WordPress Casino Spam: Recognizing and Cleaning It

What WordPress Casino Spam Looks Like

This phenomenon goes by several names depending on the country: “Japanese keyword hack,” “pharma hack,” “casino hack.” The mechanism is the same.

Symptoms Seen from Google

It all starts with a site:votredomaine.fr search. Instead of your usual thirty pages, Google lists three thousand: “best online casino 2026,” “no deposit bonus slots,” “slot gacor,” often in Japanese, Indonesian, or Turkish. The addresses look like /casino/, /slot-online/, /?p=xxxx or random subfolders. Clicking from Google redirects the visitor to a betting site; typing the same address directly shows a 404 page or your normal site. This difference in behavior is the signature of WordPress casino spam: the injected code reads the referrer and user agent, serving spam content only to Google bots and visitors coming from a search result. This makes it so difficult for the owner to spot, as they always type their site’s address manually. Other signs follow: Search Console reports thousands of new indexed pages and “security issues,” click-through rates for your real keywords plummet, complaint emails arrive, and sometimes the host blocks the account due to server load generated by millions of bot requests on the fake pages.

What the Attacker Gains with WordPress Casino Spam

The goal isn’t to harm you, but to borrow your reputation. An old domain with inbound links and a clean history ranks in Google much more easily than a domain created yesterday. Networks that sell links to online casinos in countries where their advertising is prohibited have industrialized the takeover of ordinary WordPress sites: each hacked site becomes a relay that hosts betting pages, links back to the client casino, and transfers some of its authority. A single network can control tens of thousands of sites, distributed by country and language. The injected code is designed to last: it reinstalls itself if a file is deleted, hides in multiple places at once, and carefully avoids modifying the homepage. The more invisible the infection remains, the more the site earns. That’s why a WordPress casino spam can live for six months or a year on a corporate site without anyone noticing, until the day Google removes the domain from its results or displays the warning “This site may be hacked.” At this stage, the loss of visibility is already in place, and recovery will take several weeks after cleanup.

Cleaning WordPress Casino Spam in Seven Steps

Cleaning requires method, not expertise. The classic mistake is to delete visible pages and stop there.

Finding the Injected Code

The code hides in several places at once, and you need to find them all. Start with recently modified files: from SSH access, find . -name "*.php" -mtime -30 lists everything that has changed in the last month. Compare the WordPress core with the official version, either via an integrity check tool or by downloading the same version and comparing folder by folder. Then examine the favorite locations for this type of infection, summarized in the table below. Search all files for the patterns eval(, base64_decode(, gzinflate(, str_rot13(, and long unreadable character strings. Also look for files that shouldn’t exist: a .php in uploads, a wp-conf.php, a index2.php, a randomly named file in the root. Finally, the database: the wp_posts table often contains thousands of spam posts, sometimes with a special status that hides them from the administration, and the wp_options table can host a script in the theme options. An unknown administrator in wp_users is almost systematic.

Delete, Replace, Then Verify

Once the infection map is established, follow this order, without skipping any steps.

1. Back up the infected state, files and database, off the server. You’ll probably never go back to it, but it’s your safety net.
2. Change all passwords: WordPress, FTP, database, hosting. Regenerate wp-config.php security keys.
3. Replace the core: delete wp-admin and wp-includes, reinstall the same version from wordpress.org, put back the root files except wp-config.php.
4. Reinstall plugins and themes from their official sources, delete anything no longer used or without a known source.
5. Clean the database: delete spam posts in batches, remove unknown administrators, inspect wp_options.
6. Purge sitemaps and cache, then restart an external scan and a site: search.
7. Request deletion of spam pages in Search Console and a security review.

Verification doesn’t stop the same day: monitor modified files for at least two weeks. A reinfection in the first few days means a backdoor survived or the original vulnerability wasn’t closed.

Restore a backup instead of cleaning?

The question comes up every time, and the answer depends on two dates: the date of infection and the date of the last known clean backup. If you have a copy from before the first betting pages appeared in Google, and little content has been published since, restoration is the fastest route: an hour instead of a day. The trap is that most automatic backups run for seven or thirty days, while WordPress casino spam often lives for several months before being noticed; all available copies then already contain the infection, sometimes in a dormant form that will reactivate a few days after restoration. To decide, date the infection using modified files and Search Console, which indicates when the number of indexed pages started to climb, then choose a significantly earlier backup. In any case, restoration does not exempt you from changing passwords, immediately updating everything installed, or checking administrators: the vulnerability that allowed entry also exists in the backup, and the bot that exploited it will return. A site restored without these three steps will be reinfected within a week, with the added loss of content published in the interim.

Making Pages Disappear from Google

Cleaning the server isn’t enough: Google keeps the three thousand casino pages in its index for weeks, and continues to associate your domain with these keywords. You need to accelerate their removal. First, ensure that the old addresses now return a 404 code or, better yet, 410, which signals permanent deletion and speeds up deindexing. Then, in Search Console, use the removal tool for the most frequent address prefixes, for example, anything starting with /casino/. Resubmit your legitimate sitemap, and only that one. If Search Console shows a security issue, request a review by describing the actions taken; the response usually arrives within a week. Also check Bing, whose webmaster tools offer the same functions. Expect a gradual recovery: cleaned sites usually regain their ranking in four to eight weeks, sometimes longer if the infection had been present for a long time. During this period, publish normally and monitor Search Console weekly; the number of indexed pages should steadily decrease towards your actual figure.

Preventing It From Coming Back

WordPress casino spam cleaned without correcting the cause will return in a few days.

WordPress Casino Spam: Common Entry Points

In almost all documented cases, the infection occurs through an outdated plugin or theme, whose vulnerability is public and automatically exploited by bots continuously scanning the web. Form builders, galleries, page builders, and backup plugins are the most common targets, simply because they are installed on millions of sites. Next come weak or reused passwords: an “admin” account with a password that appeared in a data breach is tested within the hour. Paid themes and plugins downloaded for free from counterfeit sites come in third: they are delivered with the backdoor integrated, and the spam installation follows a few weeks later. Finally, on poorly partitioned shared hosting, an abandoned site on the same account can contaminate its neighbors. What WordPress casino spam almost never exploits is a vulnerability in the WordPress core: these are rare and fixed within hours. In other words, the cause is almost always a delayed update or a password issue, two things that can be fixed without particular technical skill, provided it’s done regularly.

WordPress Casino Spam: Monitoring That Stops It in an Hour

The difference between an infection discovered in an hour and one discovered by Google six months later comes down to one element: someone or something is watching the site every day. Effective monitoring daily compares site files to a known fingerprint and alerts on any new or modified PHP file, especially in uploads and mu-plugins. It lists administrators and flags any unexpected accounts. It verifies that wp-config.php, .htaccess, and the sitemap haven’t changed. It checks that the site returns the same content to a normal visitor and to Googlebot, which detects the cloaking characteristic of this attack. Alongside monitoring, three measures significantly reduce exposure: weekly updates of everything installed, prohibiting PHP execution in the uploadsfolder, and disabling the file editor in the admin. For an agency managing twenty or fifty sites, doing this manually is impossible; this is precisely what a site management tool automates, reporting daily on sites where a file has changed or a plugin is outdated.

Frequently Asked Questions

My site displays normally, am I really infected? Yes, if site:votredomaine.fr shows betting pages. The code only serves them to Google and visitors coming from a search result.

Is deleting spam pages enough? No. They are regenerated by the injected code, which must be removed from files and the database.

How long to regain my ranking? Four to eight weeks after a complete cleanup and an accepted review.

Would a firewall have been enough? It would have blocked connection attempts, not the exploitation of an outdated plugin. Updating remains the primary protection.