority.
What are the variants of SEO spam?
| Variant | What the attacker gains | Primary indicator |
|---|---|---|
| Keyword injection | Ranking doorway pages on your domain | Indexed URLs and titles you never published |
| Hidden link injection | Authority passed to their own sites | Invisible outbound anchors in the page source |
| Cloaking | Spam that stays invisible to the owner | Crawler response differs from visitor response |
| Spam redirects | Traffic monetised directly | Conditional redirects on mobile or from search |
In real incidents they arrive together. A single compromise typically installs a generator for keyword pages, a footer link block, a cloaking layer to keep both hidden, and a redirect for mobile visitors — which is why fixing one symptom rarely ends the incident.
How does SEO spam get in?
- A vulnerable or abandoned CMS plugin, theme or library.
- A reused or leaked administrator credential without multi-factor authentication.
- A writable web root that allows uploaded files to execute.
- A compromised supplier: agency access, shared hosting neighbour, or a hijacked third-party script.
Sources
- Fixing hacked sites: hacked with spam — Google Search Central
- Spam policies for Google web search — Google Search Central
Prefer summary updates? Subscribe to the newsletter.