The hack only Google could see.
A small accounting practice's tax return page was quietly serving an Indonesian betting page to Google, and only to Google. Here's how we found it, how we explained it, and how it was removed. (We've left the firm's name out.)
A break-in you couldn't see from your own browser.
The firm is a small accounting and tax practice in inner Melbourne. Its website was about ten pages, built on WordPress, and nobody had touched it since 2021. It still carried WordPress's default tagline, “Just another WordPress site”. It also ran a 2020-era copy of Slider Revolution, a popular add-on with a history of serious security holes.
The first warning came from our AI-driven lead generation process, which flagged possible gambling links on the firm's Tax Return Accountant page. So we looked. And found nothing. The page looked completely normal in a browser and to the standard web tools.
That's where most checks stop. We asked for the page twice instead: once as a normal visitor, and once posing as Googlebot, the program Google uses to read websites. Then we compared the two.
- The site had two faces. People got the genuine accountant page (about 219 KB). Google got an entirely different Indonesian gambling page (about 630 KB) selling sports betting and online slots. The trick is called cloaking.
- It was built to rank. The gambling page had its own title, description and social sharing details, plus fake customer reviews and question-and-answer data designed to show up as star ratings and FAQ boxes in Google's results.
- It was aimed at this firm. Every button (login, register, buy now, the footer links) pointed to an outside spam website, at an address named after this firm and this page. That's a managed campaign, not random junk.
- It borrowed the firm's good name. The firm's own web address was linked using the betting brand as the link text. That lets the spammers ride on the age and reputation of the firm's domain to rank for gambling searches.
- Only Google could see it. The spam switched on when the visitor said it was Googlebot. The owners would never have seen it by browsing their own site.
- Google's own tool confirmed it. We checked the page in Google's testing tool, which shows a page exactly the way Google sees it. Same gambling page.
Google thought their tax return page was about gambling.
- Lost visibility. Google was being told the page was about betting, which hurts its chances for searches like “tax return accountant Melbourne”.
- A public warning. Sites like this risk a “This site may be hacked” label in Google's results, or a penalty applied by Google's team.
- Reputation. A prospective client who saw gambling content next to the firm's name wouldn't think “hacked”. They'd think “dodgy”.
- Security. An outsider had working access to the website and could change it whenever they liked.
Your website looks normal to you and your clients, but when Google visits, it's shown an Indonesian gambling site instead. Someone has broken in and is using your good reputation with Google to promote their betting site.
We didn't ask them to take our word for it. We asked them to search site: followed by their own web address in Google, on their own phone, and look at what came back.
Removing the spam is easy. Stopping it coming back is the real job.
Here's the plan we put to the firm:
- Snapshot the infected site first, as evidence
- Find and remove the cloaking code that decided who saw what
- Replace WordPress itself, every add-on and the theme with clean copies
- Hunt down hidden back doors: rogue admin users, disguised files, scheduled tasks that quietly re-infect the site, and code slipped into the database
- Close the way in by updating or removing the outdated add-ons and turning on automatic updates
- Change every password and key: hosting, file access, database, WordPress admins and the site's security keys
- Check again as Google, then ask Google to re-read the site through its Search Console
We also put the other option on the table. For a site this small, a clean rebuild can be faster and more certain than forensic cleaning. And we set expectations up front: the removal is quick, but Google can take days to weeks to show the clean version in its results.
One page. One face. The real one.
- The firm engaged us to remove the compromise
- The hidden gambling content is gone, along with the malicious code that was serving it
- Visitors and Google now see the same page: the firm's genuine tax return content
What every small business should take from this: your website can look perfectly fine to you and still be hacked. Neglected small-business WordPress sites are prime targets for automated attacks, because nobody's watching them. Cleaning off the spam you can see is the quick part. Ongoing managed hosting and updates are what stop it happening again. It's the same thinking behind our cyber security work: find what's hidden, fix it properly, then keep watching.
Is your website showing Google something you can't see?
Try the firm's check yourself: search site: and your web address in Google, on your phone. Pages in another language, or about gambling or products you don't sell, are a red flag. If you spot one, call us. Or book a free Security Scorecard and find out where the rest of your security stands.