Is my site hacked? Cloaking, spam links and conditional redirects
A hacked site often looks fine to its owner and shows spam only to Googlebot or to visitors from Google. Compare the three fetches, find the injection, clean and request a review.
Step by step, with screenshots: Flagged by Google Safe Browsing: what it means and how to clear it →
Check your own site
Runs these 4 checks and the other 183, free, in about 45 seconds.
What a passing site looks like
- Visitors and Googlebot see the same page textfail · −15 ptseffort L
- No redirect that fires only for Googlebot or Google visitorsfail · −15 ptseffort L
- No spam links and no links served only to botsfail · −15 ptseffort L
- No hidden outbound linkswarning · −2.5 ptseffort M
1. Cloaked content
Why it matters. The page was fetched as a normal visitor, as Googlebot and as a visitor arriving from Google. The bot or Google-referrer copies contain text that visitors never see. That is the pattern of a hacked site that hides spam from its owner, and Google treats cloaking as a violation. Some sites vary content by user agent on purpose; check the evidence.
- Open the page as Googlebot (Search Console URL Inspection → View crawled page, or curl with a Googlebot user agent) and compare it with a normal visit.
- If the extra content is not yours: change every password, update WordPress, themes and plugins, scan the file system for modified core files and unknown PHP files (wp-content/uploads, mu-plugins), restore from a clean backup if in doubt, then request a review in Search Console under Security Issues.
2. Redirects only for Google
Why it matters. The page sends visitors who come from Google, or Googlebot itself, to another site, while direct visitors see the normal page. Owners rarely notice because they never arrive from Google. Search results show the spam target and the site loses its rankings.
- Look for the redirect in .htaccess or the nginx config, in wp-config.php and index.php, in theme header and footer files, in the database (wp_options siteurl/home and injected scripts in posts), and in inline scripts that read document.referrer.
- Remove it, update and clean the site, rotate passwords, and request a review in Search Console.
3. Spam links
Why it matters. Links with pharma, gambling, loan or replica vocabulary, or links that only Googlebot and Google visitors receive, are the fingerprint of an injection: someone is using your domain's reputation to rank their pages. Google demotes sites that carry them.
- Search the database and theme files for the linked domains (wp_posts, wp_options, header.php, footer.php, functions.php) and remove the injection; look for an unknown plugin or a modified core file that re-adds it.
- Update everything, rotate passwords and keys, then request a review in Search Console.