Spam URL patterns
Slugs, directories and parameters help identify how the pages are generated.
Security and SEO incident
Are spam pages from your domain appearing on Google?
Gambling, pharmaceutical, fake-product or unknown pages can indicate an SEO spam compromise. The work has two parts: stop what is generating the spam and clean up the search signals already collected.
What I look for to find the source
Indexed URLs are the visible symptom. The cause may sit in files, database records, plugins, users, scheduled tasks or server rules serving different content to crawlers.
Unauthorized sitemaps
Added XML files can push large volumes of spam URLs to search engines.
Code persistence
Files, plugins or scheduled tasks can recreate spam after superficial cleanup.
Database content
Altered posts, options or records can keep generating malicious pages.
Compromised accounts
Admin or hosting access may keep the incident open.
Server-side rules
Redirects or configuration can serve different content to crawlers and visitors.
How we handle the incident
The compromise is removed first, then the search index is cleaned up.
Map the footprint
Collect URLs, patterns, sitemaps and anomalous behavior without immediately deleting useful evidence.
Find persistence
Inspect application, users, files, database, scheduled tasks and server configuration.
Clean up
Remove malicious components and restore files or packages from trusted sources.
Close access
Rotate relevant credentials and review privileges and entry points.
SEO cleanup
Review status codes, sitemaps, redirects and residual signals so spam URLs can leave the index.
Technical checks
Security and SEO are reviewed together, but with different goals.
- Indexed spam URLs
- Users and privileges
- Modified files and plugins
- Database
- Scheduled tasks
- Sitemaps and robots
- Redirects and cloaking
- Search Console
- Server logs
After cleanup
The site needs to stay clean and search engines need consistent signals for URLs that should no longer exist.
Reviewed and rotated access
Persistence removed
Clean sitemaps
Consistent status codes for spam URLs
Search Console monitoring
Recurrence checks
Useful references
Seeing spam content associated with your domain?
Send a few example URLs. We can check the compromise, persistence and search impact.