What is SEO Spam and How Does It Impact Your Site?
Sanja Trajcheva
|Marketing | May 10, 2023
Search engine optimization is a long game. It takes time to build up your content, do your keyword research, and win quality backlinks so you can rank organically for those keywords. But then you find your site falling victim to SEO spam, and all your hard work is undone.
Just like that…
So, what is SEO spam? How can you tell if it’s happened to your site, and what can you do about it?
What is SEO Spam?
SEO spam is a black hat SEO technique, often carried out as a form of automated cyber-attack. By accessing your website through various vulnerabilities, an SEO spam attack can be used to fill your site with strange content, malicious links, and even spam malware.
The purpose of SEO spam is usually for the fraudulent party to inflate the search rankings on a website by building backlinks, in bulk, from compromised sites.
Anyone who has worked with SEO knows the importance of backlinks to improve organic rankings. For hackers and spammers, taking a shortcut by creating spammy backlinks means they can see a huge improvement in their organic search engine rankings in a short period of time.
Again, anyone who has worked with SEO will also be aware that this is a very shady black hat SEO technique that will likely incur a number of penalties for the fraudster.
But these spammers are most likely selling their services as search engine marketers, and so all they need is to show quick results, and they can get paid. Black hat tactics aren’t important to them in the short term (or at all).
Interestingly, a report from 2018 found that 51% of website hacks are used for or related to SEO spam.
Of these SEO hacking attacks, the vast majority affected WordPress sites. In fact, WordPress SEO spam is very much ‘a thing’, as evidenced by the number of security plugins available on the platform to prevent and clean the aftermath of hacked websites.
How Can You Spot SEO Spam?
In some cases, the effects of SEO spam can be quite subtle. Often, a spammer will simply insert a few links into an existing article or, at worst, spoof a page (i.e., create a new page on your site copied from somewhere else) to create a contextual backlink to their target site.
As the website owner, you might not even notice these small infiltrations at first.
However, there are also more aggressive forms of SEO spam, such as creating multiple pages and links to sites, ‘cloaking,’ and hiding backlinks within the source code of a site.
Some common signs of SEO spam include:
- Links to sites that you don’t recall inserting
- New categories, pages, and content that you didn’t post
- Redirects from your site
- Unusual ranking metrics in your research tools
- Content on your site in a different language
Often, you will notice the signs of SEO spam if you use keyword research tools such as SEMRush or Ahrefs.
If you use a plugin like Akismet on WordPress (and if you don’t, you should), then you’ll probably notice a lot of spam gets picked up.
Check out this article about how spambots damage your marketing and your website.
Common Forms of SEO Spam
Although SEO spam tends to be performed for the same reason, by posting spam links and content on your site, there are different practices associated with it.
Cloaking
One of the main practices associated with SEO spam is cloaking. This is where the information presented to the search engine is different from that hosted on the site.
So, the page might be about hotel bookings, but the search engine is presented with content about pharmaceutical products.
Cloaking is usually done by creating a new page and creating a redirect so that the search engines scan the hidden page instead of the original. As well as misleading the site visitor, who lands on a page different from the one they might have been expecting, cloaking can also result in Google penalties.
Banner spam
Another sneaky way of stealing some backlinks is by manipulating banners hosted on your site. Ad banners, such as those delivered by Google Adsense, can have code inserted so that the backlink points to the fraudulent site.
This form of banner spam can also be used by affiliate marketing fraudsters to inflate their referral traffic and subsequent payout.
Spammers can even hijack your site’s CTA buttons, download buttons, and other non-advertising-related features for spam SEO purposes.
The Japanese keyword hack
An unusual but common method of SEO spam is to inject Japanese characters and content into a site using brute force. This is usually a method of generating backlinks to scam-based sites and can be a bit of a shock when it happens to you.
The giveaway is usually when you notice that your site is ranking for Japanese search terms.
Fixing the Japanese keyword hack is a fiddly task and usually requires the use of a software product.
Link injection and redirects
Using link injection or spam redirects, a hacker can insert a hidden link or mask a URL within an existing webpage.
A scary aspect of link injection is that there is usually an element of malware on your site. The code used for this malware element is usually embedded in the web page. This means that when a user clicks a link, the malware will insert a spammy link and redirect the user to a scam site.
Google Search Console often flags this up as a threat and messages the administrator. But, with the progression in cyber fraud technologies, you can’t take this for granted.
The Damage: Negative SEO
For marketers who have spent their time building up organic search results, the impact of SEO spam can be incredibly damaging.
One of the most obvious results is the problem of negative SEO. This is when black hat techniques are applied to your site, which damages your search engine rankings. In short, if you were ranking well for some search terms before, you may find yourself falling quickly off the first page.
And, as you probably already know, getting your organic results back onto page one can be a hard struggle.
The Damage: Google Penalties
With all this shady SEO on your website, another obvious problem is penalties from Google. If your respectable e-commerce site is suddenly linking to a porn site, scammy casino page, or newly set up scam retail shop, you might find Google takes a dim view.
And, of course, Google isn’t weighing this up on a case-by-case basis. They simply see that your site is full of bugs and links to crappy sites and… Oh, dear. Penalties.
These types of penalties can take time (and a lot of effort) to recover from.
How Does SEO Spam Work?
Like many forms of cyber attack, SEO spam exploits weaknesses and vulnerabilities on your site. This might be a weak password, an outdated plugin, or a lack of security on your site – for example, no SSP.
By using bots to scan your site, hackers can highlight a weakness and compromise the database or CMS. Popular site builders such as WordPress or Shopify can be particularly vulnerable as they use many plugins, and the users are often not technically minded.
By not updating security patches when they’re available or failing to remove old or outdated plugins, website users leave an open back door for SEO spam and other types of hacking attacks.
Methods to Avoid SEO Spam on Your Site
The best way to avoid SEO spam is to make it hard for bots and spammers to get into your site in the first place. In general, this means:
- Using a strong and complex password for all your administration logins
- Regularly updating software, plugins, and external elements
- Removing any old or outdated plugins
- Using software to prevent bot attacks on your site
Cyber attacks such as brute force logins are one of the easiest ways for attackers to access your site. So, strong passwords are an absolute minimum requirement.
Blocking bots with software is also an increasingly essential part of online security. CHEQ Essentials’ new Bot Mitigation tool blocks the kinds of bots that carry out SEO spam attacks, amongst other bot-related issues.
If you use a WordPress site, you can use Bot Mitigation by CHEQ Essentials with your existing subscription or use it as a standalone service.
How to Check Your Site for SEO Spam
Spotting SEO spam on your site isn’t always the easiest thing. As we’ve mentioned, the content can often be hidden.
There are several methods you can use to scan your website for SEO spam.
The manual method
If your site is relatively small, you may be able to easily go through and check on-page elements such as links and content.
Keep an eye out for:
- URLs that shouldn’t be there
- Content that looks like it may have been corrupted or tampered with
- New elements such as iframes (content boxes often used to host videos or ads)
- Foreign language elements
- Spam comments (usually containing links)
- New footer or header links or content within existing footers/headers
You can also use tools such as Ahrefs and SEMRush to see if you’re ranking for anything unusual. Most keyword research tools like this have the option to check outgoing links, so take a look through and check for any that don’t look right.
Another way to check manually is to search on Google using the following method:
- Go to Google
- In the search box, type in: “site:yourwebsitename.com intext:searchterm”
Be sure to use the exact formatting as above.
Where ‘searchterm’ is used, you can input one of the many common spammy keywords, such as:
- Cialis
- Viagra
- Canadian pharma
- Erectile dysfunction
- Bitcoin
- Crypto
This will display any pages on your site that are ranking in Google for these spam keywords.
As we’ve mentioned, though, much of the spamdexing done by these cyber attacks is invisible to us.
So, this means you might need to use a more technical method.
Using software
There are several software packages that are designed to scan for malware, viruses, and the results of SEO spam attacks in general.
They’ll usually scan your site and do their thing, much like an antivirus. The best-known are:
- Sucuri
- Defender
- Ninja Scanner
Each of these offers a WordPress plugin that can clean your site of damaging SEO spam.
If you’re trying to avoid WordPress SEO spam, make sure to also use software such as Akismet as standard.
The Key is Bot Mitigation
Like many forms of damaging attacks online, it all comes down to bots. Hackers target websites with weak security or obvious vulnerabilities, and the easiest way to do this is to deploy bots to find those weak links.
This means that any website owner needs to take site security seriously, especially if that website handles customer data or even if it’s your livelihood.
There are plenty of tools available to block bots on your website.
With CHEQ Essentials, you can protect against bad traffic on your PPC ads. And now, you can also monitor and block bad bots and malicious visitors from organic sources.
Bot mitigation by CHEQ Essentials provides protection from exactly the kinds of bots that carry out SEO spam attacks before they even happen.
Author
Sanja Trajcheva
As an experienced content writer, Sanja is a firm believer in the power of storytelling to inspire and educate audiences. In her role at CHEQ, Sanja fearlessly tackles the challenges of the fake web – navigating through fake traffic, ad fraud, and click fraud. When not writing, she enjoys exploring new tastes and planning her next adventures.
