Pharma hack on a WordPress site

A pharma hack is pharmacy spam published on your WordPress site without your knowledge. Google shows medication names or shop-style pages on your domain even if you never sold medicine. The pages often stay invisible while you browse as a logged-in administrator.

What you are seeing

A search for your domain plus a medication name, or the word pharmacy, returns URLs you never created. The page might be a fake shop, a block of links, or your real page with extra text in the source. Sometimes only deeper results are spam, and the homepage title in Google is still yours.

People often notice after a customer asks, or after Google adds This site may be hacked. The site can keep taking orders the whole time. That does not make the extra URLs harmless. They are part of what Google is indexing.

This is the same pattern as a Japanese keyword hack and casino spam. The topic changes. The hiding places do not, much. If you run a pharmacy and these pages are your catalog, this is not your incident. Drug names you do not stock, on pages nobody scheduled, are not yours.

Why it happens

Once someone can write to the site, adding pages that match heavily searched terms is a misuse of a normal CMS. WordPress will store posts the menu never links to. Google will index a URL that appears in a sitemap, a hidden block, or another spam page.

The content typically sits in the posts table, in widgets, and in footer.php or functions.php. A second copy is sometimes HTML or PHP under uploads. A check on the request can show the spam to Google and a cleaner page to you. Remove the content and the file that decides who sees it.

The entry is usually an old plugin, a reused password, a leftover administrator, or an unofficial theme. See how WordPress sites get compromised. If that stays, new URLs replace the ones you delete.

How to check if you are affected

The read-only scanner below does not log into WordPress and cannot see drafts or files the public web cannot request. Pharmacy spam is often one of those. A clear scan only means the pages it fetched did not show the problem.

Site URL Scan my site free

Read-only scan · No install · Results in about 30 seconds

1. Search site:yourdomain.com and site:yourdomain.com pharmacy. Open the results logged out, in a private window.
2. In Search Console, review known pages for paths that are not your structure. Random slugs and product-style URLs on a site with no shop are worth opening.
3. View source on the homepage. Search the source for pharmacy wording you saw in Google. Links can sit in the HTML without showing on the rendered page.
4. Sort Posts and Pages by date, including drafts. Check Menus and Widgets for link lists you did not build.
5. Over SFTP, compare the active theme with a new download. Look for PHP in wp-content/uploads and for unfamiliar files in wp-content/mu-plugins. Must-use plugins load with no activation switch.
6. List administrators and note the email and registration date. An account you cannot place is part of this. See unknown admin users.

Do not install a plugin that promises to strip pharmacy spam unless you can name the author and it is on WordPress.org.

How to fix it yourself

1. Isolate the site if the spam URLs are public. Maintenance mode is enough. You are stopping new indexing of pages you are about to remove, not hiding from Google forever.
2. Back up files and export the database. Mark the archive as suspect. Restoring it later brings the pharmacy posts back. Set aside any older export from before the spam, and still change passwords before you use it.
3. Delete the spam posts, pages, widgets, and files. Then remove the code that printed them for Google, usually a changed theme or plugin file, not the post alone.
4. Replace core from wordpress.org. Fresh wp-admin and wp-includes, and fresh root PHP files. Keep wp-config.php and wp-content. Run the database update if WordPress asks.
5. Remove administrators you do not know, after checking with anyone who might have created a real account.
6. Reinstall every plugin and the theme from a clean archive. Delete the old folder first so leftover files are not merged in. Remove anything you cannot get from the author.
7. Reset WordPress, SFTP, hosting, and database passwords. Mirror the database password into wp-config.php. Regenerate salts from the WordPress salt service.
8. Delete PHP you did not place in wp-content/uploads, and turn off PHP execution there with your host's help.

DIY is a bad idea with no backup, when the URLs reappear, when the host has suspended the site, or when you would be editing the database without a copy. See how to clean a hacked WordPress site. Request a Google review only after the content is gone.

When to get help

Ask for help if you can see the Google results and cannot find the posts, if a clean theme still prints the links, or if you cannot tell spam from real copy in the database. Those are cleanup problems, not a reason to hope the index updates on its own.

Emergency Cleanup is a flat $499. The 30-day reinfection guarantee means we clean again, or we refund the fee if we cannot clean it. We start only after you confirm you own the site. Nothing on this page expires overnight. Reach me at daniel@daniellasek.com, or use the button below.

Fix it now — $499 Talk to us by email

FAQ

I never sold medication. Why does Google show pharmacy pages on my domain?

Because the domain can be indexed. Extra posts, files, or links were added so searches for medication land on your site. Your real pages can stay in place beside them.

The pharmacy pages are not in my menu. Are they still on the site?

Yes, if Google has a URL for them or you can open that URL. Menu visibility is not the test. Search Console and a site: search show addresses your navigation hides.

Can I noindex the pharmacy pages and leave them up?

No. A noindex tag leaves the spam on the site, and the search warning can remain. Remove the pages and whatever created them, then ask Google to recrawl.

Will updating WordPress remove a pharma hack?

Updating core is necessary and not sufficient. Spam in the database, extra files, and a changed plugin are not always overwritten by an update. Reinstall from clean copies and reset passwords too.