WordPress Pharma Hack Fix

Backup Your Site Immediately

Before attempting any fixes, create a full backup of your WordPress files and database. Use your hosting provider's backup tools or a reliable plugin. This step is critical; it provides a restore point if anything goes wrong during the cleaning process.

Scan for Malicious Files and Code

Install and run a reputable WordPress security plugin like Wordfence or Sucuri. Perform a deep scan to identify any suspicious files, modified core files, or injected code. Pay close attention to files in wp-content/uploads, wp-includes, and your theme directory. Manually inspect wp-config.php and .htaccess for unusual entries.

Inspect Your Database for Spam

Access your database via phpMyAdmin. Hackers often inject spam directly into the wp_posts table (post content) or wp_options table (site settings). Search for keywords like "viagra," "casino," "poker," or "payday loan." Exercise extreme caution when editing your database; incorrect changes can render your site unusable.

Review Themes, Plugins, and Users

Deactivate all plugins and switch to a default WordPress theme (e.g., Twenty Twenty-Four). If the spam disappears, reactivate them one by one to find the culprit. Check for newly created or suspicious admin users. Ensure all themes and plugins are updated to their latest versions, as outdated software is a common entry point for hacks like the WordPress Hidden Spam Links hack.

Change All Passwords and Keys

Update all critical passwords: your WordPress admin accounts, FTP accounts, hosting control panel, and database users. Also, regenerate your WordPress security keys and salts in wp-config.php. This ensures the hacker cannot regain access using compromised credentials.

define('AUTH_KEY',         'put your unique phrase here');
define('SECURE_AUTH_KEY',  'put your unique phrase here');
define('LOGGED_IN_KEY',    'put your unique phrase here');
define('NONCE_KEY',        'put your unique phrase here');
define('AUTH_SALT',        'put your unique phrase here');
define('SECURE_AUTH_SALT', 'put your unique phrase here');
define('LOGGED_IN_SALT',   'put your unique phrase here');
define('NONCE_SALT',       'put your unique phrase here');

Seek Professional Assistance

If none of these steps resolved it, this is where professional help saves time.