You check on a client site you have not touched in weeks. Everything looks fine from the dashboard. Then you Google the domain and see pages you never created. Casino bonus offers. Slot game reviews. Betting site redirects. All indexed under your domain.
That is the WordPress casino hack. It is the most common type of SEO spam infection on WordPress sites right now, and it specifically targets sites that are not monitored regularly.
I manage multiple WordPress sites across DigitalOcean droplets using RunCloud. I have cleaned this exact infection from client sites. Here is everything I learned about how it works, how to remove it properly, and how to make sure it does not come back.
What the WordPress Casino Hack Actually Is
The WordPress casino hack is not a single exploit. It is a category of SEO spam attacks where hackers inject casino and gambling content into your WordPress site to steal your domain authority for backlink value.
The attackers do not care about your site. They care about your domain reputation. A site with decent authority and real backlinks is worth more to them than a brand new domain. They inject hidden links, create doorway pages, or redirect your visitors to casino sites. Your domain does the SEO heavy lifting for their gambling pages.
This has overtaken Japanese SEO spam and pharma spam as the most prevalent WordPress infection type. The online gambling industry exploded during COVID lockdowns, and the spam infrastructure never went away. It scaled.
How to Tell If Your Site Is Infected
Most site owners do not notice the infection from inside WordPress. The hack is designed to be invisible to logged-in administrators. Here is how to actually find it.
1. Check Google’s index of your site
Go to Google and search site:yourdomain.com. Scroll through the results. If you see pages with titles containing casino, slot, poker, betting, or gambling terms that you never created, your site is infected. This is the fastest way to confirm it.
2. Check Google Search Console
Look at the Pages report and the Performance report. If you see URLs you do not recognize getting impressions for gambling keywords, that is the infection showing up in search data. Google may also have sent you a Manual Action notice under Security & Manual Actions.
3. Test with a different user agent
Many casino hacks use cloaking. They show normal content to logged-in users and administrators but show casino spam to search engine crawlers and first-time visitors. Open your site in an incognito window. Better yet, use curl with a Googlebot user agent string:
curl -A “Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)” https://yourdomain.com
If the HTML that comes back contains casino links, iframes, or redirects that you do not see when browsing normally, you have a cloaked infection.
4. Check on mobile
Some variants only trigger redirects on mobile devices. Open your site on your phone using mobile data (not your office WiFi) and see if it redirects to a gambling site.
5. Run a site scan.
Sucuri SiteCheck (free) or Wordfence can catch the obvious infections. But do not rely only on scanners. The sophisticated variants store their payloads in the database, not in files, which means file-only scanners miss them entirely.
Where the Malicious Code Hides
This is where most cleanup guides fail. They tell you to scan your files and delete anything suspicious. But modern casino spam infections use multiple layers of persistence. Clean one and the others reinfect the site within hours.
Here are the actual locations to check, based on what I have seen in real cleanups.
1. Theme files
The active theme’s functions.php is the most common injection point. Look for base64-encoded strings, eval() calls, or code blocks you do not recognize. Also check header.php and footer.php for injected scripts or iframes.
2. Fake plugins
Attackers create fake plugins with innocent-sounding names and place them in wp-content/plugins/. The plugin does not appear in the WordPress dashboard because it is designed to be hidden from the plugin list. You will only find it by looking at the directory via FTP, SSH, or your file manager.
3. MU-plugins
The wp-content/mu-plugins/ directory is a favorite hiding spot. MU-plugins load automatically on every page request without needing activation. Many site owners do not even know this directory exists. If you see PHP files in there that you did not create, that is almost certainly malware.
4. The database
This is the one most people miss. Attackers store encoded payloads in wp_options using deceptive option names. They also inject spam content directly into wp_posts, including into post revisions that survive content edits. Run these SQL queries to check:
SELECT * FROM wp_options WHERE option_value LIKE '%casino%' OR option_value LIKE '%slot%' OR option_value LIKE '%base64_decode%'
SELECT ID, post_title, post_status FROM wp_posts WHERE post_content LIKE '%casino%' OR post_content LIKE '%gambling%' OR post_content LIKE '%slot%';
5. .htaccess file
Check for redirect rules you did not add. Attackers insert conditional rewrite rules that redirect only search engine traffic or only mobile users to casino sites.
6. wp-config.php and index.php
Sometimes the infection goes straight to the root. Compare your wp-config.php and index.php against clean copies. Any include() or require() statement pointing to an unfamiliar file is a red flag.
7. Cron jobs
Check both WordPress cron (wp_options table, look for cron in option_name) and server-level cron jobs (crontab -l). Attackers schedule reinfection scripts that run periodically and rewrite the malware back if you delete it.
The Reinfection Problem
This is the reason most cleanups fail. The casino hack is built like a hydra. It plants backup copies of itself across multiple locations. When you find and delete the infection in functions.php, a sleeper script in mu-plugins detects that the malware is gone and rewrites it.
When you delete the MU-plugin, a cron job recreates it from an encoded payload stored in the database.
You cannot clean this infection one file at a time over multiple days. You need to find every persistence point and remove them all in a single maintenance window. If you leave even one backdoor, the site will be reinfected within hours.
Step-by-Step Cleanup Process
There are two ways to do this depending on your access level. Most site owners only have the WordPress admin dashboard and a hosting control panel like cPanel or Hostinger’s hPanel. Some of us also have SSH and server access.
I have written both tracks below. If you only have admin and panel access, follow the first track. If you manage your own server, the second track goes into more depth. Either way, do everything in a single session. Do not spread this across multiple days, because the infection reinfects itself if you leave any piece behind.
Track One: Cleanup With Only Admin and Hosting Panel Access
This is for the majority of site owners. No SSH, no command line. Just your WordPress dashboard and your hosting control panel (cPanel, hPanel, Plesk, or similar).
1. Take a Full Backup First
Before you touch anything, back up your entire site. If something goes wrong, you need a restore point.
The best option is your hosting panel’s built-in backup. In cPanel, look for the Backup or Backup Wizard tool and download a full backup (files plus database). In Hostinger’s hPanel, go to Files > Backups. Most managed hosts have a one-click backup somewhere in the dashboard.
If your host does not offer backups, use a backup plugin like UpdraftPlus, Duplicator, or All-in-One WP Migration. Install it from Plugins > Add New, run a full backup, and download the files to your computer. Keep in mind a plugin backup of an infected site includes the infection, so this is only a safety net for restoring if cleanup breaks something, not a clean copy.
2. Put the Site in Maintenance Mode
Install a plugin like WP Maintenance Mode or LightStart from Plugins > Add New and activate maintenance mode. This shows visitors a simple “under maintenance” page while you work, so nobody lands on casino spam, and Google does not crawl it mid-cleanup.
3. Update WordPress, Plugins, and Themes From the Dashboard
Go to Dashboard > Updates. Update WordPress core to the latest version by clicking the update button. Then update every plugin and every theme. Do them all.
This matters because the infection almost always entered through an outdated plugin with a known vulnerability. Updating core alone reinstalls clean WordPress files and closes many entry points, and updating plugins patches the hole the attackers used.
If a plugin has no update available and you do not recognize it, that is a red flag. Note its name and move to the next step.
4. Delete Plugins and Themes You Do Not Recognize
Go to Plugins > Installed Plugins. Look carefully at the list. Delete any plugin you did not install yourself. Casino hackers often add fake plugins with innocent names to blend in.
Then go to Appearance > Themes and delete every theme you are not actively using. Keep only your active theme and maybe one default WordPress theme (like Twenty Twenty-Four) as a fallback. Unused themes are just extra attack surface sitting on your server.
Important: some fake plugins hide themselves from this list. You will catch those in the file manager step below.
5. Check Your Users for Fake Admin Accounts
Go to Users > All Users. Look at the administrator accounts. If you see any account you did not create, especially one with a random username or a recent registration date, that is the hacker’s backdoor account.
Delete every admin account you do not recognize. When WordPress asks what to do with their content, choose to delete it or attribute it to your real admin account.
Then check your own legitimate accounts for application passwords. Edit each admin user and scroll to the Application Passwords section near the bottom. These are separate credentials that give API access without using the normal login, and attackers love to generate one because it survives a normal password reset.
If you see any application password you did not create yourself, revoke it immediately. If you do not use application passwords at all, revoke every one listed.
6. Use the Hosting File Manager to Find Hidden Malware
This is the step that separates a real cleanup from a fake one. Open the File Manager in your hosting panel (cPanel > File Manager, or hPanel > File Manager). Navigate to your site’s folder, usually public_html.
Check these locations:
- wp-content/mu-plugins/ — This folder may not exist on a clean site. If it exists and contains PHP files you did not create, they are almost certainly malware. MU-plugins run automatically on every page without needing activation, which is why hackers love this folder. Delete any file here you did not put there yourself.
- wp-content/plugins/ — Look through the folders here. If you see a folder with a strange name that did not show up in your WordPress plugins list, that is a hidden fake plugin. Delete the whole folder.
- Your active theme folder (wp-content/themes/your-theme/) — Open functions.php, header.php, and footer.php using the file manager’s edit or view option. Look for long strings of random-looking characters, or code that starts with eval(, base64_decode(, or gzinflate(. This is obfuscated malware. If you are not sure what is safe to remove, the safer move is to delete the entire theme and reinstall a fresh copy from the theme’s official source.
- Root files (public_html/) — Check index.php and .htaccess. For .htaccess, look for redirect rules mentioning unfamiliar domains. The safest fix is to delete .htaccess entirely, then go to your WordPress dashboard > Settings > Permalinks and click Save Changes. WordPress rebuilds a clean .htaccess automatically.
Use the file manager’s date-modified column to sort files by when they were last changed. Files modified around the time your site got hacked, that you did not touch yourself, deserve a close look.
7. Change Every Password
Do all of these in one sitting:
Change your WordPress admin password for every user account (Users > All Users > edit each one). While you are on each user’s edit screen, revoke any application passwords you have not already cleared in step 5.
Change your hosting panel password. Change your FTP password if you have one (in cPanel under FTP Accounts). If you use the same password anywhere else, change it there too.
8. Clean Google’s Record of Your Site
Follow the “After Cleanup” section further down to remove the spam pages from Google and request a security review. This part is the same regardless of your access level.
Once you finish Track One, your site should be clean. If you have server access and want to go deeper (or you suspect the infection reached the database or other sites on your server), continue with Track Two below.
Track Two: Advanced Cleanup With SSH and Server Access
This track is for developers and agencies who manage their own servers. It covers the database, server logs, and cross-site contamination that the panel-only track cannot reach.
1. Take a Full Backup First
Before you touch anything, back up your entire site, including files and database. Use your hosting panel, SSH, or a server-level tool rather than a WordPress backup plugin, since the plugin itself might be compromised.
# Database backup mysqldump -u username -p database_name > backup_before_cleanup.sql # Files backup tar -czf backup_before_cleanup.tar.gz /path/to/wordpress/
2. Put the Site in Maintenance Mode
Do not let visitors hit the infected site while you are working. Either enable maintenance mode through your hosting panel or drop a simple maintenance.html and point your server config to it temporarily.
3. Replace WordPress Core Files
Download a fresh copy of WordPress from wordpress.org. Replace all core files (wp-admin/, wp-includes/, and root PHP files except wp-config.php). This eliminates any infected core files without touching your content.
# Download fresh WordPress
wget https://wordpress.org/latest.tar.gz
tar -xzf latest.tar.gz
# Replace core directories
rsync -a wordpress/wp-admin/ /path/to/site/wp-admin/
rsync -a wordpress/wp-includes/ /path/to/site/wp-includes/
# Replace root files except wp-config.php
for file in wordpress/*.php; do
filename=$(basename "$file")
if [ "$filename" != "wp-config.php" ]; then
cp "$file" /path/to/site/
fi
done4. Audit and Clean Plugins
Delete every plugin directory and reinstall from official sources. Do not try to clean infected plugin files manually. It is faster and safer to delete and reinstall.
Check wp-content/mu-plugins/ and remove anything you did not place there intentionally. If you use MU-plugins for legitimate purposes (like I do for client sites), verify each file against your own records.
5. Audit and Clean Themes
Same approach. Delete inactive themes completely. For your active theme, compare every file against the official version from the theme developer. If you use a custom theme, check every PHP file for injected code. Search for eval(, base64_decode(, gzinflate(, str_rot13(, and preg_replace with the e modifier.
6. Clean the Database
This is the step most guides skip or barely cover. Run targeted queries to find and remove injected content.
-- Find suspicious options SELECT option_id, option_name, LEFT(option_value, 200) FROM wp_options WHERE option_name LIKE '%client_data%' OR option_name LIKE '%widget_text%' OR option_value LIKE '%base64_decode%' OR option_value LIKE '%casino%' OR option_value LIKE '%eval(%'; -- Check for spam posts SELECT ID, post_title, post_type, post_status FROM wp_posts WHERE post_content LIKE '%casino%' OR post_content LIKE '%slot%' OR post_content LIKE '%gambling%' OR post_title LIKE '%casino%'; -- Check for unauthorized users SELECT * FROM wp_users WHERE user_registered > DATE_SUB(NOW(), INTERVAL 30 DAY); -- Check user meta for elevated privileges on accounts you don't recognize SELECT u.user_login, um.meta_value FROM wp_users u JOIN wp_usermeta um ON u.ID = um.user_id WHERE um.meta_key = 'wp_capabilities' AND um.meta_value LIKE '%administrator%'; -- Check for application passwords (survive a normal password reset) SELECT u.user_login, um.meta_value FROM wp_users u JOIN wp_usermeta um ON u.ID = um.user_id WHERE um.meta_key = '_application_passwords';
Delete any spam posts, fake user accounts, and suspicious options. Any account with an _application_passwords meta value that you did not authorize should have that meta row deleted, since revoking the login password alone does not kill an application password. Also check wp_posts revisions. Attackers sometimes inject content into older revisions that reappear when you revert changes.
7. Clean .htaccess
Delete your .htaccess file and regenerate it from WordPress by going to Settings > Permalinks and clicking Save. Compare the result against the default WordPress .htaccess rules for your permalink structure.
8. Check and Clean Cron Jobs
# Server-level cron crontab -l # Look for anything you didn't add # WordPress cron - check via WP-CLI wp cron event list
Remove any scheduled events you do not recognize.
9. Change Every Credential
All of them. In a single session.
- WordPress admin passwords for every user account
- Application passwords for every account (revoke all, then reissue only what you actually use)
- Database password (update wp-config.php to match)
- FTP/SFTP passwords
- SSH keys if applicable
- WordPress security salts (regenerate from the WordPress salt generator and paste into wp-config.php)
- Hosting panel password
10. Update Everything
Update WordPress core, every plugin, and every theme to the latest versions. The infection almost certainly entered through an outdated plugin with a known vulnerability. If you do not patch the entry point, the same attackers will be back.
Server-Level Checks
If you manage your own server as I do with RunCloud and DigitalOcean, there are additional places to check that most WordPress-only guides never mention.
Check for backdoor files outside the WordPress directory. Attackers sometimes place PHP shells above the web root or in other directories on the same server. Search the entire server:
find /var/www -name “*.php” -newer /var/www/html/wp-config.php -mtime -30 | head -50
Check for cross-contamination. If you host multiple WordPress sites on the same server (which I do across droplets), one infected site can compromise others. Check every site on the same server, not just the one showing symptoms.
Review server access logs. Look for POST requests to unusual PHP files. Attackers often use web shells that accept POST requests to execute commands.
grep "POST.*\.php" /var/log/nginx/access.log | grep -v "wp-admin\|wp-login\|wp-cron\|admin-ajax\|xmlrpc" | tail -100
File integrity monitoring. If your hosting panel or server management tool offers file change detection, enable it. RunCloud has security features that help with this. Any unexpected file change on a production WordPress site should trigger an alert.
After Cleanup: Getting Google to Trust Your Site Again
Cleaning the infection is half the job. You also need to fix your relationship with Google.
1. Request a security review in Google Search Console.
If Google has flagged your site with a Manual Action or Safe Browsing warning, submit a review request after cleanup. Explain what happened and what you fixed. Google typically processes these within a few days to a couple of weeks.
2. Remove spam URLs from the index
Use the URL Removal Tool in Search Console to request removal of the casino spam pages that were indexed. Also submit an updated sitemap that only includes your legitimate pages.
3. Check your backlink profile
The spam pages may have attracted backlinks from other casino spam sites. Use Ahrefs or Search Console to identify these and disavow them if needed.
4. Monitor for reinfection
Check site:yourdomain.com in Google weekly for at least a month after cleanup. Set up Google Alerts for your domain combined with casino and gambling terms. If the spam pages reappear, you missed a persistence point during cleanup.
How to Prevent This From Happening Again
The WordPress casino hack almost always enters through one of four doors: an outdated plugin with a known CVE, a nulled or pirated theme or plugin, a weak admin password, or cross-site contamination on shared hosting.
- Keep everything updated. WordPress core, plugins, and themes. Enable auto-updates for security releases at minimum. The majority of WordPress hacks exploit known vulnerabilities that already have patches available.
- Do not use nulled themes or plugins. Ever. A nulled premium theme is the fastest way to hand your site to an attacker. If you cannot afford the plugin, find a free alternative. Do not use a cracked version.
- Use strong, unique passwords and two-factor authentication. Every WordPress admin account. No exceptions. Use a password manager.
- Remove what you do not use. Deactivated plugins and unused themes still have their files on your server. If those files have a vulnerability, attackers can access them directly. Delete anything you are not actively using.
- Limit admin accounts. Audit your user list regularly. Remove accounts that no longer need access. Every admin account is an attack surface.
- Use a web application firewall. A WAF blocks known attack patterns before they reach your WordPress installation. Cloudflare’s free plan provides basic WAF protection. Sucuri and Wordfence offer WordPress-specific WAF options.
- Monitor sites you do not touch often. This is the biggest lesson from my own experience. The sites that get hit are the ones nobody is watching. If you have client sites or side projects that run on autopilot, set up at least basic monitoring. A weekly site:domain.com check takes 30 seconds and can catch an infection before it does real damage.
The Real Lesson
The WordPress casino hack is not sophisticated. It exploits a simple reality: most WordPress sites are set up and then forgotten. Plugins go unupdated. Nobody checks the file system. The dashboard looks fine, so everything must be fine.
The sites I have seen get infected were always the ones that had not been touched in a while. The actively maintained sites, the ones getting regular updates and monitoring, stayed clean.
If you manage WordPress sites, build the habit of checking on the quiet ones. That is where the casino spam moves in first.
