WordPress Pharma Hack: Step-by-Step Cleanup
You searched your site name in Google and something like “Buy Cheap Viagra Online | YourSiteName.com” showed up in the results. Or your host suspended your account. Or a client forwarded you a Google Search Console alert about “hacked: content” errors. Whatever brought you here — this is the pharma hack, and I’ve cleaned it off more WordPress sites than I can count since 2011.
It’s nasty because it’s invisible to you. You visit your own site, everything looks fine. But Googlebot sees a pharmacy. That’s the whole trick — the injected content is served only to search engine crawlers, sometimes only when the referrer is Google. Regular visitors see nothing wrong.
Here’s the thing: cleaning it halfway doesn’t work. I’ve had clients come to me after another developer “fixed it” and the site got reinfected within two weeks because the backdoor was never found. So this guide goes all the way through.
Step 1 — Confirm the Infection Before You Touch Anything
First, verify what you’re actually dealing with. Don’t just take the Google alert at face value — confirm it yourself so you know what you’re cleaning.
Go to Google and search: site:yourdomain.com viagra. If pages come back with pharma titles, you’ve confirmed it. Also check Google Search Console under Security Issues — it’ll often show you sample URLs.
Then install Wordfence (free version is fine for scanning). Run a full scan. At 2 AM on a client’s site once, Wordfence flagged 47 modified files — most of them inside wp-includes/ and a few buried in wp-content/uploads/ with names like class-wp-user.php that look completely legitimate unless you’re paying attention. That’s exactly what you’re looking for.
Also run your URL through Google’s Safe Browsing checker at transparencyreport.google.com and through Sucuri SiteCheck. These are free and take 30 seconds. Know what you’re dealing with before you start deleting things.
Step 2 — The Actual Cleanup (Do These in Order)
This is where most guides go vague. I’ll be specific.
Change all credentials first
Reset your WordPress admin password, your hosting cPanel password, your FTP password, and your database password. Do it now, before cleanup. If the attacker still has valid credentials, anything you clean gets re-injected within hours.
Find and remove the injected spam
WordPress pharma hack infections typically hide in four places: your database (posts, options table), your theme files, plugin files, and sometimes in auto-loaded options. The wp_options table is a favourite — attackers stuff encoded PHP into options that get loaded on every page request.
Run this SQL query in phpMyAdmin to look for obvious pharma spam injected into your database:
SELECT option_name, option_value
FROM wp_options
WHERE option_value LIKE '%viagra%'
OR option_value LIKE '%cialis%'
OR option_value LIKE '%pharmacy%'
OR option_value LIKE '%eval(base64%';Anything that comes back and doesn’t belong — delete it. I’ve seen entire fake sitemaps and link directories stuffed into a single option row.
For file-level pharma spam WordPress infections, connect via FTP or SSH and check your theme’s functions.php first — look for base64_decode calls, eval() blocks, or anything that references external URLs near the top of the file. Then check every active plugin’s main file. If you’re on SSH, this command helps:
grep -r "base64_decode" /home/youruser/public_html/wp-content/ --include="*.php" -lAny file that shows up there needs manual inspection. Not automatic deletion — inspection. Some legitimate plugins use base64 encoding. You’re looking for ones that pair it with eval() and external URL calls.
Remove hidden admin users
Check your WordPress Users screen for any admin accounts you didn’t create. I find these on maybe 60% of pharma-hacked sites. Also check your database directly — wp_users table — because sometimes the injected users are hidden from the WP admin UI.
Clean up the .htaccess
This is how the hidden spam links get served only to Googlebot. Open your root .htaccess and look for any RewriteCond blocks referencing user agents like Googlebot or referrer strings from google.com, then redirecting to external pharmacy URLs. Delete those blocks entirely. Your clean .htaccess should only have the standard WordPress rewrite rules — nothing more.
For a broader look at what the initial response to a hack should look like, I wrote about it in Your WordPress Site Got Hacked. Do This First. — worth reading alongside this if you’re in the middle of an incident right now.
Step 3 — Harden the Site So It Doesn’t Come Back
Cleanup without hardening is just buying yourself a few weeks. This part is non-negotiable in my opinion.
Update everything. WordPress core, every plugin, every theme — including ones you’re not using. Inactive themes are a known entry point and I’ve seen attackers hide backdoors in them specifically because nobody checks. If you’re not using a theme or plugin, delete it. Not deactivate. Delete.
Set your file permissions correctly. wp-config.php should be 600 or 640. The wp-content/uploads/ directory should not be executable — add this to your .htaccess inside that folder:
Options -ExecCGI
AddHandler cgi-script .php .php3 .php4 .phtml .pl .py .jsp .asp .htm .shtml .sh .cgiInstall a security plugin — Wordfence or Solid Security (formerly iThemes Security). Enable two-factor authentication for all admin accounts. Block XML-RPC if you’re not using Jetpack or any service that needs it.
For a deeper walkthrough of manual file-level cleanup, I’ve also documented the process in How to Remove Malware From WordPress Manually — it covers some scenarios this article doesn’t, like cleaning infected wp-includes core files.
Step 4 — Get Google to Recrawl and Remove the Pharma Results
Once you’re confident the site is clean, go to Google Search Console. Under Security Issues, click “Request Review.” Be honest in the description — explain what was found and what you did. Google typically processes these within a few days to two weeks, though I’ve seen it take up to three weeks for sites with a lot of indexed pharma pages.
Submit an updated sitemap while you’re in there. Use the URL Inspection tool to request indexing of your homepage and any key pages that were flagged. This speeds up the recrawl.
The wordpress spam injection fix is only complete once Google has re-evaluated the site and removed the hacked content labels. Don’t assume it’s done just because your files are clean. Watch Search Console daily for a week after submitting the review.
One more thing: get a proper backup system in place. Not just your host’s automated snapshots — a real off-site backup through something like BlogVault or UpdraftPlus connected to external storage. I’ve had clients whose host’s backup was corrupted because the backup itself contained the malware. Off-site. Tested. Weekly minimum.
How pharma spam wordpress infections survive a “clean” reinstall
I can’t count how many times a client’s told me they already reinstalled WordPress and the pharma spam wordpress links came right back within a week. Here’s why: the infection usually isn’t just in your core files. Hackers drop a backdoor into your uploads folder — /wp-content/uploads/2021/cache/ is a favorite — because most people never wipe that directory during a reinstall. They also love injecting rogue rows directly into wp_options, sometimes under innocent-looking option names like recently_edited. So you can swap out every PHP file and still be reinfected the moment that leftover backdoor phones home and rewrites your theme’s functions.php.
If you’d rather hand this off to someone who’s done it dozens of times, I take on pharma hack cleanups at swsDreams — typically a 24–48 hour turnaround depending on how deep the infection goes.
