WordPress site showing casino spam

Casino spam on WordPress means gambling pages or betting links are on your domain even though you did not add them. They may sit in the footer, on a junk URL, or only in Google. They stay your site until you remove the content and whatever writes it back.

What you are seeing

A page on your domain reads like a casino or sportsbook, or your real pages grow a block of gambling links. A customer may mention the footer. Google may show betting brands for your domain while the homepage you open looks ordinary. A click from search may redirect to an outside gambling site instead of rendering the spam on your host.

The visible version is easier to believe. The hidden version is easier to miss, and it is the one that usually brings This site may be hacked. Pharmacy spam and Japanese doorway pages are the same pattern with a different vocabulary. If you publish gambling content on purpose, you know your own pages. Spam is the set of URLs and outbound links nobody on your team ordered.

The rest of the site can keep working. That is not a reason to leave the extra pages up.

Why it happens

Gambling terms are another set of searches. Once the site can be edited by someone you did not appoint, adding pages for those searches is straightforward. WordPress stores them as posts, as widget text, or as links a theme file prints in the footer. The database prefix may not be wp_. The content is still in posts, options, or post meta.

Hidden links are often a style rule, or a block your theme skips for logged-in users. A conditional redirect can send a search visitor away and show you the clean page. You do not need to rebuild that condition. You need the extra posts gone and the theme or plugin file back to the author's version.

Old passwords, outdated plugins, leftover administrators, and unofficial themes are the practical causes. See how that access happens. Delete only today's post and a leftover file publishes another.

How to check if you are affected

The read-only scanner below does not log in or modify WordPress. Spam shown only to Google, or only on URLs other than the homepage, can slip past one fetch.

Site URL Scan my site free

Read-only scan · No install · Results in about 30 seconds

1. In a private window, search site:yourdomain.com and site:yourdomain.com casino. Open anything you did not publish. Note whether the browser stays on your domain.
2. View source on the homepage, logged out. Search the source for casino wording you saw in Google. Footer links are often in the HTML even when they are hidden on screen.
3. Check Appearance, Widgets, and Menus. Sort Posts and Pages by date, including drafts and private items.
4. Open the sitemap your SEO plugin advertises. Entries you would not put on a business card belong on the removal list.
5. Compare footer.php, header.php, and functions.php with a clean theme package. Look through wp-content/uploads for HTML and PHP, not only images.
6. List administrators. A gambling page and a user you do not know should be handled together.

If a cache or CDN is on, bypass it before you decide the footer is clean. You may be looking at a saved copy of the honest homepage.

How to fix it yourself

1. Isolate the site while the casino URLs are public. A maintenance message is enough. Google needs to see the pages gone, not a note that you are working on it.
2. Back up files and the database. Label it as containing the spam. Restoring that copy brings the pages back. An older backup, from before they existed, might be worth restoring after passwords change.
3. Delete the spam posts, pages, menu items, widgets, and files. Search the theme for the outbound domains you wrote down. Editing the footer in the Customizer does nothing if footer.php hard-codes the links.
4. Replace core from wordpress.org: wp-admin, wp-includes, and the root PHP files. Keep wp-config.php. Do not delete wp-content as a bundle.
5. Remove unknown administrators after you check they are not your current developer.
6. Replace the theme and plugins from clean copies. If the theme was an unofficial download, retire it. Updating a tampered theme in place often leaves the extra file.
7. Reset administrator, SFTP, hosting, and database passwords. Write the database password into DB_PASSWORD in wp-config.php. Replace salts from the WordPress salt service.
8. Clear PHP out of wp-content/uploads and disable PHP execution there. Purge the site cache and any CDN, or you will keep seeing the old footer.

DIY is a bad idea without a backup, if the pages come back, if the host has suspended the account, or if you would edit the database with no export. See how to clean a hacked WordPress site. Removing the hacked label is a separate step after deletion.

When to get help

Get help if the visible site is clean and Google still lists gambling URLs you cannot find in Posts, if a clean theme did not stop the footer, or if you do not want to sort the database yourself.

Emergency Cleanup is a flat $499. The 30-day reinfection guarantee means we clean again, or we refund the fee if we cannot clean it. We start only after you confirm you own the site. There is no urgency timer. Write to daniel@daniellasek.com or use the step below.

Fix it now — $499 Talk to us by email

FAQ

Casino links show in Google but not on my homepage. Do I still remove them?

Yes. Search site:yourdomain.com plus a gambling word, and open the URLs Google lists. Those pages are on your site even if your menu never links to them.

Where do unexpected casino links in the footer come from?

From the active theme, a widget, or a menu. Check Appearance, then Widgets and Menus, and the theme files header.php and footer.php. View source as well. A link can be hidden on screen and still visible to Google.

Can I noindex casino pages and leave them on the WordPress site?

No. The spam is still being served from your domain. Remove the pages and the change that added them, then let Google recrawl.

Why would a business site suddenly show casino pages?

Because the domain is already crawled and has some reputation in search. The pages were added for that reason. They are not there because of a post you wrote. They still have to come down, along with whatever account or file added them.