SEO Spam, Redirect Hacks, and Miners: WordPress Malware Taxonomy

When a WordPress site gets compromised, the symptoms rarely announce themselves as “you have malware.” Instead you notice something odd: search results full of pages you never wrote, visitors complaining about strange redirects, or your host flagging unusual CPU use. Each of these points to a different category of infection, and each category exists because it makes money for someone else. Knowing the taxonomy turns a vague sense of “something’s wrong” into a fast, targeted cleanup.

Why WordPress Is a Common Target

WordPress runs a huge share of the web, which means attackers write tooling once and scan for it everywhere. The actual entry point is almost never WordPress core itself; it’s outdated plugins and themes, pirated (“nulled”) premium plugins with backdoors baked in, weak or reused admin passwords, and leaked FTP or SFTP credentials. Once in, the attacker doesn’t usually deface the site. Defaced sites get noticed and cleaned fast. Quiet, monetizable infections survive longer.

SEO Spam Injection

This is the most common infection type, and the business model is simple: your site’s search authority is valuable, so an attacker borrows it. They inject hidden pages or hidden links promoting pharmaceuticals, replica goods, gambling, or essay-writing services, hoping Google’s crawler indexes them and passes along some of your domain’s trust.

Telltale signs:

• Google Search Console shows a “Security Issues” warning or flags specific URLs as hacked.
• Searching site:yourdomain.com turns up dozens or hundreds of pages you never created.
• Viewing page source reveals text or links wrapped in display:none or pushed off-screen with CSS.
• The database (usually wp_posts or wp_options) contains injected content that doesn’t match anything in the admin post list, because the spam page is generated dynamically rather than stored as a normal post.

Redirect Hacks

Redirect infections hijack your traffic instead of your rankings. A visitor clicks a legitimate search result for your site and lands on a scam page instead: fake tech support, survey scams, sketchy app downloads, or ad fraud landing pages. The attacker gets paid per click, per install, or per completed “offer.”

What makes these infections sneaky is that they’re conditional. The malicious code checks the visitor’s referrer and user agent, so someone arriving from Google on a mobile browser gets redirected, while the site owner logged in as admin sees a perfectly normal site. This is deliberate evasion, and it’s why redirect hacks often go unnoticed until a user reports it or Search Console raises an alert.

Telltale signs:

• Reports from real visitors about being sent to unfamiliar domains, especially on mobile.
• A spike in bounce rate or a sudden drop in average session time in analytics.
• Unfamiliar JavaScript injected into theme header or footer files, or into a file placed in the mu-plugins directory (which loads automatically and is easy to overlook).
• An ad network or Search Console notice about deceptive content.

Cryptocurrency Miners

Miner infections monetize computing resources directly rather than traffic or rankings. Server-side variants run a mining process on your hosting account, quietly consuming CPU cycles around the clock. Browser-based variants inject mining JavaScript that runs in each visitor’s browser while they have your page open, borrowing their device’s CPU instead of yours.

Either way, the symptom is performance. Server-side miners show up as CPU spikes and resource-limit warnings from your host. Browser-based miners drag down every visitor’s experience, which is exactly the kind of thing that pushes Core Web Vitals like LCP and INP in the wrong direction, since the CPU is busy mining instead of rendering.

Telltale signs:

• Unexplained CPU spikes in your hosting dashboard, sometimes with the account approaching or hitting a resource limit.
• A host abuse notice or suspension warning.
• Unfamiliar cron jobs or PHP processes running under your account.
• Site speed degrading noticeably with no code or traffic changes to explain it.

Backdoors and Mailer Scripts

These two often travel together and tie the other categories back to a single root cause. A backdoor is persistent, hidden access, usually a small file with obfuscated code (heavy use of base64_decode or eval) sitting in an uploads folder or disguised as a plugin file. It’s rarely the payload itself; it’s the door the attacker reuses to install spam, redirects, or miners later, even after you think you’ve cleaned up.

Mailer scripts monetize your server’s ability to send email. Once installed, they use your site’s reputation and IP to blast spam or phishing campaigns. This is a business model built on borrowed trust in the same way SEO spam is, just applied to email delivery instead of search rankings.

Telltale signs:

• Your host suspends or throttles outbound mail, or you get a bounce-back flood.
• Unfamiliar admin or editor user accounts appear in Users.
• Suspicious .php files sitting inside wp-content/uploads, a directory that should only ever contain media.

Reducing Exposure

None of these infections require exotic defenses. The basics matter more than any single tool:

1. Keep WordPress core, plugins, and themes updated, and run a current PHP version (8.1 through 8.3, with OPcache enabled, is the solid mainstream default).
2. Avoid pirated premium plugins entirely; a backdoor is often baked into the “free” copy.
3. Use strong, unique credentials for wp-admin and for FTP/SFTP, since credential leaks are one of the most common entry points.
4. Audit file integrity with wp-cli: wp core verify-checksums and wp plugin verify-checksums compare your installed files against known-good versions and flag anything tampered with.
5. Put a web application firewall in front of the site. Cloudflare’s WAF filters known malicious payloads before they reach your origin, and keeping your origin IP unpublished behind it adds real DDoS resilience on top.

Some managed hosts, including ServerBorn, run malware scanning and file integrity checks at the platform level, which catches a fair share of these infections before a site owner ever sees a symptom. That’s a helpful layer, but it’s not a substitute for keeping software current and credentials clean.

Takeaway

WordPress malware isn’t one problem, it’s several distinct business models wearing the same disguise. SEO spam borrows your rankings, redirect hacks hijack your traffic, miners borrow your CPU, and backdoors and mailers borrow your server’s trust and access. Matching the symptom to the category tells you where to look first, and that’s most of the battle in getting a compromised site clean and staying that way.