The latest articles on DEV Community by Shiv Prakash | Team Elivate (@teamelivate). https://dev.to/teamelivate https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4244007%2F660a6447-1029-43e6-a921-11fd0d50a87b.png https://dev.to/teamelivate en Shiv Prakash | Team Elivate Sat, 14 Nov 2026 06:45:48 +0000 https://dev.to/teamelivate/how-i-check-a-wordpress-site-for-hidden-casino-spam-5-minute-checklist-l3f https://dev.to/teamelivate/how-i-check-a-wordpress-site-for-hidden-casino-spam-5-minute-checklist-l3f <p>Last week I was checking a small business website in Delhi before pitching SEO work. The homepage looked normal. But the site had more than 2,000 hidden posts, and almost all of them were about casinos and betting.</p> <p>The owner had no idea.</p> <p>This kind of hack is common on WordPress sites that nobody updates. So now I run a quick check on every site before I talk to the owner. You only need a browser.</p> <h2> 1. Count the posts through the REST API </h2> <p>Open this in your browser:</p> <p><code>https://example.com/wp-json/wp/v2/posts?per_page=10</code></p> <p>You will see the latest posts as JSON. Open DevTools &gt; Network, click the request and look for the <code>X-WP-Total</code> header. That is the total number of posts.</p> <p>A local shop or clinic site usually has 0 to 50 posts. If you see 2,000, something is wrong.</p> <h2> 2. Search the site for spam words </h2> <p>Try the built-in WordPress search:</p> <p><code>https://example.com/?s=casino</code></p> <p>Also try <code>betting</code>, <code>slot</code> and <code>loan</code>. A clean small business site should return nothing.</p> <h2> 3. Check what Google can see </h2> <p>Search Google for:</p> <p><code>site:example.com casino</code></p> <p>If spam pages show up here, Google has already found them.</p> <h2> 4. Read robots.txt and the sitemap </h2> <p>Open <code>/robots.txt</code>, then <code>/wp-sitemap.xml</code> or <code>/sitemap_index.xml</code>.</p> <p>Look for sitemaps you did not create, or lines that point to a different domain.</p> <h2> 5. Check the canonical tag </h2> <p>View the page source and search for <code>rel="canonical"</code>. It should point to your own domain.</p> <p>On another site I checked, the canonical tag, robots.txt and sitemap all pointed to a different company's domain. Google was being told the pages belonged to someone else.</p> <h2> What to do if you find spam </h2> <ul> <li>Take a full backup first.</li> <li>Don't just delete the posts. Find how they got in: old plugins, old themes, weak passwords or admin users you don't know.</li> <li>Update WordPress, the theme and all plugins. Remove anything you don't use.</li> <li>Change every password and check the Users list for unknown admins.</li> <li>Remove the spam pages, then submit a clean sitemap in Google Search Console.</li> </ul> <h2> Why this matters </h2> <p>A hacked site quietly loses trust and rankings, and the owner usually finds out last. A five-minute check every few months is worth it.</p> <p>I'm Shiv, founder of <a href="https://teamelivate.com" rel="noopener noreferrer">Team Elivate</a>, a small web design and SEO studio in Rohini, New Delhi. Questions? Leave a comment.</p> wordpress seo security webdev