I'm a total noob when it comes to being a web dev so please forgive me if the following sounds idiotic.

I noticed that when you search my website one of the result's URL looks like an advertisement:


It's not listed on the sitemap and when you follow the link it takes you to our homepage. I've tried to use their removals tool but it won't remove it since it's a 'valid' page.

What could have caused this and how do I stop Google from showing it in the search results?

3 Answers 3


Your site has likely been hacked and a malicious script inserted to add spam-advertising. The script may show one result to the Google bot and other results to humans. You should contact your hosting provider right away to get them to look at the site and see if they can assist in cleaning it. If not, there are security services that can do the same thing for a fee (Sucuri, Stop the Hacker, etc).

If you are running WordPress or Joomla or another common content management system, you will definitely need to get a pro involved to not only clean the infection but also harden the site against future attacks.

  • "Your site has likely been hacked" - it could also be possible that another (malicious / hacked / unsuspecting) site is simply linking to the site in question?
    – DocRoot
    Aug 25, 2016 at 23:32
  • @DocRoot From the original question: "I noticed that when you search my website" so I'm thinking the OP's site is hacked unless they misspoke.
    – JCL1178
    Aug 25, 2016 at 23:42
  • "when you search my website [on Google]" .... "how do I stop Google from showing it in the search results". The URL could have been discovered on an external website, not necessarily the site in question, could it not?
    – DocRoot
    Aug 26, 2016 at 0:00
  • Again, I'm parsing the OP's words. Your mileage may vary.
    – JCL1178
    Aug 26, 2016 at 16:41
  • Hi JCL1178, Thanks for responding to my question. The weird part is that I don't see any advertising on the site, it looks exactly the same in all the browsers. I've gone ahead and contacted my host in hopes they can look into it more. We're running Drupal as our CMS and I'm definitely not the pro the site needs
    – stexebarb2
    Aug 29, 2016 at 15:46

You are a victim of a hack (XSS, code injection) due to a bug, security flaw in your CMS (WordPress, Drupal, etc.)

One example of this type of attack is the "pharma hack" on WordPress, where ads about viagra were injected into WordPress pages to get them crawled on Google with incorrect keywords.

You would need to:

  • Fix security bugs in your webpages if they accept request parameters without sanitization, or their direct injection into page components like meta description or any other paragraphs. The current malicious link seems to have an intent of injecting ad keywords in your page.

  • Return a 410 for any already crawled page (410 = permanently discontinued), so that Googlebot can remove these results from SERPs

  • Put a URL removal submission request in webmaster tools, that may take some while to reflect though.


how do I stop Google from showing it in the search results?

Make sure this URL (and others like it) don't return a 200 OK status.

For example, to block all URLs that contain any of the words "money", "ebay" or "marketing" in the query string part of the URL, include something like the following near the top of your root .htaccess (Apache) file:

Options +FollowSymLinks
RewriteEngine On

RewriteCond %{QUERY_STRING} (money|ebay|marketing) [NC]
RewriteRule ^ - [F]

To block any URLs that contain a query string:

RewriteCond %{QUERY_STRING} !^$
RewriteRule ^ - [F]

These directives return a 403 Forbidden for such requests (as instructed by the F flag on the RewriteRule).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.