You check your site, and everything looks normal. Then you Google your domain and see results for Viagra, Cialis, and online pharmacies you never heard of. Or a visitor messages you saying your site redirected them to a sketchy pills store. Your site is serving pharmaceutical spam to search engines and visitors while showing you a clean dashboard.
This is the WordPress pharma hack, also called the Google Viagra hack. It is one of the oldest and most persistent WordPress infections, and it specifically targets your domain authority and search rankings rather than your data or your visitors directly. The attackers do not want to break your site. They want to use it.
I manage multiple WordPress sites across DigitalOcean droplets and have cleaned SEO spam infections off client sites. Here is exactly how the pharma hack works, how to find it, and how to remove every piece of it so it does not come back.
What the WordPress Pharma Hack Actually Is
The pharma hack is an SEO spam attack. Hackers break into your WordPress site and inject pharmaceutical keywords, hidden links, and doorway pages promoting counterfeit drugs. Your domain’s authority does the ranking work for their spam pages. They get the traffic and the sales. You get the Google penalty and the confused visitors.
It is designed to be invisible to you as the site owner. The infection uses cloaking, showing normal content to logged-in administrators and a different version (full of pharma spam) to search engine crawlers and first-time visitors.
This is why most site owners discover it from the outside, through a Google search, a Search Console warning, or a visitor complaint, rather than from inside the dashboard.
In 2026, the pharma hack has evolved. Modern variants now use AI-generated spam content that is harder for scanners to flag as malicious because it lacks the obvious keyword patterns that older scanners look for.
The injection methods are also more aggressive, targeting the database and scheduled tasks rather than just theme files, which means file-only scans miss them entirely.
How to Tell If Your Site Has the Pharma Hack
- Search Google for your site – Go to Google and search site:yourdomain.com. Scroll through the results. If you see pages with pharmaceutical titles, drug keywords, or links to online pharmacies that you never created, your site is infected. This is the fastest confirmation.
- Check Search Console. Look at your Performance report for queries your site is ranking for. If you see impressions or clicks for terms like viagra, cialis, pharmacy, or pills, that’s spam showing up in search data. Check the Security and Manual Actions section for any warnings Google has already flagged.
- Test with cloaking in mind. The infection hides from you when you are logged in. Open your site in an incognito window, or better, use a Googlebot user agent:
curl -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" https://yourdomain.com
If the returned HTML contains pharmaceutical links or content you do not see when browsing normally, you have a cloaked pharma infection.
- Check on mobile from a different network. Some variants only trigger on mobile devices or on traffic that comes from search engines. Open your site on your phone using mobile data (not your home or office WiFi) and click through from a Google result if possible.
- Run an external scan. Sucuri SiteCheck is free and catches many file-based infections. But as mentioned, database-stored variants get missed by file-only scanners. Use the scan as a starting point, not a final verdict.
Where the Pharma Hack Hides
The pharma hack uses the same hiding spots as other SEO spam infections, with some specific favorites.
- The database. This is where modern pharma infections live. Attackers inject spam content directly into wp_posts, insert hidden pharmaceutical links into post content and revisions, and store encoded payloads in wp_options. Because the content is in the database rather than in files, file scanners report the site as clean while the spam is still actively showing to Google.
- Theme files. The functions.php file in your active theme is a classic injection point. Look for base64-encoded strings, eval() calls, or conditional logic that checks for Googlebot before deciding what to output. Also check header.php and footer.php for injected links or scripts.
- Fake plugins. Attackers create fake plugins in wp-content/plugins/ that hide from the WordPress plugin list in the dashboard. You will only find them by looking at the directory directly through FTP, SSH, or the file manager in your hosting panel.
- mu-plugins directory. Files in wp-content/mu-plugins/ load automatically on every page request without activation and are invisible to most site owners. Any PHP file in this directory that you did not place there is almost certainly malicious.
- WordPress cron. The pharma hack often schedules a reinfection cron job in WordPress that periodically rewrites the malware if it detects it has been removed. This is why cleaning the files and database is not enough on its own.
- .htaccess. The redirect variant of the pharma hack adds conditional redirect rules in .htaccess that send search engine traffic to pharmaceutical sites. Check this file for any rewrite rules you did not add.
The Reinfection Problem
The same warning from the casino hack guide applies here. Modern pharma infections are built with multiple persistence layers. If you remove the spam pages but leave a sleeper script in mu-plugins, or clean the files but leave an encoded payload in wp_options, the site reinfects itself within hours.
You need to find and remove every persistence point in a single session. Spread the cleanup across two days, and the infection is back before you finish.
Step-by-Step Cleanup Process
The process splits into two tracks depending on your level of access. If you only have your WordPress dashboard and a hosting control panel, follow Track One. If you have SSH and server access, follow Track Two, which goes deeper into the database and server.
Either way, do everything in one session.
Track One: Cleanup With Dashboard and Hosting Panel Access
1. Take a Full Backup First
Back up your entire site before touching anything. Use your hosting panel’s built-in backup tool (cPanel Backup Wizard, Hostinger hPanel Backups, or similar). If your host does not offer this, install UpdraftPlus from Plugins > Add New, run a full backup, and download it to your computer.
This backup includes the infection, so it is not a clean copy. It is a restore point in case something goes wrong during cleanup.
2. Put the Site in Maintenance Mode
Install WP Maintenance Mode or LightStart from Plugins > Add New and activate it. This prevents visitors from landing on pharma spam while you work and stops Google from crawling the infected state mid-cleanup.
3. Update Everything From the Dashboard
Go to Dashboard > Updates. Update WordPress core, every plugin, and every theme. The pharma hack almost always enters through an outdated plugin. Updating core reinstalls clean WordPress files, and updating plugins closes the entry point.
If you see a plugin with no update available that you do not recognize, note it down. It is likely a fake plugin planted by the attacker.
4. Delete Unrecognized Plugins and Unused Themes
Go to Plugins > Installed Plugins. Delete every plugin you did not install yourself. Go to Appearance > Themes and delete every theme you are not actively using. Unused themes are an attack surface sitting on your server.
5. Check Users and Application Passwords
Go to Users > All Users. Delete any administrator account you did not create. Then edit each of your legitimate admin accounts and scroll to the Application Passwords section. Revoke any application password you did not generate yourself. These survive normal password resets and give API access without going through the login page, making them a favorite backdoor.
6. Use the File Manager to Find Hidden Malware
Open the File Manager in your hosting panel and navigate to your site’s public folder (usually public_html).
Check these locations in order:
- wp-content/mu-plugins/ — If this folder exists and contains PHP files you did not create, delete them. Every file here loads automatically on every page request.
- wp-content/plugins/ — Look through every folder. If you see a folder that does not match any plugin in your WordPress dashboard, that is a fake plugin. Delete the entire folder.
- Your active theme (wp-content/themes/your-theme/) — Open functions.php, header.php, and footer.php. Look for long encoded strings or code blocks starting with eval(, base64_decode(, or gzinflate(. If you are not confident identifying what is malicious, delete the theme entirely and reinstall a fresh copy from its official source.
- Root folder (public_html/) — Delete the .htaccess file. Then go to WordPress dashboard > Settings > Permalinks and click Save Changes. WordPress rebuilds a clean .htaccess automatically. Also open index.php and look for any include() or require() pointing to files you do not recognize. Sort everything by date modified and look for files changed around the time the hack appeared. Unexpected modification dates on files you never touched are a red flag.
7. Clean Spam Content From Posts
Go to Posts > All Posts and search for any post you did not write. Pharma hacks sometimes create hidden posts with pharmaceutical content that are set to a non-public status but still get indexed by Google. Delete anything you do not recognize.
Also check Pages the same way.
8. Change Every Credential
Change your Wochanges admin password for every user account. Additionally, Change your hosting panel password and your FTP password. Regenerate your WordPress security salts (go to the WordPress salt generator, copy the new values, and paste them into wp-config.php via the file manager). If you reuse passwords anywhere else, change those too.
9. Tell Google
Follow the After Cleanup section at the end of this article to request a security review and clean up the indexed spam pages.
Track Two: Advanced Cleanup With SSH and Server Access
1. Take a Full Backup First
mysqldump -u username -p database_name > backup_before_pharma_cleanup.sql tar -czf backup_before_pharma_cleanup.tar.gz /path/to/wordpress/
2. Put the Site in Maintenance Mode
Enable maintenance mode through your hosting panel or temporarily redirect traffic at the server level while you work.
3. Replace WordPress Core Files
wget https://wordpress.org/latest.tar.gz tar -xzf latest.tar.gz rsync -a wordpress/wp-admin/ /path/to/site/wp-admin/ rsync -a wordpress/wp-includes/ /path/to/site/wp-includes/ for file in wordpress/*.php; do filename=$(basename "$file") if [ "$filename" != "wp-config.php" ]; then cp "$file" /path/to/site/ fi done
4. Search Files for Pharma Signatures
# Search for pharmaceutical keywords in PHP files grep -ri "viagra\|cialis\|pharmacy\|levitra\|tramadol\|pills" /path/to/site/wp-content/ --include="*.php" -l # Search for cloaking code checking for search engine bots grep -ri "googlebot\|bingbot\|user_agent" /path/to/site/wp-content/themes/ --include="*.php" -l # Search for obfuscated code grep -ri "base64_decode\|eval(\|gzinflate\|str_rot13" /path/to/site/wp-content/ --include="*.php" -l # Find recently modified files find /path/to/site -name "*.php" -mtime -30 | grep -v "wp-admin\|wp-includes"
5. Delete and Reinstall Plugins and Themes
Delete every plugin directory and reinstall from official sources. Do the same with themes. Do not try to clean infected plugin files manually.
Check wp-content/mu-plugins/ and remove any file you did not place there. Check wp-content/plugins/ for directories that do not match any active plugin.
6. Clean the Database
-- Find pharma spam in posts SELECT ID, post_title, post_status, post_type FROM wp_posts WHERE post_content LIKE '%viagra%' OR post_content LIKE '%cialis%' OR post_content LIKE '%pharmacy%' OR post_content LIKE '%pills%' OR post_content LIKE '%levitra%'; -- Find encoded payloads in options SELECT option_name, LEFT(option_value, 300) FROM wp_options WHERE option_value LIKE '%base64_decode%' OR option_value LIKE '%eval(%' OR option_value LIKE '%viagra%' OR option_value LIKE '%pharmacy%'; -- Check for spam in post meta SELECT post_id, meta_key, LEFT(meta_value, 200) FROM wp_postmeta WHERE meta_value LIKE '%viagra%' OR meta_value LIKE '%pharmacy%' OR meta_value LIKE '%cialis%'; -- Find application passwords (survived password reset) SELECT u.user_login, um.meta_value FROM wp_users u JOIN wp_usermeta um ON u.ID = um.user_id WHERE um.meta_key = '_application_passwords'; -- Find unauthorized admin accounts SELECT u.user_login, u.user_email, u.user_registered, um.meta_value FROM wp_users u JOIN wp_usermeta um ON u.ID = um.user_id WHERE um.meta_key = 'wp_capabilities' AND um.meta_value LIKE '%administrator%'; Delete any spam posts, rogue admin accounts, and suspicious options rows. Any _application_passwords entry you did not authorize should have its meta row deleted. Also check post revisions. Pharma spam is sometimes injected into older revisions that resurface when content is reverted: DELETE FROM wp_posts WHERE post_type = 'revision' AND (post_content LIKE '%viagra%' OR post_content LIKE '%cialis%' OR post_content LIKE '%pharmacy%');
7. Clean .htaccess
Delete .htaccess and regenerate from the WordPress dashboard (Settings > Permalinks > Save Changes). Compare the result against the default WordPress .htaccess for your permalink structure.
8. Check and Remove Malicious Cron Jobs
# Server-level cron crontab -l # WordPress cron via WP-CLI wp cron event list # Remove a specific WordPress cron event if needed wp cron event delete event_name
Remove any scheduled events you do not recognize.
9. Check for Backdoors Outside the WordPress Directory
# Files modified in the last 30 days outside wp-admin and wp-includes find /var/www -name "*.php" -newer /var/www/html/wp-config.php -mtime -30 | grep -v "wp-admin\|wp-includes" | head -50 # Check for web shells accepting POST requests grep -ri "eval.*\$_POST\|eval.*\$_GET\|assert.*\$_POST" /var/www/ --include="*.php" -l
10. Check Server Access Logs for the Entry Point
# Find POST requests to unusual PHP files (likely web shells) grep "POST.*\.php" /var/log/nginx/access.log | grep -v "wp-admin\|wp-login\|wp-cron\|admin-ajax\|xmlrpc" | tail -100
Identifying the entry point matters because if you do not close it, the same attackers come back through the same door.
11. Change Every Credential
- WordPress admin passwords for every account
- Application passwords (revoke all, reissue only what you actually need)
- Database password (update wp-config.php to match)
- WordPress security salts (regenerate and update wp-config.php)
- SSH keys if you suspect compromise
- FTP and hosting panel passwords
12. Update Everything
Update WordPress core, every plugin, and every theme. The entry point is almost certainly an unpatched plugin. Close it.
After Cleanup: Repairing Your Standing With Google
Cleaning the site is half the work. Google has indexed your spam pages and may have flagged your domain. Here is how to fix that.
- Request a security review. Go to Google Search Console > Security and Manual Actions. If Google has flagged your site, submit a review request. Explain what happened and what you fixed. Google typically processes these within a few days to two weeks.
- Remove spam URLs from the index. Use the URL Removal Tool in Search Console to request temporary removal of the pharmaceutical spam pages that were indexed. Also submit an updated sitemap containing only your legitimate pages.
- Monitor for reinfection. Search site:yourdomain.com weekly for at least a month after cleanup. Set up a Google Alert combining your domain with pharmaceutical terms. If the spam pages reappear, you missed a persistence point and need another cleanup pass.
- Check your backlink profile. The spam pages may have attracted backlinks from other pharmaceutical spam sites. Use Ahrefs or Search Console to find them and disavow if needed.
How to Prevent the Pharma Hack
The pharma hack enters through the same doors as every other WordPress infection. Close those doors.
Keep everything updated. The majority of pharma hack infections exploit known plugin vulnerabilities that already have patches. Automatic security updates for plugins are worth enabling.
Never install nulled themes or plugins. Pirated premium software is the fastest path to infection. No exceptions.
Use two-factor authentication on every admin account. A stolen password is not enough if 2FA is on.
Delete plugins and themes you do not use. Deactivated software still has its files on your server, and those files can still be exploited.
Take remote backups on a regular schedule and actually test restoring from them. A backup you have never restored is a backup you do not know works.
Use a web application firewall. Cloudflare’s free plan provides basic edge protection. A WAF-level block stops many automated exploit attempts before they reach WordPress.
Monitor the sites you rarely touch. Unmonitored sites are where attackers park their spam. A weekly site:domain.com check takes 30 seconds and can catch an infection early.
WordPress has similar hack patterns like this; one of them is a casino hack WordPress. It’s quite similar to this one. If you want to know about that so that you can fix it if it happens to you, you can check our guide WordPress Casino Hack: How to Find It, Clean It Permanently
The Real Lesson
The pharma hack is not sophisticated. It exploits the same reality as every other WordPress SEO spam infection: sites that are set up and then not watched. Automated tools probe millions of sites for known vulnerabilities, inject their payload, and move on. Your site was not targeted. It was just reachable.
The cleanup is tedious but entirely doable, whether you have SSH access or only a cPanel file manager. The key is doing it completely in one session, finding every persistence layer, and closing the entry point so the same exploit cannot be used again.
If you would rather have someone handle it, this is exactly the kind of work I do. Get in touch about a professional cleanup.
