How do you know if your website has SEO spam?

The clearest sign is a mismatch between the pages you published and the pages search engines have indexed: unfamiliar URLs, foreign-language titles, or a sudden rise in indexed page count in Search Console.

Can a security plugin detect SEO spam?

Partly. File-integrity scanning catches injected files, but cloaked pages generated at request time and spam stored in the database frequently pass a plugin scan, so search-side checks remain necessary.

Does SEO spam always mean the site was hacked?

Almost always. The exception is content added deliberately by a plugin, theme or an agency, which is still harmful but needs a different fix.

SEO Spambeginnerguide

How to Detect SEO Spam on Your Website

A repeatable detection routine: search-side checks first, then crawler-view comparison, then file and database review.

Cyber Security Space editorial desk · Published 9 Jul 2026 · Updated 26 Aug 2026 · 2 min read · Reviewed 26 Aug 2026

Short answer

To detect SEO spam, start outside your site: compare the number of indexed URLs in Search Console against your real page count, run a site: query looking for titles you never wrote, then fetch suspect pages with a crawler user agent and diff the response against a normal browser request. Only after that do you search files and database content for the injected code.

Key takeaways

Search-side signals appear before site-side ones, because the spam is built to be seen by crawlers.
An unexplained jump in indexed pages is the single most reliable early indicator.
Always test logged out and with a crawler user agent; a logged-in session usually receives clean content.
Record every spam URL you find — you will need the list for removal and reindexing.

Step 1 — Check what search engines have indexed

Open Search Console → Pages and compare indexed URLs against your sitemap count.
Run site:yourdomain.com and page deep into the results, not just page one.
Look for languages you do not publish in, and for directories your CMS does not create.
Review Settings → Users and permissions for owners you did not add.

Step 2 — Compare the crawler view with the visitor view

Injected spam is normally cloaked. Fetch a suspect URL twice — once with a browser user agent, once with a crawler user agent — and diff the HTML. Then use Search Console's URL inspection to see the version Google actually received, which defeats IP-based cloaking that a spoofed user agent misses.

curl -s -A "Mozilla/5.0" https://example.com/page > visitor.html
curl -s -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" https://example.com/page > crawler.html
diff visitor.html crawler.html

Step 3 — Audit outbound links and hidden content

Extract external links from templates and compare against domains you intentionally link to.
Look for anchors with zero size, hidden visibility, or large negative offsets.
Check footers, widget areas and sidebar templates first — they render on every page.

Step 4 — Search files and stored content

STEP 01
Find recently modified files
List files in the web root by modification time. Clusters of changes on one date usually mark the injection.
STEP 02
Look for obfuscation
Grep for base64_decode, eval, gzinflate and long encoded strings in PHP files.
STEP 03
Query the database
Search post content, options and metadata for script tags and unfamiliar domains.
STEP 04
Check scheduled tasks
Review cron jobs and CMS scheduled events used to reinstate deleted files.

What do you do once you find spam?

Treat it as a compromise, not a content issue. Take a forensic copy, remove the injected content, close the entry point, rotate every credential, then serve 404 or 410 for the spam URLs and resubmit your real sitemap. Re-check indexed page counts weekly for a month.

Frequently asked questions

How do you know if your website has SEO spam?: The clearest sign is a mismatch between the pages you published and the pages search engines have indexed: unfamiliar URLs, foreign-language titles, or a sudden rise in indexed page count in Search Console.
Can a security plugin detect SEO spam?: Partly. File-integrity scanning catches injected files, but cloaked pages generated at request time and spam stored in the database frequently pass a plugin scan, so search-side checks remain necessary.
Does SEO spam always mean the site was hacked?: Almost always. The exception is content added deliberately by a plugin, theme or an agency, which is still harmful but needs a different fix.

Sources

Fixing hacked sites: hacked with spam — Google Search CentralSupports: Detection and recovery workflow for injected spam.
URL Inspection tool — Google Search CentralSupports: Seeing the crawler's rendered view of a page.