What Is SEO Spam?

Definition

SEO spam is content an attacker injects into a hacked website to borrow its search reputation: hidden links, keyword stuffed text, or whole new pages promoting casinos, pharmacies, counterfeit goods, or scams. Google's spam policies classify this as hacked content, placed "without permission, due to vulnerabilities in a site's security."

How It Works

Google's spam policies list the main forms:

Content injection: subtle changes to existing pages, such as hidden links or hidden text, that search engines see but visitors may not.
Page injection: new pages added to the site, often to manipulate search rankings.
Code injection and redirects: scripts that send some visitors to spam pages.

GoDaddy's 2025 website malware report describes the injection points: database entries (posts, widgets, options), theme and plugin files, .htaccess rewrite rules, and doorway pages created by the hundred. Many infections use cloaking, showing spam to Googlebot while the owner sees a normal site, so the first sign is often odd titles in Google results or unknown URLs in Search Console. GoDaddy also reports that nearly all spam infections include one or more backdoor scripts, which is why spam reappears after a quick cleanup.

The business model is affiliate income and traffic: the attacker profits from your domain's trust without paying for it.

Real-World Example

Sucuri's 2023 Hacked Website and Malware Threat Report describes the "Japanese SEO spam" campaign, which creates thousands of Japanese language doorway pages on compromised sites that send searchers to knock-off sites selling replica brand goods. Sucuri found it on over 10% of the websites it remediated that year, and its remote scanners found it on another 157,723 sites. Sucuri notes that the search results of an infected site are usually polluted with Japanese keyword spam. Sucuri notes its figures reflect the sites it inspected, not the entire web.

Why It Matters for a Small Business

GoDaddy's 2025 report found SEO spam on 328,490 websites, 35.2% of all threats its SiteCheck scanner detected, making it the second largest category. GoDaddy notes the harm is "primarily reputational and financial": degraded rankings, lost organic traffic, possible search penalties, and damage to the owner's credibility. These figures reflect sites GoDaddy's scanner examined, not the whole web. For a business that wins customers through search, a spam infection can quietly undo years of work. Sucuri's 2023 report adds that 38.3% of the compromised databases it cleaned contained SEO spam, mostly concealed links for counterfeit drugs and online gambling.

How to Spot It / How DTS Handles It

Signs: a site:yourdomain.com search showing pages you never made; Japanese, casino, or pharmacy titles in results; a Search Console "hacked content" or manual action notice; unknown sitemaps; and spam that returns after deletion.

DTS takes a forensic backup first, checks search results and Safe Browsing, and maps the injected pages, database entries, and the backdoors and cron events that restore them. With the owner's approval we remove them all, rotate salts and passwords, then clean up the index through Search Console and request a review if the site was flagged. See our hacked WordPress cleanup service, or our guide to WordPress spam links.

Related Terms

Casino and gambling link injection: now the most common type of SEO spam.
Japanese keyword hack: the long-running doorway page campaign.
Cloaking: how spam hides from site owners.
Malicious redirect: often installed alongside spam.
Backdoor: the reason spam comes back.
Pharma hack: the older form of injected spam.

Sources

Google Search Central, Spam policies for Google web search (hacked content): https://developers.google.com/search/docs/essentials/spam-policies
GoDaddy, GoDaddy Annual Cybersecurity Report: Website Malware Threat Landscape (2025 data, vendor research): https://www.godaddy.com/resources/news/godaddy-annual-cybersecurity-report
Sucuri, 2023 Hacked Website & Malware Threat Report (vendor research): https://sucuri.net/reports/2023-hacked-website-report/

Last updated October 14, 2026.