Getting a Corporate Website Built: A Step-by-Step 2026 Guide
Everything you need to know before getting a corporate website built — from setting goals and choosing an agency to preparing content and post-launch maintenance.
Read moreImagine searching for your company’s name on Google one morning and seeing betting, gambling or unrelated product pages under your site’s address. This is one of the most common and most damaging consequences of a hacked site: SEO spam. In this article we explain how these attacks work, how to spot them and how to prevent them for good.
What is SEO spam and how does it work?
Attackers break into sites with security holes and use the site’s reputation in search engines for their own purposes. The most common methods:
- Spam page injection: thousands of betting or pharmaceutical pages are added to your site and get indexed on Google under your domain.
- Hidden links: links to other sites that visitors cannot see are placed on your pages.
- Cloaking: your site looks normal to regular visitors, while Google is shown a different (spam) page. That is why owners often don’t notice.
- Redirects: mobile visitors arriving from Google are redirected to other sites.
Symptoms: could your site have been hacked?
- Pages you don’t recognise in a
site:yourcompany.comsearch on Google - Your site’s title looking different in search results
- A “Security issues” or “Manual actions” warning in Search Console
- Administrator accounts you don’t know about, or changed site address settings
- PHP files in the uploads folder, plugins you don’t recognise
- Being sent to another site when visiting via Google on a phone
What should you do if your site has been hacked?
- Don’t panic, don’t delete the evidence: first back up the current state; knowing which files were changed matters during the clean-up.
- Change all access: renew every administrator, hosting, FTP and database password and remove users you don’t recognise.
- Remove the malicious code: replace the WordPress core files with the official version, reinstall plugins and themes from trusted sources, and weed out modified files and spam content.
- Close the hole: identify and fix the outdated plugin, theme or weak password that allowed the attack.
- Request a review in Search Console: after removing the spam pages, request a review of the security issue and, if needed, use the URL removal tool for removed addresses.
Lasting measures
| Measure | Why it matters |
|---|---|
| Up-to-date WordPress, theme and plugins | Most attacks exploit known vulnerabilities |
| Few, trusted plugins | Every plugin is an additional attack surface |
| Strong password + two-factor authentication | A stolen password alone is not enough |
| Failed login limits | Stops brute-force attacks |
| Blocking PHP in the uploads folder | Prevents backdoor files from running |
| File integrity monitoring | Flags changed and added files immediately |
| Checking the Googlebot view | Catches cloaking early |
| Regular backups stored off-site | A quick way back in the worst case |
How is security handled on GOGNUS sites?
On the sites we deliver, a firewall, file and core integrity scanning, SEO spam and cloaking checks (detecting a different page being shown to Google), two-factor authentication, login limits, activity logging and instant email/Telegram alerts in case of anything suspicious are set up as standard. No system can promise one hundred percent protection, but spotting problems early keeps the damage to a minimum.
Frequently Asked Questions
How can I tell if my site has been hacked?
The most common signs are betting or unrelated product pages appearing on Google under your site’s address, a security warning in Search Console, administrator accounts you don’t recognise, visitors being redirected to other sites and the site slowing down.
Will rankings come back after a hacked site is cleaned?
Once the spam pages are removed, the site is secured and a review is requested via Search Console, visibility can recover over time; however, the time and outcome vary from site to site and cannot be guaranteed.
Is installing a security plugin enough?
Not on its own. Up-to-date software, few and trusted plugins, strong passwords and two-factor authentication, regular backups, file integrity monitoring and server-level rules together provide protection.
For your site’s security and maintenance, see our hosting, maintenance and technical support service or write to us.
