Injected content, usually from a compromise.
WHAT IT LOOKS LIKE
Pages you did not create, frequently selling pharmaceuticals, loans or replica goods Spam links injected into your existing pages, sometimes visible only to search engines Search results for your site showing unrelated keywords Redirects affecting only visitors arriving from search
HOW YOU FIND OUT
A Search Console security notice Searching your site and seeing unfamiliar results A customer reporting something odd A sudden change in indexed page count
WHAT TO DO
- Treat it as a compromise, because it is. Follow the malware cleanup process.
- Find and remove every spam page and injected link.
- Find and remove the backdoor, or it returns within days.
- Change every password.
- Update everything.
- Request removal of the spam URLs from the index.
- Request a review if a security notice was issued.
CHECKING THOROUGHLY
Search your own site with a site-restricted query and look through the results for pages you do not recognise.
Check as a search engine sees you, since some injections show different content to crawlers.
