Google shows spam for my site, but the site looks fine

Updated 2026-10-16

Short answer: that's a classic sign of a hacked site using cloaking: hidden code shows search engines spam (pharmacy, casino, replica goods) and shows normal visitors the real page. You can't see it by browsing, because it only appears when the visitor looks like Google.

How to check it yourself

  1. Search Google for site:yourdomain.com and read the titles and descriptions. Spam text there that isn't on your pages is the giveaway.
  2. In Google Search Console, use URL Inspection, then Test live URL, then View tested page. That shows the page as Googlebot saw it.
  3. Or fetch the page as Googlebot from a terminal, curl -A "Googlebot" https://yourdomain.com, and compare it with a normal fetch.
  4. If the two differ, look for recently changed files, unknown plugins or admin users, and injected code in your theme and .htaccess. Then change every password.

What Preventionlabs shows

Every report reads your homepage twice, once as Googlebot and once as a visitor, and reports spam words that search engines are shown but visitors aren't: "Search engines are shown spam words that visitors aren't", followed by the words it found. Google's spam policies call this cloaking, and say sites that break them may rank lower or not appear in results. The check covers the homepage; a hack that cloaks only deeper pages needs the Search Console steps above.

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free