You search for your own business on Google and the results look wrong. Next to your real pages are listings for online casinos, slot games or betting sites, all carrying your domain name. You open your website and everything looks normal.<\/p>\n
This is one of the most common website compromises there is, and it’s built to stay hidden from you. This guide explains how the attack works, how to confirm it and how to clean it properly so it doesn’t come back.<\/p>\n
The casino spam hack, often called an SEO spam hack or doorway page injection, is an attack where criminals plant hundreds or thousands of pages on your website that you never created. The pages promote gambling, betting or similar sites, and they exist to borrow your domain’s reputation. Search engines trust an established site, so spam published on it can rank quickly.<\/p>\n
The attacker’s goal isn’t to damage your site. It’s to use it. Your domain becomes free advertising infrastructure for someone else, and you get the consequences: lost trust, lost rankings and sometimes a Google warning across your whole site.<\/p>\n
This is what makes the hack so effective. The injected pages are usually served selectively, a technique known as cloaking. The site shows your normal content to you and to most regular visitors, and shows the spam only to search engine crawlers, or to visitors arriving from Google, or to specific devices.<\/p>\n
So the usual advice, “just look at your site,” fails. The owner sees nothing wrong, while Google sees a very different website.<\/p>\n
You don’t need special tools to run a first check.<\/p>\n
1. Search Google for your own domain.<\/strong> Type 2. Look at the page titles in the results.<\/strong> Spam titles are usually keyword-stuffed and out of character for your business, and the URLs often follow odd patterns, such as long strings of numbers or random folder names.<\/p>\n 3. Check Google Search Console.<\/strong> Open your property and look at the Pages (indexing) report. A sudden jump in indexed pages you didn’t publish is a strong warning sign. Also check the Security issues report for any manual action or hacked-content notice, and look at Performance for unfamiliar queries driving impressions.<\/p>\n 4. Check your sitemap.<\/strong> Attackers often add their own sitemap files so Google discovers the spam faster. If you find a sitemap you didn’t create, treat it as evidence.<\/p>\n 5. Ask a clean outside perspective.<\/strong> Because of cloaking, a check from your own browser can miss things. A tool or service that views your site the way Googlebot does shows you what the search engine sees.<\/p>\n If you find one spam page, assume there are many more, and that there’s a way in that’s still open.<\/p>\n Understanding the entry point matters, because cleaning the spam without closing the door means it returns. Common routes into a WordPress site include:<\/p>\n The specific route is different every time, which is why a proper cleanup ends with a written report on how the attacker got in.<\/p>\n Most site owners who find this hack try to delete the pages they can see. That rarely works, for three reasons.<\/p>\n First, the visible pages are usually only the output. The attacker has typically left backdoors, which are small hidden files or database entries that let them regenerate the spam whenever they want.<\/p>\n Second, the injected content may live in several places at once: in files on the server, in the database, in modified core or plugin files, and in rewrite rules that control which content is served to whom.<\/p>\n Third, the entry point is still open. Remove the symptoms without closing it and you’ll likely be reinfected, sometimes within days.<\/p>\n If you suspect an active compromise, read our guide on what to do in the first hour of a WordPress hack<\/a> before you start deleting anything. Preserving logs and taking a forensic copy first makes the cleanup far more reliable.<\/p>\n A thorough cleanup for the casino spam hack works through these stages:<\/p>\n Once the site itself is genuinely clean, you need to tell Google. The order matters, because asking for review before the cleanup is complete usually fails.<\/p>\n Fix the response first.<\/strong> Make sure the spam URLs no longer return their old content. Depending on the situation, a removed page should return a proper “not found” or “gone” response rather than redirecting somewhere unexpected.<\/p>\n Remove the spam from your sitemap.<\/strong> Delete any sitemaps the attacker added and submit a clean sitemap of your real pages through Search Console.<\/p>\n Use Search Console’s removal tools.<\/strong> The Removals tool can temporarily hide URLs from results while Google recrawls. It’s a stopgap rather than a permanent fix, so it needs to go alongside the real cleanup.<\/p>\n Request a review if Google issued a security warning.<\/strong> If Search Console shows a security issue or manual action, submit a review request once the site is clean. Be specific about what you found and what you removed.<\/p>\n Be patient with recovery.<\/strong> Spam listings can take days or weeks to drop out as Google recrawls the site, and rankings take time to rebuild. Cleaning the site properly the first time is the fastest route, because a repeat infection resets the process.<\/p>\n Prevention comes down to a handful of habits:<\/p>\n Be realistic about that last point. A firewall blocks the attacks it can see and reduces your exposure, but it doesn’t patch a vulnerable plugin and it can’t clean a site that’s already infected. You need protection and a cleanup capability, and they’re different services.<\/p>\n If hundreds of spam pages are already indexed under your domain, Armor SOS<\/strong> is Tremhost’s emergency cleanup service. We clean this exact pattern across our own fleet every week, so it won’t surprise us. Triage is free and usually starts the same day. We contain the attacker’s access, remove every injected page, shell and backdoor, reset compromised credentials, handle your Google and blacklist delisting and give you a written report on how they got in. We work on sites hosted anywhere, and developers can use us behind their own name, since we report to you and never contact your client.<\/p>\n Message Armor SOS now \u2192<\/a><\/strong><\/p>\n For sites that take payments or hold client data, the smart follow-up is Armor Shield<\/strong>, at $29 per site per month. It includes firewall rules written for your specific application, unlimited malware cleanup if you’re ever compromised again, Google and blacklist delisting handled by us, a monthly report and a named engineer with a four-hour response. At that price it costs less than a single emergency cleanup.<\/p>\nsite:yourdomain.com<\/code> into Google and scan the results. Look for pages about casinos, slots, betting, pharmaceuticals or anything in a language you don’t publish in. Also try site:yourdomain.com casino<\/code>, site:yourdomain.com slot<\/code> and site:yourdomain.com bet<\/code>.<\/p>\nHow the Attackers Got In<\/h3>\n
\n
Why Deleting the Spam Pages Isn’t Enough<\/h3>\n
What a Proper Cleanup Looks Like<\/h3>\n
\n
Cleaning Up Your Google Results<\/h3>\n
How to Prevent It From Coming Back<\/h3>\n
\n
Get Help Now: Armor SOS<\/h3>\n
Make Sure It Doesn’t Return: Armor Shield<\/h3>\n