Pharma hack removal.

Mechanism

Cloaked SEO spam, sitting in your files and your database.

The pharma hack is a long-running SEO-spam campaign. The attacker drops a PHP loader on the server and inserts spam content in the wp_posts and wp_options tables. The loader checks who is requesting each page and serves drugstore content only to Googlebot.

Two consequences: your domain's authority is hijacked to rank pharmacy keywords, and your own pages start ranking lower because the spam pages get crawled more often than yours.

01 SELECT option_name, LENGTH(option_value) AS sz
02 FROM wp_options
03 WHERE autoload = 'yes'
04 ORDER BY sz DESC LIMIT 20;
05
06 // Unusually large autoloaded rows you don't recognise = inspect.
07 // Pharma payloads often live there, encoded.

What I remove

Every place the pharma hack hides.

• File loader

  Obfuscated PHP loader, removed by reading the file diff against a clean WordPress install.

• wp_posts

  Spam posts and drafts injected into the database — purged. Legitimate content untouched.

• wp_options

  Autoloaded payloads removed. Theme footer injections and feedwordpress-style spam options reviewed and cleaned.

• Sitemap

  Synthetic pharma URLs purged from sitemap.xml. Clean sitemap regenerated and resubmitted to Search Console.

• Reconsideration

  Google Safe Browsing reconsideration submitted. Search Console indexation requested for affected URLs.

• Vector closed

  I identify the plugin or credential that let the attacker in and close that door before signing off.

Pricing