Have you searched your WordPress site on Google and found a strange pharmaceutical name in the search results? Yes? Then your WordPress site is a victim of WordPress Pharma Hack!

More than 40% of the available sites on the Internet run on WordPress CMS. Its popularity has attracted many hackers and SEO spammers to profit from a real and complete website with good traffic and search engine presence.

Hackers use different malicious methods to attack WP sites, thereby bringing money and trust issues to your business and its growth. The results of such attacks may also cause a sudden decrease in the number of website visitors, or search engines may display warnings before visiting your WordPress website.

Pharmaceutical hacker example

To understand the full content of this hack and how to get rid of it, this article will help you solve all your doubts. So let’s get started!

What is WordPress Pharma Hack?

WordPress Pharma Hack, sometimes called Google Viagra Hack, is a black hat SEO spam Technology, hackers use real websites to sell illegal and banned drugs to the public.

Whenever a WordPress website is attacked by pharmaceutical hackers, it will display pharmaceutical advertisements and content selling drugs, such as Viagra, Nexium, and Cial. The text and images generated as a result of such hacking attempts are not always easy to be seen by website owners or other users. Their disguise is very clever, so visiting the website and scrolling quickly will not reveal any suspicious content. However, checking your website on Google (or other) search engines will reveal different (pharmaceutical) text or titles for legitimate websites.

How does the pharmaceutical hacker work?

Pharmaceutical hackers mainly target vulnerable WordPress sites (sites that lack recent updates, misconfigure or ignore WordPress security, coding flaws, etc.). Then, they use black hat SEO techniques to promote their content on illegal drugs. Therefore, they can use the keyword rankings of other websites to drive traffic to their website.

The code of such hackers is usually hidden in the CSS files of the site, or it may be hidden in the front end. Such attempts ensure that you cannot view such additions on the HTML. However, search engines use crawlers to scan for malicious code. If malicious code is found, it will lower your search engine rankings and blacklist your website.

The difficulty lies in identifying the malicious code that makes the pharmaceutical hacker active on your WordPress site. To know that you have been hacked, it is sufficient to find your website on search engines such as Google. Finding out the offending code is a bit difficult, because if you are not a professional, checking everything manually may not work.

Why would hackers infect WordPress sites?

If you want to know why hackers target WordPress sites, there are very few reasons, and any of them may be real:

  • Sell ​​or promote drugs or illegal drugs
  • Redirect legitimate sites to malicious links
  • Use your website to host a phishing page

Your site has a good domain authority (DA) and a corresponding low spam score. The purpose is to use it to deceive Google’s PageRank system to promote malicious sites where hackers sell illegal drugs. The better the DA, the better the hacker’s website can become a mark in Google’s eyes.

How does Pharma Hack affect your WordPress website?

The results of a WordPress website hacked by Pharma can cause nightmares for website owners. If your WordPress site is infected with this hack, you may experience some of the following effects:

  • Your website is blacklisted by Google and a warning message is displayed in the search results of all visitors.
  • The PageRank of the website will be affected. If you do not clean up your website for a long time, your website’s spam score will increase, and the entire website will be considered spam by Google.
  • In some cases, Google can also prevent your website from appearing in search results-but don’t worry about this happening in extreme cases.

All these impacts need to work harder to get back to the original point. Therefore, you can take the following measures to solve the pharmaceutical hacking problem.

How to fix WordPress Pharma Hack?

For hackers, the best part of this hacker is that it is not easy to spot, so it can stay on your website for a long time. You may not see any symptoms of a WordPress Pharma hacker, but your website may be under the hacker’s control.

You need to scan the code to find the vulnerabilities on the WordPress site, and then restore your site. Please follow the steps below to do it yourself:

Step 1: Create a backup of your website

Before fixing any bugs or vulnerabilities, it is always a good habit to create a full backup of your WordPress website. If there is a problem cleaning up the site, you can easily undo the changes. This backup must contain all core files, plug-in and theme files, and your website’s database.

Step 2: Scan the website for malware

After backing up the data, the next step is to scan your WordPress site.There are many tools available to scan your website, such as Total number of viruses Used to mark infections or Astra’s malware scanner Used for virus scanning, etc.

All tools are effective enough to scan for vulnerabilities on your website. This process will mark all suspicious files and codes in a short period of time and help you remove malware quickly and easily.

Step 3: Delete the infected file

After connecting to the host server via FTP or file manager, navigate to the /wp-contents/ directory and find the hacked file or plug-in. These files have words like .class, .cache, .old, and they look similar to plugin files.

The dot (.) in front of the file name makes them hidden and invisible until you select ‘Show hidden files‘Option. Delete all such hidden files.

Step 4: Clear the temporary directory

Hackers use temporary files and folders to avoid damage during the installation of malware on your WordPress site. The /wp-contents/temp/ directory can generate temporary files for the WordPress Pharma hack; if you see suspicious entries, it is recommended to clear this folder.

Step 5: Check the contents of the .htaccess file

The .htaccess file is the configuration file of the server and is used to define how to process server requests. Attackers can use these files to invade your website. Search for the code given below or regenerate a new .htaccess file from the WordPress dashboard.

Check the .htaccess file

Image courtesy of Astra Security

Step 6: Remove malicious code from your database

Similarly, every time you use the website’s database, you must make a backup. Using a database is a sensitive step, and if something goes wrong, a backup will help you roll back the changes.

To manually clean up the database, follow these steps:

  1. Go to your phpMyAdmin panel
  2. Select database
  3. Click on the wp_options table
  4. Search for malicious entries that may exist in your database. Some common entries are:
    • wp_check_hash
    • class_generic_ssupport
    • widget_generic_support
    • ftp_credentials
    • rss_%

Please be careful not to delete any other important information from this table, as this may cause your website to crash.


WordPress Pharma Hack You can take away the name, reputation, ranking, and income of your WordPress site. It is not easily detected, which makes the situation worse. However, if you protect your website by implementing the required security measures, such as using a website firewall to protect your website or using a malware scanner to scan your website regularly, you can prevent such attacks. If your website is infected with Pharma hackers and you are not satisfied with the technical procedures to clean it, it is always a good choice to seek professional help.