How to identify and remove an SEO spam hack on a Hostinger website

An SEO spam hack injects spam pages and keywords into your website so Google shows them in search results, often in Japanese, Turkish, or gambling-related text. To fix an SEO spam hack, confirm the spam in Google Search, run the Malware Scanner in the Hostinger dashboard, and clean your files and database. Then verify the cleanup and secure your website to prevent reinfection. The Hostinger Malware Scanner cleans website files only, so spam stored in your WordPress database needs separate cleanup.

Before you start

• Make sure your website is hosted on a Hostinger web or cloud hosting plan, which includes the Malware Scanner.
• Prepare access to your Hostinger dashboard, your WordPress Admin area, and your Google Search Console property.
• Use the WordPress steps if your website runs on WordPress. Other content management systems (CMS) are covered in a separate section.

Identify an SEO spam hack in Google search results

An SEO spam hack shows in Google when your website’s titles, descriptions, or URLs contain keywords in a language or topic your website does not use. The Japanese keyword hack and Turkish gambling spam are variations of the same attack. There are five common signs of an SEO spam hack:

• Google results for your domain show Japanese, Turkish, or other foreign-language titles and descriptions you did not write.
• Google results for your domain show unrelated topics, such as gambling or counterfeit product stores.
• Google lists pages in randomly named directories you did not create, such as domain.tld/abcxyz/123.html.
• The number of pages Google indexes for your domain is far higher than the number of pages your website has.
• Your website looks normal when you open it directly, but visitors who click a spam result may land on spam pages or be redirected to another website.

Once Google indexes the spam pages, your website ranks for thousands of unrelated keywords, which damages your search visibility and reputation.

NOTE

• A website that is legitimately written in Japanese, or a Google listing with no pages you do not recognize, does not indicate an SEO spam hack.

Confirm and investigate an SEO spam hack on your Hostinger website

Confirm an SEO spam hack by searching your domain in Google, then investigate the cause with the Malware Scanner in the Hostinger dashboard and a manual check of your files, users, and database. Complete both parts before you start the cleanup.

Confirm the spam in Google Search

1. Open Google and search site:domain.tld, replacing domain.tld with your root domain.
2. Review the titles, descriptions, and URLs in the results. Spam pages contain foreign-language or unrelated keywords, or sit in directories you did not create.
3. Search your business name or a main keyword of your website, and check the title and description Google displays.
4. Open the Security issues report in Google Search Console to check whether Google flagged your website.

NOTE

• Clearing your browser cache does not remove spam from Google results, because the spam text comes from Google’s search index and not from your device.

Investigate the infection in the Hostinger dashboard and your website files

There are six places to check for signs of an SEO spam hack: the Malware Scanner, your website files, the .htaccess file, WordPress users, the database, and other websites on the same hosting plan.

NOTES

• The Malware Scanner scans and cleans website files only, and it does not scan your database.
• Do not delete files the Malware Scanner quarantined, because the scanner already isolated them.
• Malware on one website can spread to the other websites on the same hosting plan, so check all of them.

For more details about scanner results, read How to use the Malware Scanner at Hostinger.

Remove an SEO spam hack from your website

Remove an SEO spam hack with one of three options: clean the infection manually, restore a backup from before the infection, or request the Hostinger site cleanup service for WordPress websites. Whichever option you choose, secure your access afterward to stop reinfection.

Option 1 – Clean the infection manually

1. Create a backup of your website files and database before you change anything, following How to create backups at Hostinger.
2. Change the passwords for your Hostinger account, FTP or SFTP accounts, database, WordPress, and Google account, and enable two-factor authentication where available.
3. Remove unrecognized administrator users in the WordPress Admin area.
4. Open Google Search Console, go to Settings → Users and permissions, and remove any owner or user you do not recognize. Also delete any unknown verification file from your website.
5. Delete unfamiliar files and spam directories in File Manager, and remove unrecognized rules from the .htaccess file.
6. Open phpMyAdmin, export the database, then remove unexpected content from the posts and options tables.
7. Update WordPress, your theme, and all plugins, and delete any plugin or theme you do not use or recognize. Delete nulled or cracked plugins and themes immediately, because they can reinfect your website.
8. Run the Malware Scanner again, then run a full scan with a trusted security plugin such as Wordfence or MalCare.

Option 2 – Restore a backup from before the infection

Restoring a Hostinger backup from a date before the infection replaces your website files and database with the version from that date. Choose a backup created before the spam first appeared in Google, then follow How to restore backups at Hostinger and restore the files and database to the same date.

Restoring one website does not clean other websites on the same hosting plan, so check them separately. A restoration also does not close the vulnerability that allowed the infection. Update your software, change your passwords, and run a new scan when the restoration finishes.

NOTE

• Do not edit your website while a restoration is in progress.

Option 3 – Request the Hostinger site cleanup service

Depending on your hosting plan, WordPress websites with domains pointed to Hostinger may be eligible for the site cleanup service, which is offered separately from the Malware Scanner. If it’s available for your website, you’ll see a Request site cleanup button in the Malware Scanner section of the Hostinger dashboard.

A WordPress developer or professional malware-removal service can also clean your files and database if you prefer not to edit them yourself.

Remove an SEO spam hack from a non-WordPress website

Non-WordPress websites, including Joomla and Drupal websites, follow the same process: back up your website, secure your access, clean the files and database, and update the CMS. Check the official security documentation of your CMS for cleanup steps that match your CMS version. The Hostinger site cleanup service is not available for non-WordPress websites.

Recover and verify your website after removing an SEO spam hack

Verify the recovery by scanning your website again, checking Google for remaining spam, and requesting a Google review once your entire website is clean. Google updates search results only after it recrawls your website, which takes from a few days to a few weeks.

1. Run the Malware Scanner again after the cleanup or restoration finishes, and confirm no files remain pending.
2. Open the spam URLs you found in Google in your browser, and confirm they no longer load.
3. Open the Security issues report in Google Search Console, and check whether Google still lists problems for your website.
4. Request a review in Google Search Console if the report lists security issues, but only after your entire website is clean and secure.
5. Request a recrawl of your website in Google Search Console so Google updates its index.
6. Repeat the site:domain.tld search every few days until no spam results remain.

Prevent an SEO spam hack from happening again

Prevent an SEO spam hack by keeping your CMS, plugins, and themes updated, securing access to your website, and monitoring Google results regularly. There are seven practices that reduce the risk of reinfection:

• Update your CMS, plugins, and themes regularly, and delete the ones you no longer use.
• Install plugins and themes only from official or trusted sources, and never install nulled or cracked versions.
• Use strong, unique passwords, enable two-factor authentication, and remove unrecognized administrator accounts.
• Disable directory browsing by adding Options -Indexes to your .htaccess file, so visitors cannot list your website’s directories.
• Set file permissions to 644 for files and 755 for directories, and restrict sensitive files such as wp-config.php to 400 or 440.
• Create backups of your website regularly, so you can restore a clean version after an infection.
• Monitor Google Search Console, run a site:domain.tld search regularly, and use SEO tools such as Semrush or Ahrefs to catch spam keywords and unfamiliar pages early.

For account-level protection, follow What to do if your account or site has been hacked at Hostinger.

After you clean the infected files and database, secure your access, and request a Google review, your website returns to normal search results as Google recrawls it. Regular monitoring of your Google results catches any reinfection early.

Frequently asked questions about SEO spam hacks on Hostinger websites

Why does my website look normal when Google shows spam?

An SEO spam hack often shows spam only in Google search results, so your website can look normal when you open it directly. Check your domain with a site:domain.tld search in Google and run the Malware Scanner to find the infection.

How long does Google take to remove SEO spam results?

Google removes SEO spam results after it recrawls your cleaned website, which takes from a few days to a few weeks. No exact timeframe exists, because Google controls the search index.

Does the Hostinger Malware Scanner remove SEO spam from the database?

No, the Hostinger Malware Scanner scans and cleans website files only. Spam stored in your database requires a manual check of the posts and options tables, a backup restoration, or the Hostinger site cleanup service for WordPress websites.

Does restoring a backup remove an SEO spam hack?

Restoring a backup from before the infection removes spam added after the backup date. A restored website can still be reinfected, so update WordPress, your plugins, and your theme, change your passwords, and run the Malware Scanner after the restoration.

Additional resources

• Ask Google to recrawl your URLs – Google Search Central guide for requesting a recrawl.
• Security issues report – Google Search Console Help article about hacked content and review requests.
• WordPress malware removal guide – Hostinger Tutorial for scanning and cleaning WordPress with Wordfence.