Signs Your Website Has Gambling Malware: From Code Injection to Google Index Spam

If your website suddenly starts showing gambling keywords, casino pages, or URLs you never created, that is not a cosmetic problem. In many cases, it is a sign the website has already been compromised. On WordPress, this often appears as a spam SEO hack: attackers inject code, create doorway pages, install hidden redirects, or manipulate the database so Google indexes content that does not appear anywhere in your normal menu.

The problem is that most website owners notice it too late. Some discover it after seeing strange titles in Google. Some only realise it when Google Search Console starts reporting unusual URLs. Others find out because a customer says the site redirects them somewhere else. By that stage, simply deleting one spam page is almost never enough.

The short answer is this: the signs of gambling malware usually appear as injected code, files changing without your input, gambling pages indexed by Google, hidden redirects, unknown administrator accounts, and unexplained changes to your sitemap or robots rules. The fix has to follow the right order: preserve a copy, identify how it got in, clean the files and database, rotate all access, then ask Google to crawl again.

This article focuses on WordPress because that is where we see this pattern most often. If your website uses another CMS, the logic is still similar, but the exact file locations and technical steps will differ.

What “gambling malware” means on a website

“Gambling malware” is not the name of one official virus family. In day-to-day website work, the phrase is used for many types of compromise where the attacker piggybacks on your domain’s reputation to promote gambling, casino, betting, or similar spam content.

On WordPress, that can happen in several ways:

• injecting JavaScript or PHP into theme files, plugin files, or .htaccess;
• creating spam pages and posts quietly inside the database;
• placing a backdoor in places owners rarely inspect, such as wp-content/uploads/ or mu-plugins;
• redirecting only visitors coming from Google, or only visitors on mobile devices;
• changing the sitemap so spam URLs are fed to search engines;
• adding a new administrator account so the attacker can get back in at any time.

Because of that, the symptoms are not always identical. Some websites look normal to the owner but are a mess in search results. Others look fine on the homepage while the server is already full of modified files.

The most common signs your website has gambling malware

Below are the signs most worth suspecting. I am writing them in a problem-solution format so you can match them directly against your own WordPress site.

1. There is injected code in the header, footer, functions.php, or .htaccess

What does the problem look like?

This is the classic sign. The website looks ordinary from the front, but behind the scenes there is code you do not recognise. The injection often appears in header.php, footer.php, functions.php, wp-config.php, plugin files, .htaccess, or in the database inside tables such as wp_options and wp_posts.

Suspicious code often includes one or more of these patterns:

• functions like base64_decode, gzinflate, str_rot13, eval, or preg_replace used in ways that make no sense;
• long obfuscated JavaScript;
• hidden iframes;
• code that calls a domain you do not know;
• new redirect rules inside .htaccess that you never created.

How to check it properly:

1. Compare WordPress core files against a clean package from the official source.
2. Review the files with the most recent modification dates.
3. Check the folders where backdoors are often hidden: wp-content/uploads/, wp-content/mu-plugins/, and the active theme.
4. Search the entire codebase for suspicious strings. If you are comfortable with SSH, a quick search can speed up the investigation.

grep -R "base64_decode\|gzinflate\|eval(" public_html/wp-content

A command like that does not prove a file is infected by itself, but it is very effective for narrowing down which files deserve inspection first.

How to fix it in a way that actually solves the problem:

• Create a backup of files and database before you delete anything.
• Replace WordPress core with a clean copy from the official WordPress release instead of editing core files one by one if they have been altered.
• Reinstall plugins and themes from official sources, especially if you find extra files inside plugin folders.
• Remove malicious snippets from .htaccess, wp-config.php, functions.php, and wp_options.
• Change every password: hosting, SFTP/SSH, database, admin email, and WordPress logins.
• Log out all active sessions and force everyone to sign in again.

The common mistake: deleting only one visible code snippet while the real backdoor is still hidden elsewhere. The site then looks clean for a day or two and gets infected again.

Prevention: follow WordPress guidance on Hardening WordPress, use only official plugins and themes, and make a habit of updating WordPress plugins safely.

2. Gambling URLs or strange pages appear in Google Search Console

What does the problem look like?

This is one of the clearest signs. You open Search Console and see URLs you never created: random slugs, odd character strings, or pages filled with gambling or casino keywords. Sometimes those pages are invisible in the website menu but still indexed by Google.

Many owners first notice the problem only after running a site:yourdomain.com search and seeing a title or description that has nothing to do with their business. Google itself recommends regular site: checks and regular review of security reports to spot unexpected pages earlier.

How to check it properly:

• Search site:yourdomain.com in Google and look for unknown titles or descriptions.
• Review the Page indexing and Security issues reports in Search Console.
• Use URL Inspection on suspicious URLs.
• Check the sitemap to see whether spam URLs are being submitted.
• Search your wp_posts and wp_options tables for terms such as casino, slot, bet, or unknown domains.

How to fix it properly:

• Remove the source of the content from the database or the file that generates it, not just the URL from search results.
• Make sure deleted spam URLs now return 404 or 410, not 200.
• Refresh the sitemap and submit it again through Search Console.
• If there is a security warning, request review only after the website is genuinely clean.
• Use Search Console removals only as a speed-up step, never as the real solution.

This matters because Google’s removal tool does not clean a hacked website. It only hides a URL temporarily in search results. If the real source still exists on the server, the page will return on the next crawl.

If the problem has already reached the index level, it also helps to read our article on a website not appearing in Google, because once the cleanup is done, the next job is restoring search trust and making sure your real business pages are visible again.

Prevention: enable Search Console email notifications, perform a site: search every week, and save a list of suspicious URLs the first time you find them.

3. The website redirects to gambling pages, but only for certain visitors

What does the problem look like?

This is the most confusing pattern. You open your own website and everything looks normal. Then customers report that clicking your Google result sends them to another site. Sometimes the redirect only happens on mobile devices, only for certain user agents, or only for first-time visitors.

This pattern is often called a conditional redirect or cloaking. The goal is to stay hidden from the website owner while still redirecting search visitors and bots.

Common sources of the problem:

• malicious redirect rules in .htaccess;
• JavaScript loaded from an external domain;
• a nulled or compromised plugin;
• code stored in the database, such as in widgets, custom HTML, or theme options;
• a backdoor that rewrites the redirect after files are cleaned.

How to check it properly:

• Test the site in incognito mode and on a mobile device.
• Open the website through Google search results, not only by typing the domain directly.
• Compare the page source shown to ordinary visits and search-result visits.
• Inspect .htaccess, active plugins, functions.php, and any ad or third-party script settings.

How to fix it:

• Remove unauthorised redirect rules.
• Cut off every script loaded from domains you do not recognise.
• Reinstall the active theme and plugins from official sources.
• Clear plugin cache, server cache, and CDN cache so the old poisoned version is not still being served.
• Make sure there is no cron job or backdoor rewriting the redirect after cleanup.

If the redirect only happens sometimes, do not assume the site is clean just because one test was normal. Test repeatedly from multiple devices, networks, and browser modes.

Prevention: keep plugin count under control, avoid nulled plugins entirely, and monitor file integrity. Our guide on how to secure a small business WordPress site covers the foundation in simpler terms.

4. There are unknown admin accounts, unknown plugins, or settings changes you did not make

What does the problem look like?

Not every compromise begins with code injection into files. Some begin with leaked credentials, brute-force access, or a plugin vulnerability that lets an attacker create a new user. Warning signs include:

• a new administrator, editor, or author account you do not recognise;
• extra plugins becoming active on their own;
• changes to the homepage, permalink settings, or discussion options;
• password reset emails or login notices you did not trigger.

How to check it properly:

• Audit every user account in WordPress, especially admin and editor roles.
• Review the full plugin and theme lists, including inactive items.
• Check scheduled posts and cron events.
• Review login history or the activity log if you have one.

How to fix it:

• Remove suspicious users after reassigning legitimate content if needed.
• Reset passwords for all important users and turn on 2FA.
• Force-log out all sessions.
• Remove or disable unknown plugins.
• Make sure “Anyone can register” is turned off unless the website genuinely needs public signups.

Prevention: use unique passwords, turn on 2FA, and add login protection. On WordPress, Wordfence Security is widely used for firewall, scanning, and login security. If you want event logging and extra hardening, Sucuri Security is also useful for monitoring and file integrity. Security plugins help, but they do not replace proper cleanup when the site is already infected.

5. The sitemap, robots rules, or database changed for no obvious reason

What does the problem look like?

There are cases where the main files look fine, but the attacker plants spam in the database or manipulates the sitemap. As a result, Google keeps finding gambling pages even though nothing unusual appears in your website navigation.

Changes worth suspecting include:

• the XML sitemap suddenly listing unrelated URLs;
• robots.txt changing and pointing bots toward strange locations;
• the wp_posts table containing spam drafts, posts, or pages;
• the wp_options table containing scripts, redirects, or hidden HTML.

How to check it properly:

• Open the XML sitemap and verify that it only lists real pages.
• Audit robots.txt.
• Search the database for spam keywords.
• Review theme options, widgets, and builder content, because injections often hide there.

How to fix it:

• Delete spam records from the database.
• Regenerate the sitemap using the SEO plugin you trust.
• Restore robots.txt to a clean version.
• Clear transients and caches after fixing the database.

Prevention: keep scheduled database backups, review the sitemap regularly, and avoid giving admin access to more people than necessary.

The right handling order for a WordPress site with gambling malware

If you have already seen one or more of the signs above, do not jump randomly from one fix to another. The safest order usually looks like this:

1. Enable maintenance mode or restrict public access if the website is redirecting visitors or serving dangerous code.
2. Back up the current files and database for forensic purposes. This is different from a restore backup; the point is to preserve evidence.
3. Document every symptom: spam URLs, screenshots of search results, Search Console notices, changed files, and strange user accounts.
4. Rotate all credentials from a device you trust is clean.
5. Scan and audit WordPress: core files, themes, plugins, uploads, mu-plugins, the database, .htaccess, cron jobs, and users.
6. Restore from a clean backup if you have one and you know it predates the infection.
7. If no clean backup exists, do a manual cleanup until the backdoors, injections, spam URLs, and rogue users are all gone.
8. Update WordPress core, themes, and plugins after the site is clean. Delaying updates just leaves the same door open again.
9. Test again from both the user side and the search side: desktop, mobile, incognito mode, search results, and URL Inspection.
10. Request Google review if there was a security issue, then monitor closely for several weeks.

The principle is the same as in our guide on what to do when a website is hacked: do not only remove the symptoms; close the entry point as well.

For WordPress specifically: plugins worth adding after the site is clean

Plugins are not magic, but some genuinely help reduce risk after the website has already been cleaned.

The most sensible plugin stack for this kind of case

• Wordfence Security for firewall, malware scanning, login rate limits, and 2FA.
• Sucuri Security for audit logs, file integrity monitoring, and extra hardening.
• UpdraftPlus for scheduled backups and cleaner restores.

If several people manage the site, an activity log is also valuable because you can see who created a user, who edited content, and when plugins were activated. The key point is still this: install security plugins selectively. Too many overlapping security tools make the dashboard heavier and often make incident response more confusing.

Plugins do not help if the source of the compromise is still there

This is the part many owners misunderstand. Installing a security plugin after a hack does not mean the site is now clean. If you are still running a nulled theme, if the attacker’s user account still exists, or if a backdoor is still hiding inside uploads, the plugin may alert you but it does not erase the root cause.

That is why the more important long-term routine is:

• scheduled monthly updates;
• backups that are actually tested;
• user audits;
• Search Console monitoring;
• changed-file monitoring;
• uptime and performance reviews.

That is the core of WordPress maintenance service: not just installing a plugin, but keeping the site healthy after the incident is over.

How to prevent gambling malware from coming back

Realistic prevention is not one dramatic trick. It is a set of small habits done consistently.

1. Do not use nulled plugins or themes

This entry point is underestimated far too often. Many gambling spam cases begin with pirated files bundled with a backdoor from day one. WordPress itself stresses the importance of using trusted sources.

2. Update regularly, but do it in a safe order

A site that is months behind on updates is much easier to scan and exploit. Do not wait for symptoms. Schedule regular updates and check the site afterward.

3. Have backups that actually work, not backups that “probably exist”

Having a backup on paper is not the same as being restore-ready. Store backups in a separate location and test that they can be restored. WordPress guidance on backup and recovery explains the basics, and our own article on why website backups matter covers the practical side for business owners.

4. Turn on 2FA and limit login attempts

If you rely on password-only access, one leaked credential can open everything. Turn on 2FA, rate-limit logins, and disable accounts that are no longer used.

5. Watch Search Console and run site: searches

Google explicitly recommends that website owners monitor site: results and the Security Issues report to catch unexpected pages early. A five-minute check every week can prevent a problem from growing unnoticed for months.

6. Review users, plugins, and changed files

Many attacks are caught earlier simply because someone has the habit of checking whether a new admin appeared, a strange plugin was activated, or files changed outside normal working hours.

Frequently asked questions

Is removing gambling URLs from Google Search Console enough? Not enough. Removing a URL from Search Console only hides it temporarily in results. If the source page, injected code, or backdoor on the server has not been cleaned, the same or similar URLs can return on the next crawl.

If Wordfence or Sucuri is installed, does that mean the site is definitely clean? No. Security plugins are helpful for scanning, firewalling, and monitoring, but they do not guarantee a full cleanup if infected core files, database entries, rogue users, or nulled extensions are still present. Manual cleanup and closing the vulnerability remain essential.

Can gambling-indexed URLs disappear completely after cleanup? Yes. Once the source is removed, spam URLs return 404 or 410 or are redirected correctly where appropriate, the sitemap is refreshed, and a review is requested if there was a security warning, spam index entries usually fade out over time. The exact timeline depends on how many URLs were indexed in the first place.

When should you restore from backup, and when should you do manual cleanup? Restore makes sense if you have a backup you know was created before the infection and the missing content after that date is acceptable. If there is no verifiably clean backup, or if important new data would be lost, manual cleanup is usually the safer route.

Final thought: do not wait until your search results are full of gambling spam

The moment your website starts showing the signs above, treat it as urgent. Gambling malware rarely stops at a single file or one page. It almost always leaves something else behind: a rogue user account, extra scripts, a changed sitemap, or a backdoor waiting to be used again.

If you want a second opinion before acting, start with our free audit. If the website is already redirecting, if search results are full of spam, or if you are not sure which files are safe to remove, go straight to our website emergency service or contact us on WhatsApp. The faster it is handled, the less damage it does to your domain reputation and sales.