Website injected with gambling links: check it yourself in 10 minutes and fix it

How common is this?

In September 2024, Thanh Nien newspaper reported that more than 600 Vietnamese websites had hidden gambling ads injected (article in Vietnamese), including school and business websites. The links were hidden in text matching the background colour, so visitors could not see them. Many websites were injected again because the previous clean-up had not patched the hole.

Warning signs

• Searching your domain on Google shows strange pages, with titles or descriptions that are not yours.
• Visitors arriving from Google are redirected to another site, while typing the address directly works normally.
• Search Console reports "Security issues" or a sudden jump in indexed pages.
• There are admin accounts, plugins or themes you did not install.
• The website is unusually slow and the host reports excessive resource use.

Check it yourself in 10 minutes

1. Search Google: type site:yourdomain.com casino, then try the words betting, slot, jackpot and the Vietnamese terms cá cược, nhà cái, nổ hũ one by one. Any result is a bad sign.
2. Open Google Search Console: go to Security & Manual actions → Security issues; also check Pages and Sitemaps for unfamiliar addresses.
3. View the home page source: press Ctrl+U (Windows) or ⌘+⌥+U (Mac), then search (Ctrl+F) for display:none, casino and bookmaker names. Pay attention to link blocks in the footer.
4. Test on a phone using mobile data: search for your website on Google, tap the result and see whether you are redirected elsewhere.
5. If you use WordPress: check Users for unfamiliar admin accounts, and Plugins and Themes for anything you did not install; on the host, sort files by modification date to find recently changed files.

How to clean up for good

1. Back up the current state for comparison, then change every password: hosting, website admin, database, FTP, admin email. Delete unfamiliar accounts.
2. Remove the malware: update the website core, plugins and themes; delete unused or "nulled" plugins/themes; check the .htaccess file, configuration files and home page files. The safer way: restore a clean backup, then patch the hole.
3. Clean up on Google: make the spam addresses return 404 or 410; use the Removals tool in Search Console to hide them temporarily; if there is a security warning, request a review once the site is clean.
4. Monitor for 30 days: repeat the 5 checks every week, because reinfection is common when the hole has not been patched.

Prevention

• Update the website core, plugins and themes regularly.
• Strong, different passwords for every account; turn on two-factor authentication where available.
• Never use "cracked" (nulled) plugins or themes: they are a common infection route.
• Back up regularly and keep one copy off the host.
• One account per person, with only the permissions they need.
• Scan for injected links and malware regularly: Weme's Care plan does this weekly and responds to critical incidents within 4 working hours.

Frequently asked questions