The pharma hack: why Google thinks your site sells medication

Your business has nothing to do with pharmaceuticals, but your Google listing mentions them. Or your meta description, which you definitely wrote, now offers cheap medication.

This is the pharma hack — one of the oldest WordPress compromises still in wide circulation, and one of the most persistent, because it is specifically built to survive a casual cleanup.

What makes it different

Most injections are relatively blunt. The pharma hack is not. It typically:

• Serves spam only to search engine crawlers, so the site looks perfect to you
• Stores its payload in the database, not only in files, so replacing files does not remove it
• Rewrites your existing pages' titles and descriptions rather than creating new ones
• Reinstalls itself from a second copy hidden somewhere else

That last point is why people clean it three times before it sticks. There is almost always a copy you have not found.

How to confirm you have it

Search site:yourdomain.com and read the titles and descriptions rather than the URLs. The pharma hack often leaves your real pages in place and simply rewrites how they appear in search — which is exactly why a quick look at the site tells you nothing.

Fetch a page as Google. In Search Console, use URL Inspection on one of your normal pages and choose "Test live URL". Compare the rendered HTML with what you see in a browser. If the crawler version contains drug names, you have it.

Check your database for suspicious option rows. The payload frequently lives in wp_options under an innocuous-looking name, and sometimes in the postmeta table attached to real posts.

Where to look

In order of likelihood:

1. wp_options — injected rows, often with names that mimic real plugin settings
2. Theme functions.php — a long obfuscated line after a block of whitespace
3. Core files, particularly index.php and wp-settings.php
4. A fake plugin folder containing a single PHP file, deactivated so it never appears in the plugins list
5. PHP files in wp-content/uploads, which should never exist
6. Files above the WordPress root, outside where anybody thinks to look

If you have SSH, the fastest first pass is searching for the usual obfuscation functions:

grep -rEl "(eval\(|base64_decode\(|gzinflate\()" wp-content/ --include=*.php

Removing it so it stays removed

The order matters more here than with most infections, because of the reinstall behaviour.

1. Back up the infected site as evidence
2. Replace core, plugins and themes with clean copies — never edit
3. Clean the database, checking wp_options, wp_posts and wp_postmeta
4. Delete every PHP file in uploads
5. Audit scheduled tasks — this is where the reinstaller usually lives
6. Look above the web root for stray PHP files
7. Remove unknown admin users
8. Rotate every credential, including the salts
9. Clear all caches, including your CDN
10. Fetch as Google again to confirm the crawler now sees clean pages

Step 10 is the one people skip, and it is the only one that actually proves the fix. Your browser was never seeing the spam in the first place.

Repairing the search damage

Once the crawler sees clean pages:

• Request a security review in Search Console if Google flagged the site
• Use Removals for the worst affected URLs to speed up re-crawling
• Expect titles and descriptions in the search results to take a couple of weeks to correct themselves
• Watch rankings for a month — a long-running pharma hack can leave a real dent

The uncomfortable part

The pharma hack is old. Every version we clean got in through something patched years ago — an abandoned plugin, a nulled theme, or a site that had not been updated since it was built.

So the honest prevention is the boring one: update weekly and remove what you do not use. Our free plugin will tell you today whether anything on your site is currently vulnerable or abandoned, which is usually where this started.

If it is already in your search results, our cleanup is $249 and includes finding the reinstaller — the part that decides whether it is gone or just hiding.