The pharma hack is one of the most deceptive WordPress attacks in circulation, precisely because it’s built to be invisible to the one person most likely to notice it: you. It works through cloaking — showing search engines and bots one version of your site (stuffed with pharmaceutical, gambling, or counterfeit-goods spam) while showing every regular visitor the completely normal site they expect. That split is exactly why it can run for months before anyone catches it.
How the attack actually works
Once malicious code is planted — usually through an outdated or vulnerable plugin, a weak admin password, or an old theme with a known exploit — it checks every incoming request to see who’s asking. If the visitor looks like Googlebot, Bingbot, or another search crawler (based on user-agent strings and other fingerprints), it serves spam-filled pages built around pharmaceutical keywords, often thousands of them, dynamically generated and linked together to build fake authority. If the visitor looks like an ordinary human, it serves your real site, untouched. You can open your homepage in a browser all day and see nothing wrong, because the malware is specifically designed not to show you anything.
Why this particular hack is so damaging
The spam pages get indexed by Google under your domain — sometimes thousands of them — which pollutes your own search rankings with content that has nothing to do with your business and actively damages the trust signals your real pages depend on. Left unaddressed, this reliably escalates to a Google Search Console manual action or an outright search blacklist, at which point your organic visibility doesn’t just drop, it can disappear for the flagged pages entirely until you clean it up and successfully request a review.
Common causes
- Outdated WordPress core, plugins, or themes — the entry point in the large majority of cases, since plugins account for the overwhelming share of known WordPress vulnerabilities
- Weak or reused admin credentials, giving attackers direct access without needing an exploit at all
- Abandoned plugins or themes no longer receiving security updates, still installed and still reachable
- No security monitoring, which is precisely what lets a cloaking attack run undetected for extended periods — nothing about it announces itself to a site owner casually checking their homepage
Warning signs to check for directly
- Pharmaceutical, gambling, or unrelated foreign-language keywords appearing in your search results (search
site:yourdomain.com viagraor similar directly in Google to check) - Meta titles and descriptions in your search listings that you never wrote
- A sudden, unexplained spike in indexed pages in Google Search Console that don’t correspond to real content on your site
- Traffic referred from unusual search terms that have nothing to do with your business
How to fully remove it
- Identify every infected file, not just the obvious ones — cloaking scripts are often planted in multiple locations (theme files, plugin directories, even the database) specifically to survive a partial cleanup.
- Remove the malicious code or restore from a backup taken before the infection started — restoring from a backup taken after infection just reintroduces the same problem.
- Change every credential tied to the site: WordPress admin, hosting, FTP/SFTP, and database.
- Update everything — WordPress core, every plugin, and your theme — before bringing the site fully back online.
- Submit a review request in Google Search Console if you were flagged or blacklisted, and monitor your indexed page count and search listings closely for the following weeks to confirm the spam pages are actually gone from Google’s index, not just from your server.
Preventing it from coming back
Because this attack specifically exploits the fact that most site owners never see it happening, the real fix is closing the gap between infection and detection — real-time monitoring that checks what search engines actually see, not just what your homepage looks like in a browser, combined with keeping every plugin and theme on a current, patched version. If you’ve already been hit once and want the SEO damage properly assessed and reversed as part of the cleanup, it’s worth reading alongside how to restore your rankings after a hack — cleaning the malware and recovering your search visibility are two different jobs, and skipping the second one is how sites stay quietly damaged long after the infection itself is gone.
If you’d rather have this confirmed and fully removed by a team that specifically looks for cloaking-style attacks — not just visible malware — our malware removal and security service covers exactly this.
FAQ
How do I check if my site has a pharma hack right now? Search Google for site:yourdomain.com followed by common spam terms like “viagra” or “cialis” — if pages show up that you didn’t create, that’s a strong signal. You can also check Google Search Console’s coverage report for an unexplained spike in indexed pages.
Will removing the malware automatically fix my search rankings? No — removing the malware stops the ongoing damage, but the spam pages already indexed by Google need to actually drop out of the index, and any manual action needs to be reviewed and cleared separately in Search Console. Both steps matter.
Can a pharma hack come back after I clean it? Yes, if the original entry point — an outdated plugin, a weak password, an unpatched theme — isn’t identified and closed. Cleaning the visible spam without fixing how it got in is the single most common reason this type of infection returns.
