Moatline

WordPress pages replaced by gambling spam: what we found and how to fix it

In October 2026 we cleaned a small business site where a dozen real service pages had been swapped for online slot and casino pages. WordPress itself looked fine. The attackers had also posted spam under the owner’s name, made themselves an owner in Google Search Console and left a way back in. Here is how it worked and how to check your own site.

By the Moatline team at Next Nova Technologies · Published 23 October 2026 · 8 min read

Worried your site is affected?See what your visitors and Google see. Free, no sign-up, about 20 seconds.
Check my site free

Signs to look for

  • Google shows gambling titles for your pages: words like “slot gacor”, “togel”, “situs toto” or casino brand names next to your domain.
  • A service page shows a completely different site, while the WordPress editor still shows your normal content.
  • Posts you didn’t write, published under a real administrator’s name.
  • An administrator you don’t know, often with an odd email address such as one ending in @local.invalid.
  • Search Console sends you a “new owner” email, or shows a sitemap you never submitted.
  • The whole domain sends visitors to a gambling site, even though your hosting and WordPress look untouched.

How the attack worked

These are the steps we found on one site, in the order the attackers set them up over three days. The last step, the domain takeover, happened on a different site in the same week.

1. Getting in and staying in

The site ran an outdated form plugin with a known flaw, and the logs showed logins to the owner’s administrator account from two other countries. The attackers then created a second administrator called content_operator with the email address …@local.invalid. That address can never receive mail, so the owner was never told about it.

2. A fake plugin that posts spam in the owner’s name

They installed a plugin with a random name made of three words and a code, such as trotrax-text-prime-…. It adds a hidden, signed connection that lets the attackers publish posts from their own server. It published about a hundred gambling posts, each credited to the site owner’s real account, so at a glance they looked like the owner’s own work.

3. Folders that replace real pages

This was the clever part. For twelve of the site’s real pages, the attackers created a folder in the site root with the same name as the page, and put a ready-made gambling page inside called index.html. When someone asks for /services/, the web server finds the folder and serves that file. WordPress never even runs. The page keeps its trusted address and its Google ranking, but now shows slot and casino content.

4. Taking over Google Search Console

To get Google to pick up the swapped pages fast, the attackers uploaded their own google….html verification file, which made them a verified owner of the site in Search Console. They also uploaded a static sitemap.xml listing only the gambling pages, and submitted it. WordPress makes its own sitemap at /wp-sitemap.xml and SEO plugins create theirs on the fly, so a plain sitemap.xml file you didn’t upload is a warning sign.

5. Hidden casino links

Links to casino sites were added to the home page, hidden from visitors with styling but still read by Google. They pass your site’s reputation to the gambling sites.

6. A way back in that leaves almost no trace

A small file called wp-obf.php in the site root downloaded code from a free web page each time it ran and executed it. Nothing harmful is stored on your server, so a simple file search finds nothing, and the attackers can change what it does at any time. Another file, core-compat-70.php, was built to wipe the files of other plugins it sees as a threat, including security plugins.

7. The domain itself

On a second site that week, nothing on the server was touched. Instead, the domain’s nameservers were changed at the registrar to the attackers’ own Cloudflare account. From then on, they controlled where the domain pointed, and every visitor was sent to a gambling site. No WordPress scan can see this: the fix is at the registrar.

Check your site in 15 minutes

  1. Search Google for site:yourdomain.com slot, site:yourdomain.com casino and site:yourdomain.com togel.
  2. Open your main pages in a private browser window, including service and location pages.
  3. Look at your site root in your host’s file manager or by FTP. A normal WordPress root has wp-admin, wp-content, wp-includes and a few files. Any other folder holding an index.html, especially one named like one of your pages, needs a closer look. With SSH: 
    find . -mindepth 2 -maxdepth 2 -name "index.htm*" -not -path "./wp-*"
  4. Look for root files named google….html and sitemap.xml, and PHP files you don’t recognise. Note their dates.
  5. Users: in wp-admin, go to Users, filter by Administrator and check every account and email address. Our guide to unknown admin users covers hidden ones.
  6. Posts: sort by date and look for posts you didn’t write.
  7. Plugins: look for names you don’t recognise, especially random word combinations.
  8. Search Console: check Settings → Users and permissions and Indexing → Sitemaps.
  9. Nameservers: look up your domain with any WHOIS or DNS lookup tool and check that the nameservers are the ones your host or you set up.

The free Moatline Malware Scanner 1.2.3 and newer finds most of these signs for you: folders that replace your pages, gambling pages in the site root, Search Console verification files, the fake posting plugin, administrators with @local.invalid addresses and files that download and run code from the internet. Nameserver changes and Search Console owners can only be checked by hand.

Clean it up, in this order

  1. Back up the files and database as they are, so nothing is lost if you need to look back.
  2. Lock the attackers out. Delete administrators you don’t know (assign their posts to yourself if WordPress asks, then delete the spam). Change every administrator password, log out all sessions, and change the security keys in wp-config.php. Check application passwords on each profile and delete any you didn’t create.
  3. Delete the fake plugin and any other plugin you don’t recognise.
  4. Delete the planted folders. Your real pages come back as soon as each folder is gone. Check that each page shows your normal content again.
  5. Delete the loader and other planted files, such as wp-obf.php, and look in wp-content/mu-plugins and wp-content/uploads for PHP files that don’t belong.
  6. Remove the attacker from Search Console, then delete their google….html file and the fake sitemap.xml. Remove the owner first: if the file is still there, they can verify again.
  7. Delete the spam posts and remove the hidden links from the home page, theme and widgets.
  8. Update WordPress, every plugin and the theme, especially form plugins. Turn on two-factor login for administrators.
  9. Run a full scan again and check the site daily for a week. Our malware removal guide has the full checklist.

If the whole domain redirects

If every page on your domain goes to a gambling site, check the nameservers first. If they have changed:

  1. Log in to your domain registrar (where you pay for the domain) and set the nameservers back to your host’s or your own Cloudflare account.
  2. Change the registrar password, turn on two-factor login and switch on registrar lock or transfer lock.
  3. Check the contact email on the domain is yours, and look for forwarding rules you didn’t set up.
  4. Changes can take a few hours to reach everyone. Then check the site from a phone on mobile data.

Get Google to drop the spam

  1. In Search Console, use URL inspection on each page that was replaced and click Request indexing.
  2. Use Indexing → Removals for spam post addresses that now return 404.
  3. If Google listed Security issues, request a review describing what you removed and how the attackers got in.
  4. Keep your real sitemap submitted and remove any sitemap you didn’t add.

Related: Japanese or pharma spam in Google and “This site may be hacked” in Google.

Don’t want to do this yourself? Our team cleans hacked WordPress sites every week: WordPress malware removal service, from $45, usually done within 24 hours.

Frequently asked questions

Why does my page show gambling content when it looks fine in the WordPress editor?
Because WordPress never gets the request. A folder in your site root with the same name as the page, containing an index.html file, is served by the web server first. The editor shows your real page; visitors and Google get the planted file. Delete the folder and your page comes back straight away.
Will changing my password fix it?
Not on its own. Attackers usually leave several ways back in: a second administrator, a fake plugin, a file that downloads new code. Remove those first, then change passwords and log everyone out, or they can simply sign in again.
Is a google….html file in my site root always a bad sign?
No. It is how Google Search Console checks that you own a site, and your web designer or SEO company may have added one. Look at the date it was created and at Settings → Users and permissions in Search Console. If an owner there isn’t someone you know, remove them and delete their file.
How did they get in?
On the site we cleaned, the most likely way in was an outdated form plugin with a known flaw, followed by logins to a real administrator’s account from abroad. Old plugins and reused passwords are the usual causes. Update everything and turn on two-factor login for every administrator.
How long until Google stops showing the gambling pages?
Once the pages return your real content or a 404, Google updates them as it recrawls, usually within days to a few weeks. Requesting indexing in Search Console for your main pages speeds it up.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides

All guides →