Quick answer
The pharma hack injects cloaked pharmacy spam (Viagra, Cialis, etc.) that's shown to search engines but hidden from you. Remove it by inspecting your pages as Googlebot, finding the injected content and cloaking code in files and the database, deleting the backdoor, closing the entry point, and requesting a Google review.
Key takeaways
- The spam is cloaked — you see a normal page, but Google sees pharmacy spam.
- Check your site the way Googlebot sees it to reveal the hidden content.
- It lives in files and the database, so both need cleaning.
The pharma hack is one of the most frustrating infections because your site looks completely normal. Meanwhile, Google sees pharmacy spam under your domain. That gap — cloaking — is the whole trick.
How cloaking works
The malware checks who's visiting. Regular users get your real content; search engine crawlers get injected spam for pharmaceuticals. That's why you can't spot it by browsing your own site.
Reveal the hidden content
Use the URL Inspection tool in Search Console to see your page as Google renders it, or fetch it with a Googlebot user-agent. If pharmacy keywords appear, you've confirmed the hack.
Find and remove the source
Pharma spam typically lives in a mix of injected files, altered core or theme files, and database entries (often in wp_options or post content). Remove all of it, plus the backdoor and any malicious cron jobs regenerating it.
Clean up and request a review
Once the site is genuinely clean, regenerate your sitemap, request reindexing, and — if Google flagged the site — submit a security review so the warning is lifted.
Prevent a repeat
Close the vulnerability that allowed the injection, rotate credentials, and add monitoring. Cloaked hacks are easy to miss, so ongoing scanning is worth it here.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Follow-up questions
People also ask
It's cloaked. The malware detects search engine crawlers and serves them spam while showing normal content to regular visitors, so it stays hidden from the owner.
Keep reading
How to Detect and Remove a Credit-Card Skimmer in WooCommerce
A card skimmer quietly steals customer payment details at checkout. Here's how to detect and remove one from WooCommerce.
Website Suspended by Your Host? How to Get It Back Online
If your host suspended your account for malware, here's how to clean the site to their standard and get it reactivated.
How to Request a Google Security Review After a Hack
Cleaned the hack but Google still warns visitors? Here's how to request a security review and get the warning lifted — the right way.