Over the past couple of weeks, we've noticed that the search results from Google for some of our drupal-powered sites are having their page titles hijacked somehow. An example would be:

free streaming porn - [Actual page title]

There are other variations of the porn prefix, that's one of the more tame ones. I looked in the databases for each of these sites and the titles haven't actually been changed or anything along those lines. When you click on the result to visit the page everything looks normal (sans porn stuff). Would anyone be able to point me in the right direction as to what the cause of this is?

  • Links to some example queries and URLs would be helpful.
    – ceejayoz
    Nov 29, 2011 at 22:50
  • Here's results from the latest site that's been affected: bit.ly/vMw0ia
    – rfoote
    Nov 29, 2011 at 22:56

3 Answers 3


First of all, this isn't happening on bing or any other search engines. Also, when I view the pages, like you said, the bad titles don't appear.

Therefore, what I think is happening is that your site has became infected with a virus that causes google to see a different version of your page than what other people see, with the bad titles. This is easy to do, as when google browses webpages, it uses a special header and certain ip addresses, and therefor anyone can tell when google is visiting a site. You can test this by using google's webmaster tools "fetch as googlebot" feature: if the title of the page is different, than that's what is happening.

If that is the case, I would get someone to remove that virus from your drupal installation. Once that virus is gone, then google will re-index your pages, and the search results will be back to normal.

UPDATE (much later): Matt Cutts, the head of Google's webspam team, just posted a blog post that explains the basics of this problem, and where you can go to get more information and/or receive help.

  • You were right - as soon as I started to go in and check the drupal installation I saw a bunch of malicious code that was inserted onto some of the core files. Thanks for the help - now the task is to go and figure out how this got in here in the first place!
    – rfoote
    Nov 29, 2011 at 23:36
  • 2
    For reference, it looks like it was airschk that was messing with these sites of ours. Now the trick is to find out where our vulnerability lies so this doesn't happen again!
    – rfoote
    Nov 30, 2011 at 0:05

Are you sure that the virus is not on your end?

Have you tried other PCs and perhaps even other networks (in case your proxy is infected)?

  • Yes, our clients that we run these sites for have been catching these before we do, and we're able to independently verify it on our end. I also checked the internal link reports via google webmaster tools and its reporting back a bunch of similar things. For example, one of the entries:
    – rfoote
    Nov 29, 2011 at 22:50
  • 1
    +1 May not be the answer in this case, but this actually is a symptom of some variants of spyware/scumware so this answer represents valid concerns.
    – danlefree
    Nov 30, 2011 at 6:26

Problem: Drupal website page titles has "live streaming porn" text in prefix in only google search results

Solution: Visit drupal base directory for these 2 files index.php and install.php hackers have written a function GLOBAL $wehaveitagain; remove the complete function. Login to google webmaster tools and submit the URL's which you want to remove only from cache; revisit google webmaster once you see success message for submitted links and resubmit the URL's. Check if your sitemap.xml and robots.txt are manipulated by hackers if so create fresh XML and .txt files and upload it to your server.

Once google re-indexes pages your site will be normal.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.