Why Your WordPress Site Is Suddenly Selling the Wrong Thing

A WordPress site owner recently discovered their accounting firm was apparently running an online pharmacy — at least according to Google. Their URLs, their site, their pages — but listings for prescription medications they’d never heard of. When they clicked through, everything looked normal. The site was fine. The pages were fine. Google just thought otherwise.

If you’ve seen something like this — your site appearing in search results for pharmaceuticals, casino games, knockoff goods, or anything else you’ve never sold — this article is for you. Not to scare you. To explain exactly what happened, why you couldn’t see it coming, and what stops it from happening in the first place.

Why You Couldn’t See It on Your Own Site

The first thing most people do when they see a weird Google result is visit the page themselves. And it looks completely normal. That’s not a coincidence — it’s the whole point of the attack.

SEO spam attacks use a technique called cloaking. The malicious code injected into your site checks who is visiting. If the visitor is a search engine crawler — Googlebot, Bingbot — it serves spam content: keyword-stuffed pages, hidden links, fake product listings, pharmaceutical terms. If the visitor is a human with a regular browser, it serves your real content. You see your normal site. Your visitors see your normal site. Google sees something completely different.

This is why these infections go undetected for so long. Patchstack’s 2026 security research notes that the dominant attack families all use cloaking techniques, and that hosting providers often don’t discover compromises until significant damage has already occurred — degraded rankings, customer complaints, or blacklisting by security services. By the time the infection is visible in Google, the attacker has already achieved their objective.

How Common Is This — And Why WordPress?

This is not a rare or exotic attack. According to Patchstack’s State of WordPress Security 2026 report, SEO spam injection is the single most common category of WordPress malware, accounting for 55.4% of all infections. Sucuri’s malware trends data puts the figure at 38.4% of infections in their own dataset. By any measure, if your WordPress site is going to get hit with something, this is what’s most likely hitting it.

WordPress is the target because it’s everywhere — powering over 40% of the entire web. The plugin ecosystem, while powerful, creates a vast attack surface. Outdated plugins are the primary entry vector. Attackers don’t need to be sophisticated. They run automated scans across millions of sites looking for known vulnerabilities in specific plugin versions. When they find one, they exploit it. Your site doesn’t have to be interesting or high-traffic to be a target — it just has to be running a vulnerable plugin.

The Attack Chain: How They Got In Before You Knew

SEO spam doesn’t start with an injection. It starts with reconnaissance — automated bots scanning your site long before any attack attempt is made. This is the part of the attack chain that most site owners never think about, because it’s invisible and harmless-looking on its own.

The critical insight here is that step 1 is where the entire chain can be broken. A bot that gets blocked during reconnaissance never reaches step 2. It never finds the vulnerable plugin. It never attempts the injection. Everything downstream of that first crawl never happens.

If You’re Already Infected: What Actually Works

The common advice to wipe and restore is correct — with important caveats. Here’s the sequence that actually works:

1. Don’t just clean files. SEO spam injections frequently live in the database — in wp_posts, wp_options, and theme settings — not just in PHP files. Cleaning theme files while leaving database injections intact means you’re not actually clean.
2. Restore from a backup taken before the breach. The hard part is knowing when the breach happened. Check Google Search Console for when the weird keywords first appeared — that’s your approximate infection date. Your backup needs to predate that.
3. Identify and patch the entry point before going back online. Restoring a clean backup onto a site with an unpatched vulnerable plugin means you’ll be reinfected within days. Audit every plugin version against known CVEs before your restored site goes live.
4. Request Google recrawl your important pages via Search Console URL inspection after cleanup. The spam content may stay in Google’s index for days after you’ve cleaned it — recrawling speeds up the removal.
5. Set up monitoring. Google Search Console will alert you to security issues if you have it configured. File integrity monitoring catches unauthorized changes to core files.

How to Stop the Reconnaissance Bot That Found You

The SEO spam attack chain starts with a reconnaissance bot that ignores robots.txt and scrapes your site looking for vulnerable plugin versions. This bot isn’t subtle — it hits every page, reads every file header, catalogs every plugin it can identify. And it has a tell: it ignores robots.txt, because it’s not a legitimate crawler and it doesn’t care about your crawling rules.

Legitimate crawlers — Googlebot, Bingbot — respect robots.txt by design. Bad bots ignore it. In fact, robots.txt is often the first thing a bad bot reads deliberately — not to follow the rules, but because site owners commonly list sensitive paths they want search engines to ignore, making it an accidental treasure map straight to the directories and endpoints they most want to hide.

This behavioral difference is the foundation of how WhoKnew Shield™ works. The moment a bot ignores robots.txt and triggers the Scraper Trap™ honeypot, its IP is blocked from the entire site — instantly and automatically. It never completes its reconnaissance. It never maps your plugin versions. It never finds your vulnerable endpoint. The attack chain breaks at step one.

On top of the active honeypot, WhoKnew Intelligence™ blocks 14,999,051 known hostile IPs the moment Shield activates — before they send a single request. Many of the bots running SEO spam reconnaissance operations are already on that list, blocked before they arrive.

Wordfence is still valuable — it catches targeted human attackers who don’t behave like bots, handles file integrity monitoring, and covers known exploit signatures. But it operates at the attack stage, after reconnaissance is already complete. For the automated bot-driven attacks that represent the vast majority of real-world WordPress breaches, upstream blocking is what stops them before they map your site.

Who knew the strangest Google result you’ll ever see for your own site was actually a message from months ago?