The "Pharma Hack": What SEO Spam Injection Actually Looks Like

What the "pharma hack" actually is

The name comes from what it originally advertised — spam pages built around pharmaceutical keywords like Viagra, Cialis, Levitra, and Xanax, chasing the high-value ad revenue those terms once commanded. The technique itself has outlived the original niche: the same mechanism now gets used for counterfeit-goods spam, fake giveaways, and plenty of other categories, all under the same nickname because the method is identical.

What actually happens: an attacker compromises your site and injects extra pages, or extra content on existing pages, built entirely around their spam keywords. According to Sucuri's own detection data, pharma-style spam injections accounted for over 40% of all SEO spam infections they found across the sites they scan — this isn't a rare or theoretical pattern, it's one of the most common ways a WordPress site gets exploited for financial gain rather than pure vandalism.

Why cloaking means you don't see it — and Google does

The reason this hack is so persistent is simple: it's specifically built so you, the site owner, almost never see it by just browsing your own site. The injected code checks who's asking. If the request looks like it's coming from Googlebot or another search crawler's user-agent, it serves the spam content. If it looks like an ordinary visitor — or you, checking your own homepage — it serves your real, unmodified page.

This is called cloaking, and it's the whole reason the hack works as well as it does. You can refresh your homepage fifty times and see nothing wrong, while Google's index is quietly filling up with pages you never wrote, ranking for keywords you never targeted, sitting on a domain that took years to build real trust with the same search engine.

Some variants go a step further and modify your XML sitemap or, in more advanced cases, add an unauthorized user to your Google Search Console property to directly influence what gets submitted and crawled — worth checking your Search Console user list specifically if you suspect this.

How you actually find out you have it

Since the hack hides from you by design, the discovery almost always comes from outside:

• Someone else tells you. A customer, a colleague, or a competitor searches your business name or a term related to your site and sees spammy titles and descriptions in the results that have nothing to do with your actual content.
• You check it yourself. Search site:yourdomain.com on Google and scroll through what's actually indexed. If you see page titles or meta descriptions referencing pharmaceuticals, casinos, counterfeit goods, or anything you never published, that's the tell.
• A pharma-specific search turns up your domain. Searching a known spam term alongside site:yourdomain.com — for example site:yourdomain.com viagra — will surface indexed spam pages even when your own homepage looks completely clean.

One detail that trips people up: clicking through one of these spam results from Google often just returns a 404, or bounces you to your normal homepage instead of the spam content. That's the cloaking working correctly from the attacker's point of view — the spam page was only ever meant to be shown to the crawler that indexed it, not to a human clicking through afterward.

Why it comes back after you think you've cleaned it

This is the part that separates a real fix from a cosmetic one. A pharma-style infection typically plants itself in multiple places at once — commonly cited security-research breakdowns of these infections describe as many as five to nine separate persistence points across a single compromised site: injected files, rogue rows in the WordPress database (often in wp_options or hidden inside legitimate-looking post content), a scheduled task, a hidden administrator account, and sometimes a webshell used to silently re-inject everything else if any one piece gets removed.

Remove the files but miss the database rows, and the spam reappears within hours. Remove the obvious database entries but miss a webshell sitting in an unrelated directory, and the whole thing gets rebuilt from scratch the next time the attacker checks in. This is the same underlying lesson as restoring from a backup after a hack: a partial cleanup that doesn't close the actual entry point, and doesn't find every piece the attacker left, isn't really a cleanup — it's a pause.

Cleaning it up properly

1. Treat it as a full compromise, not a content problem. Don't just delete the spam pages you find — that addresses the symptom while leaving the mechanism that created them fully intact. Work through the complete malware removal process: check for unfamiliar admin users, scan the database for injected content, replace WordPress core files wholesale, and audit every active plugin and theme file.
2. Check specifically for a webshell. Given how often these infections use one for persistence, it's worth deliberately looking — see what a webshell is and how to find one — rather than assuming file and database cleanup alone got everything.
3. Close the actual entry point. Update every plugin and theme, remove anything abandoned or unused, and rotate every credential connected to the site. If you don't know how the attacker got in originally, you can't be confident they — or the next opportunist scanning for the same weakness — won't get back in the same way.
4. Request a review once you're confident it's clean. If Google Search Console has flagged your site or you've confirmed spam pages in the index, submit a reconsideration/review request through Search Console after cleanup, so Google re-crawls and removes the spam pages from its index rather than leaving them cached indefinitely.