The Invisible Hack: SEO Spam and Pharma Injections Explained

There's a category of hack designed around one goal: making sure you never notice. SEO spam — often called a pharma hack after the counterfeit-drug pages it typically plants — turns your trusted domain into a free billboard for someone else's gray-market products. Your homepage looks untouched. Meanwhile Google is indexing hundreds of pages about discount pills that live on your site.

What the attacker actually wants

Not your data — your reputation. Search engines rank pages partly on the standing of the domain they sit on, and a legitimate business site that's been online for years carries standing that spammers can't build honestly. So they inject their pages into yours: sometimes thousands of generated URLs stuffed with pharmacy, casino, or knockoff-brand keywords, all quietly riding your domain's credibility.

Cloaking: two versions of your site

The reason owners stay blind for months is cloaking. The injected code checks who's asking: when the visitor identifies as Googlebot, it serves the spam; when it's a normal browser — yours — it serves your real site or redirects innocently. You can stare at your own homepage daily and see nothing wrong while the search index fills with junk under your name.

How to see what Google sees

Search for site:yourdomain.com and read the results past page one — pages you never created, often with garbled titles in another language, are the tell. In Google Search Console, check the Pages report for an unexplained surge in indexed URLs and use the URL Inspection tool to view the crawled version of any suspicious address. Search Console will also email you if it flags the hack — one more reason every owner should have it connected before trouble starts.

The slow damage while it sits there

Rankings you spent years earning erode as search engines associate your domain with spam. Visitors who land on a pill page and see your business name draw the obvious conclusion. Left long enough, the site can be flagged as hacked in search results or demoted almost entirely — recovery from that takes far longer than the cleanup itself.

Cleaning it out for good

Spam injections hide in database entries, modified core files, rogue sitemap files, and .htaccess rewrite rules that only fire for crawlers. Deleting the visible pages without finding the backdoor guarantees they return within days. A thorough cleanup means scanning every file against known-good versions, checking the database for injected content, rotating all credentials, updating everything — then requesting reindexing so the spam URLs drop out.

The stores that avoid all of this are the ones that catch the injection in its first days, not its fourth month. Trust Guard's daily scanning looks at your site from the outside — including the version served to crawlers — so cloaked spam gets caught while it's still a small problem.