We recently got a call from a new client who was crazy with worry about Yandex links showing up in the footer of their site.
Their web developers had told them the site was clean and that it was a browser glitch or a virus on their computer. Maybe it was only showing up for them, but then they said that their personal assistant was seeing the same thing – from a completely different computer. Maybe it was time for a completely different web developer…
When we pulled up the site, we saw the same thing.
Footer links pointing where they absolutely shouldn’t have been pointing. Strange domains. Spammy junk. The kind of thing that makes your stomach sink a little because you know, pretty quickly, that this isn’t just a visual bug.
It was SEO poisoning.
I sent a quick email to the client to confirm what we’d found: there was definitely malware on that site. We were going to drop everything to clean it up before any more damage was done to their online reputation.
That’s one of the awful things about this kind of hack. It isn’t always loud. The homepage can look normal. The menu can work. The contact form can still send. But underneath the surface, the site may be quietly pushing spam links, redirecting visitors, or sending Google signals that can hurt the domain’s credibility.
And when you’ve spent years building up trust with Google, that’s not something you want sitting there for one more afternoon than necessary.
The First Problem: The Site Didn’t “Look” Hacked
This is the part that makes these cases so frustrating.
A lot of people still think a hacked site is going to be obvious. Like you visit the homepage and there’s a giant skull on the screen, or the whole page is replaced with some hacker message in broken English.
That can happen, sure. But most hacked WordPress sites I see aren’t like that.
They’re quieter. Weirder. Sneakier.
The site mostly works, except there are footer links going to Yandex or pharmacy pages. Or Google has indexed a bunch of strange URLs that nobody created. Or visitors get redirected only sometimes, on mobile, or only when they come from search results. Or the bad code hides from logged-in users, which means the site owner can look around and think everything’s fine.
In this case, the client knew something was wrong because they were seeing it with their own eyes. But they were also being told, basically, “Nope, the site’s clean.”
That’s a terrible position to be in as a business owner. You’re not trying to be dramatic. You’re just looking at your own website and seeing links that absolutely shouldn’t be there.
So We Treated It Like a Real Emergency
Once we confirmed the Yandex links were visible on our end too, we treated it as malware until proven otherwise.
That meant not assuming it was “just cache.” Not assuming it was “just the browser.” Not assuming it was harmless because the homepage still loaded.
We started checking the site the way you have to check compromised WordPress sites: files, database content, user accounts, plugins, themes, server logs, and anything else that could explain how those links got there.
And this is where it gets a little unglamorous.
Cleaning up SEO poisoning isn’t usually one dramatic delete button. It’s more like crawling through the attic with a flashlight, finding one mouse nest, and knowing there may be three more behind the insulation.
You remove the obvious spam, yes. But then you have to find the thing that created it. Otherwise the site looks clean for a day or two and then the junk comes back.
What SEO Poisoning Actually Does
SEO poisoning is when attackers use your site’s authority to promote their garbage.
Sometimes that means hidden links. Sometimes it means injected pages. Sometimes it means redirects. Sometimes it means your site starts showing up in Google for searches that have nothing to do with your business.
And because it’s happening on your domain, Google can start treating your site as part of the problem.
That’s the part that should get everyone’s attention.
This isn’t just embarrassing. It can affect search visibility, customer trust, and the reputation of the domain itself. If visitors click your site from Google and land on spam, or if Google finds hacked content sitting there long enough, the cleanup gets more painful.
Cleaning the Site Meant More Than Removing the Links
The Yandex links were the symptom. They weren’t the whole disease.
So the cleanup had to go deeper than “delete the bad footer links and call it good.”
We looked for modified files. We checked the database for injected content. We reviewed suspicious users. We replaced compromised code with clean copies where needed. We updated vulnerable software. We reset credentials. We looked for backdoors.
That last part matters a lot.
If a site has been compromised, there’s often some little hidden doorway left behind so the attacker can come back later. It may be buried in a plugin folder, disguised as a normal file, tucked into the uploads directory, or stored in the database in a way that doesn’t immediately scream “malware.”
Automated malware scanners can help, but they’re not enough by themselves. They’re a starting point. You still need a human being who knows what looks wrong.
Then We Had to Think About Google
After the site was cleaned, the next concern was Google.
If Google has already detected hacked content, you may need to work through Google Search Console, review the security issues, clean the examples Google found, and request a review once the site is safe.
That request needs to be honest and boring, which is usually how Google likes things.
Something along the lines of: here’s what we found, here’s what we removed, here’s what we updated, here’s how we secured the site, and here’s how we confirmed the hacked content is gone.
No drama. No magic words. Just evidence that the site’s been cleaned properly.
The Bigger Lesson
The biggest lesson from this one is pretty simple: if you’re seeing weird links on your site, don’t let anyone wave it away too quickly.
Maybe it is cache. Maybe it is a browser extension. Maybe it is something harmless.
But if footer links are pointing to Yandex, pharmacy pages, casino pages, adult sites, or strange domains you don’t recognize, that needs to be taken seriously.
Because even if the site looks normal to most visitors, Google may be seeing something else. And your customers may be seeing something else. And by the time everyone agrees it’s real, the damage may already be worse than it needed to be.
In this case, the client was right to be worried. The links were real. The malware was real. And the right answer was not to reassure them into silence. The right answer was to confirm what we saw, jump on it, and clean the site before it had more time to hurt their reputation.
If This Is Happening to Your Site
If you’re seeing strange links, spam pages, redirects, or Google warnings, don’t ignore it. And don’t assume it’s fine just because someone ran a quick scan and didn’t see anything obvious.
Hacked sites can be subtle. SEO poisoning can be quiet. And the sooner it’s cleaned up properly, the better chance you have of protecting your search visibility and customer trust.
If your WordPress site has been hacked, blacklisted, or poisoned with spam links, get in touch with us. We’ll help you figure out what happened, clean it up, and get the site back on solid ground.
