WordPress Pharma Hack: How to Detect and Remove It Completely (2026)

TL;DR

• The WordPress pharma hack injects pharmaceutical spam keywords (Viagra, Cialis, Xanax) into your site’s pages and Google search results.
• Your site looks normal when you visit it — but Google sees pages full of drug spam instead of your real content.
• The hack hides in your database, .htaccess file, and theme files using conditional code that shows different content to different visitors.
• Detection requires checking your site through Google’s eyes, not your own browser.
• Per Sucuri’s 2023 Hacked Website Report, the pharma hack is the most commonly detected WordPress injection attack.

A restaurant owner spent six months building her WordPress site. One afternoon, she searched her business name on Google and found her homepage description replaced with: “Buy Cialis 20mg — Fast Delivery — No Prescription Required.”

Her site had been running a pharma hack for weeks. To her, everything looked normal. To Google, her site was a drug shop.

This is one of the most deceptive WordPress infections because it is specifically built to hide from you.

What the WordPress Pharma Hack Does

The pharma hack (also called the Google Viagra hack or SEO spam hack) injects pharmaceutical product keywords into your site’s metadata, page titles, and content — but only shows that content to search engines and outside visitors.

When you visit your site while logged in as an admin, you see your real content. When Google crawls your site, it reads pages full of drug spam. Your Google search result descriptions change to show pharmaceutical keywords. Your site gets flagged, your rankings drop, and in severe cases Google removes your pages from search results entirely.

The attackers use your site’s existing domain authority to rank their spam pages in Google. They get the SEO benefit. You get the reputation damage.

How to Tell If Your Site Has the Pharma Hack

Three methods will confirm the infection:

Method 1 — Google site search: Type site:yourdomain.com viagra into Google search. If any results appear, your site is infected.

Method 2 — Google Search Console: Log in at search.google.com/search-console. Go to Security & Manual Actions — Security Issues. Google will display confirmed hacks here if it has detected them.

Method 3 — cURL check: Run this from a terminal or use an online cURL tool:

curl -A "Googlebot/2.1" https://yourdomain.com

This fetches your page pretending to be Google. Compare what you see against what your browser shows you when logged in. Differences confirm the conditional hack.

Where the Pharma Hack Hides

The infection spreads across multiple locations simultaneously. A partial cleanup that misses any one of these will result in reinfection.

Location 1: The Database (Most Common)

The pharma hack frequently injects spam content directly into your WordPress database — inside post titles, meta descriptions, widget content, and option values.

In phpMyAdmin, search the wp_posts table for: SELECT * FROM wp_posts WHERE post_content LIKE '%viagra%' OR post_title LIKE '%cialis%'

Also check wp_options for injected values in blogname, blogdescription, and any SEO plugin settings like _yoast_wpseo_title.

Location 2: .htaccess File

The pharma hack uses .htaccess to serve different content to Googlebot versus human visitors. Look for rewrite rules that check the user agent string and redirect search engine crawlers to spam pages.

Delete your .htaccess file entirely. Then regenerate a clean one by going to Settings - Permalinks in your WordPress dashboard and clicking Save.

Location 3: Theme Files

Conditional PHP code in your active theme’s functions.php or header.php checks whether the visitor is a search engine crawler, then outputs spam content for crawlers and real content for humans.

Look for any code block that references $_SERVER['HTTP_USER_AGENT'], Googlebot, or user agent strings. These do not belong in theme files.

Location 4: Uploaded PHP Files

Check wp-content/uploads/ for any .php files. These are backdoors used to re-inject the pharma content after a cleanup. Delete every PHP file found in this directory.

Step-by-Step Pharma Hack Removal

Step 1: Put your site in maintenance mode or take it offline via your hosting panel to stop new infections while you clean.

Step 2: Run Wordfence or MalCare scanner to identify all flagged files. Note every location — but do not stop at what the scanner finds.

Step 3: Clean the database. Use phpMyAdmin to search and remove all pharmaceutical keywords from post content, titles, and option values.

Step 4: Replace your .htaccess with a clean WordPress-generated version (delete it, then save Permalinks).

Step 5: Inspect and clean functions.php, header.php, and footer.php in your active theme. Remove any conditional user-agent code.

Step 6: Delete all PHP files from wp-content/uploads/.

Step 7: Replace all WordPress core files with a fresh download from wordpress.org — this catches any infected core files.

Step 8: Change all passwords: WordPress admin, database, FTP, hosting panel.

Step 9: Update all plugins and themes. Delete any that are inactive.

Step 10: Request a Google review via Search Console — Security Issues — Request Review. Google typically responds within 1–3 days.

Why the Pharma Hack Keeps Coming Back

If you have cleaned your site and the pharma keywords return in Google within days, a backdoor survived the cleanup. The most common missed location is the uploads folder PHP file and encoded database cron jobs.

The cleanup must cover files, database, and cron jobs simultaneously. Missing any one layer means the attacker’s automated system will re-inject the content on schedule.

If you have cleaned your site twice and it keeps coming back, the infection is more complex than a standard cleanup can address.

I offer professional pharma hack removal on Fiverr, including database cleaning, backdoor detection, and Google blacklist removal request: https://www.fiverr.com/s/kL9zYkA

Frequently Asked Questions About the WordPress Pharma Hack

What is the WordPress pharma hack?

The WordPress pharma hack is an SEO spam attack that injects pharmaceutical keywords (Viagra, Cialis, Xanax) into your site’s content and metadata. The injected content is visible to Google and outside visitors but hidden from logged-in site owners.

How did my WordPress site get the pharma hack?

The pharma hack enters through outdated plugins, themes, or weak admin passwords. Attackers scan millions of WordPress sites automatically, looking for known vulnerabilities in popular plugins. Per Wordfence’s 2023 WordPress Threat Report, outdated plugins were the entry point in the majority of compromises.

How long does it take Google to remove pharma hack warnings?

After a successful cleanup and a Google review request, warnings typically clear within 1–3 days. Affected search rankings can take 2–8 weeks to recover fully depending on how long the hack ran.

Will the pharma hack damage my site’s SEO permanently?

Not permanently, if cleaned promptly. The longer the hack runs, the more pages get flagged and the longer the ranking recovery takes. Sites cleaned within 1–2 weeks of infection typically see full ranking recovery within a month.

Can I detect the pharma hack without Google Search Console?

Yes. Search site:yourdomain.com viagra directly in Google. Any results confirm infection. You can also use a cURL tool to fetch your page as Googlebot and compare it against what you see when logged in.

Is the pharma hack dangerous to my site’s visitors?

The pharma hack primarily targets search engines, not visitors directly. However, some variants redirect visitors to fraudulent pharmacy sites that may try to collect payment or personal information.

Key Takeaways

• The pharma hack is invisible to logged-in admins but fully visible to Google, destroying your search rankings and reputation.
• The infection lives in your database, .htaccess, theme files, and backdoor PHP files in the uploads folder.
• A complete cleanup must cover all four locations plus a Google review request — fixing just one layer causes reinfection.