Hidden Spam Links and Doorway Pages: SEO Spam on Hacked Sites
Not every hack attacks your visitors. A large share of compromised sites are used to sell links: the attacker adds links to gambling, pharmacy, adult or “bonus” sites and hides them from visitors, so only search engines read them. Your site’s reputation passes to the spam sites, and when search engines notice, your site can lose rankings or receive a manual action.
A bigger version of the same business is the doorway hack: the attacker generates thousands of spam pages on your domain and lists them in a sitemap so they get indexed under your name.
What we check
- Hidden spam links. Outbound links whose text or address uses spam vocabulary (casino, betting,
“deneme bonusu”, pharmacy names and similar) inside an element hidden with inline styles: off-screen
positioning, zero font size,
display:noneor thehiddenattribute. Two or more such links are needed, so one hidden menu item doesn’t count. - Spam pages in the sitemap. Three or more sitemap addresses with spam words, on a site whose own page doesn’t use those words (a real casino site’s pages aren’t spam).
- Sitemaps on other sites.
Sitemap:lines in robots.txt that point at a domain you don’t own. Storage and CDN hosts, where sites legitimately keep sitemaps, are skipped.
| Check | Result when found |
|---|---|
| Hidden spam links | Fail (strong sign) |
| Spam pages in the sitemap | Fail (strong sign) |
| Sitemap on another site | Warning (weak sign) |
Links hidden with a class from a stylesheet can’t be seen without rendering the page, so a clean result covers inline hiding only. Some kits also show the links only to search engine crawlers; our scanner identifies itself honestly and doesn’t pretend to be one.
How to clean it
- Find the block. Spam links usually live in the theme footer, a widget, a “custom HTML” block or a database option. Search the files and the database for the spam domains.
- Delete generated pages. Doorway pages are often files in a new folder or posts created in bulk. Remove them, regenerate the sitemap and fix robots.txt.
- Close the way in. Update everything, remove unused plugins and themes and change passwords; a site that was hacked once is usually re-infected through the same hole.
- Clean the search results. In Google Search Console, check Security issues and Manual actions, remove spam URLs with the Removals tool and request reconsideration if you received a manual action.