You search for a free PDF converter or a software installer, click the second result, and download something that looks right. A week later your browser is full of strange extensions or your bank login has been used elsewhere. That is SEO poisoning working as designed.
The Short Answer
The most common objective is to spread malware and steal data. Attackers get malicious pages to show up high in search results so that people come to them, instead of having to send phishing emails. Typical payloads are info-stealers, fake login pages, browser hijackers and scam support numbers. Some campaigns just aim to redirect traffic to shady shops or ad pages for quick money, but malware and credential theft are the main goal.
How It Works
Attackers use the same tactics honest SEOs use, but for the wrong reasons. They build pages around popular or trending searches, such as software downloads, tax forms, event tickets and news. They stuff pages with keywords, copy content, and often hack a legitimate website to host the page so it borrows the site’s trust.
On hacked WordPress sites we see a few repeating signs: hundreds of unfamiliar pages with Japanese or pharma text, redirects that fire only for visitors arriving from Google, and a page that looks fine when you type the URL directly. This “cloaking” is intended to hide the infection from the owner.
Why It Hurts Site Owners Too
If your site is the one being used, you pay twice. Google may flag it with a “This site may be hacked” label or a Safe Browsing warning in Chrome. Rankings fall, visitors stop trusting you, and ad accounts can be disapproved if Google Ads finds malware on your landing pages. Cleaning up takes time, and requesting a review in Search Console only works after every trace is gone.
How Site Owners Can Protect Themselves
- Keep WordPress core, themes and plugins updated, and delete any you do not use
- Avoid nulled themes and plugins. They are a favourite delivery method
- Use strong, unique passwords and two-factor login for admin accounts
- Check the Security issues and Manual actions reports in Search Console regularly
- Search site:yourdomain.com once a month and look for pages you never made
- Keep offsite backups so you can restore a clean version quickly
A reputable security plugin or host-level malware scanner helps, but nothing replaces updates and access control.
How Users Can Stay Safe
Be careful with search results for downloads. Go to the official vendor site by typing the address, not by clicking an ad or a result. Check the domain spelling, be suspicious of “free cracked” software, and never run an installer from a page that pushes you to disable antivirus. Keep your browser and operating system updated, and use a password manager, because it will not auto-fill on a fake login page.
If you do get hit, act in order. Take a backup for evidence, change every password including hosting, FTP and database, scan files for recently modified code, remove the bad pages, and then ask Google to re-check the site from Search Console. Rushing the review request before the clean-up is finished usually just gets rejected, and it costs you days.
SEO poisoning succeeds because people trust Google’s results. That trust is mostly deserved, but a few seconds of checking where a link actually leads is cheap protection.
If your site has odd pages, sudden traffic drops or security warnings, our SEO team can help you trace the infection and recover your rankings.
