# Is my site hacked? Cloaking, spam links and conditional redirects

> A hacked site often looks fine to its owner and shows spam only to Googlebot or to visitors from Google. Compare the three fetches, find the injection, clean and request a review.

Security · HTML version: https://getreport.app/learn/hacked-site

## Cloaked content

Passing looks like: Visitors and Googlebot see the same page text.

**Why it matters.** The page was fetched as a normal visitor, as Googlebot and as a visitor arriving from Google. The bot or Google-referrer copies contain text that visitors never see. That is the pattern of a hacked site that hides spam from its owner, and Google treats cloaking as a violation. Some sites vary content by user agent on purpose; check the evidence.

**How to fix it.**

1. Open the page as Googlebot (Search Console URL Inspection → View crawled page, or curl with a Googlebot user agent) and compare it with a normal visit.
2. If the extra content is not yours: change every password, update WordPress, themes and plugins, scan the file system for modified core files and unknown PHP files (wp-content/uploads, mu-plugins), restore from a clean backup if in doubt, then request a review in Search Console under Security Issues.

## Redirects only for Google

Passing looks like: No redirect that fires only for Googlebot or Google visitors.

**Why it matters.** The page sends visitors who come from Google, or Googlebot itself, to another site, while direct visitors see the normal page. Owners rarely notice because they never arrive from Google. Search results show the spam target and the site loses its rankings.

**How to fix it.**

1. Look for the redirect in .htaccess or the nginx config, in wp-config.php and index.php, in theme header and footer files, in the database (wp_options siteurl/home and injected scripts in posts), and in inline scripts that read document.referrer.
2. Remove it, update and clean the site, rotate passwords, and request a review in Search Console.

## Spam links

Passing looks like: No spam links and no links served only to bots.

**Why it matters.** Links with pharma, gambling, loan or replica vocabulary, or links that only Googlebot and Google visitors receive, are the fingerprint of an injection: someone is using your domain's reputation to rank their pages. Google demotes sites that carry them.

**How to fix it.**

1. Search the database and theme files for the linked domains (wp_posts, wp_options, header.php, footer.php, functions.php) and remove the injection; look for an unknown plugin or a modified core file that re-adds it.
2. Update everything, rotate passwords and keys, then request a review in Search Console.

## Hidden outbound links

Passing looks like: No hidden outbound links.

**Why it matters.** Links inside containers with display:none, visibility:hidden, zero font size or an off-screen position are invisible to visitors but counted by search engines. Legitimate pages rarely need them; injections use them constantly.

**How to fix it.**

1. Find the hidden container in the page source (search for the linked domain) and remove it. If it comes from a plugin or theme, that is the compromised or spammy component.
2. If the links are yours and intentional (a collapsed menu, a screen-reader-only list), keep them; the finding is a warning, not a penalty.

Check your own page: https://getreport.app/