Spam Links Injected Into Your Site: How to Find and Remove Them
By Glenn Lyvers · Updated · 6 min read
Spam link injection is the quietest profitable hack there is. Nobody defaces your homepage and nothing redirects, so there is no dramatic moment that tells you something is wrong. Instead someone has added links to your pages — to counterfeit goods, casinos, essay mills, pirated streams — and is renting out the credibility your domain spent years building. You usually find out from a Search Console message, an SEO tool, or a customer who saw something strange in a Google result.
The links are real links pointing at real spam sites, and Google treats them as your editorial endorsement. That is the whole point of the attack, and it is also why ignoring it gets expensive.
What injected spam links look like
Most of the time you will not see them on the page, because they are deliberately hidden from human visitors while staying perfectly readable to a crawler. The usual techniques are old and still effective: text colored to match the background, a block positioned thousands of pixels off-screen with a negative margin, a container set to one pixel tall with the overflow hidden, or a display:none wrapper around a list of forty anchors.
Sometimes they are not hidden at all. On sites with a lot of old posts, attackers simply append a paragraph of links to the bottom of content published years ago, betting that nobody reviews 2017's archive. Both versions do the same job.
Where they actually live
Four places, in rough order of how often I find them.
Inside your post and page content. The attacker updates rows in wp_posts directly, so the spam is part of the content itself and appears anywhere that post is rendered. This is the most common and the most tedious, because it can touch hundreds of rows.
In the theme's template files. footer.php and header.php are favorites, because code placed there appears on every page of the site at once from a single edit. functions.php is used too, usually to hook the links into the output rather than hardcode them — harder to spot, since the links exist nowhere in your templates.
In the database outside your posts. Widget content lives in wp_options, and a text widget full of hidden anchors is easy to miss because the widget may not be visibly placed in any sidebar you look at. Database malware generally is where file scanners stop being useful.
In an injected plugin or mu-plugin. Less common but the most persistent version: a small plugin whose only job is to append links, sometimes serving them only to search engine crawlers.
Why you can't see them but Google can
Better implementations of this hack are conditional. The injected code checks the visitor's user-agent and serves the links only to Googlebot and Bingbot, or checks whether a logged-in WordPress session exists and hides everything from administrators. You can load the page fifty times, view source, and find nothing, while Google indexes a page stuffed with links to a pharmacy in another hemisphere.
This is called cloaking, and it means checking your own site in your own browser proves nothing at all. It is the same evasion used by the pharma hack, which is a close cousin of this one — pharma spam builds whole cloaked pages, while link injection just borrows the pages you already have.
Finding every one of them
Start with the view Google has, not the view you have. In Search Console, use the URL Inspection tool on a few pages and read the rendered HTML it reports; that is the crawler's copy, cloaking included. A site:yourdomain.com search with a spam term attached — the product category you saw in the Search Console notice works well — will surface indexed pages carrying the links. Fetching a page with a Googlebot user-agent string and reading the raw response does the same job from the command line.
Once you know the spam is there, find its full extent. Search your database for the linked domains and for telltale markup: display:none, text-indent:-9999, and stray <a href patterns in tables where they have no business appearing. Search your theme and plugin files for the same domains. Then check your administrator accounts, because an attacker who could edit hundreds of posts usually had a login, not just a file exploit.
Removing them without wrecking your content
Back up the database before you change a single row. Cleaning link injection means bulk edits, and a bad search-and-replace across wp_posts can quietly delete legitimate content on pages nobody checks for months.
Work from the narrowest possible match. Target the exact injected block — the specific wrapper with its specific styling — rather than something broad like every <div> containing an anchor. Do the replacement on a copy of the database if you can, spot-check a dozen of the affected posts by hand, then apply it to production. For the file-based copies, replace the theme outright from a clean download rather than editing the injected lines out, since a theme that was edited once usually has more than one edit.
Then close the entry point. Rotate every password, remove admin accounts you cannot account for, and look hard for the backdoor that let this happen. Link injection is a revenue stream for whoever set it up, which means they have a strong incentive to come back and rebuild it, and they usually do if the way in is still open.
Undoing the SEO damage
Once the links are genuinely gone, ask Google to recrawl the affected pages through Search Console rather than waiting for the normal cycle. If Search Console showed a security issue or a manual action, request the review only after you have verified the cloaked version is clean too — a review that fails because the reviewer's crawler still sees spam costs you weeks.
Most sites recover their rankings once the spam is gone and the pages are recrawled, and a manual action lifted after a successful review stops suppressing you immediately. What lingers is any external link the spam earned while it was live, which is not something you control and rarely worth chasing. My guide on what a hack really does to your rankings covers the recovery timeline in more detail.
If the injection reaches hundreds of posts, or you would rather not run bulk edits against your own live database, a cleanup is what I do daily — including the database work and finding the way in. You can also start with a free scan of your site to see what is visible from the outside right now.
Common questions
How do I remove malicious links from my website?
Find every copy first, because they are usually in more than one place: post content in the database, theme files like footer.php and functions.php, widget content in wp_options, and sometimes an injected plugin. Back up the database, then remove the exact injected block with the narrowest possible match rather than a broad search-and-replace, and replace theme files from clean downloads instead of editing them. Finish by rotating passwords and finding the backdoor, or the links come back.
Why can't I see the spam links on my own site?
Because good link injection is cloaked. The code checks the visitor's user-agent and serves links only to Googlebot and Bingbot, or hides everything when a logged-in WordPress session is detected. Viewing your site in your own browser proves nothing. Use Search Console's URL Inspection tool to see the crawler's rendered copy, or fetch a page with a Googlebot user-agent and read the raw HTML.
Will hidden spam links hurt my Google rankings?
Yes. Google treats outbound links as editorial endorsements, so links to spam sites can trigger a security notice or a manual action, and can suppress rankings on the affected pages even without one. The damage is usually reversible: once the links are gone and the pages are recrawled, rankings typically recover, and a manual action lifted after review stops suppressing the site right away.
How did spam links get added to my WordPress site?
Almost always through a vulnerable plugin or theme, a compromised administrator password, or a backdoor left from an earlier break-in. Because the attack often edits hundreds of posts, the attacker usually had working admin access rather than just file-level access, which makes auditing your user accounts and application passwords part of the cleanup rather than an optional extra.
Can I just delete the posts that have spam links in them?
Deleting the posts throws away your content and the rankings attached to it, and it does not address the copies living in theme files, widgets, or an injected plugin. Clean the injected markup out of the posts instead and keep the content. Deleting is only reasonable for pages the attacker created from scratch, which are spam pages rather than posts of yours that were modified.
How do I stop the spam links from coming back?
Find and close the entry point, not just the links. That means removing every backdoor, rotating all WordPress, hosting, FTP and database credentials, deleting admin accounts you cannot account for, updating or removing the vulnerable plugin or theme, and checking other sites in the same hosting account. Link injection pays whoever set it up, so they have every reason to return if the door is still open.