How to Check WordPress Posts for Hidden SEO Spam

Last updated on October 23rd, 2026 at 12:44 pm

A search for hidden markup can help locate suspicious WordPress posts, but it cannot tell you by itself that a site is infected. Treat each match as something to review, not something to delete automatically.

Search a database copy first

Back up the database and files before investigating. Work on a copy where possible. Replace wp_posts below with the actual posts table for the installation; table prefixes vary.

SELECT ID, post_type, post_status, post_title
FROM wp_posts
WHERE post_content LIKE '%display:none%'
   OR post_content LIKE '%display: none%'
ORDER BY ID;

This illustrative query reads candidate records without changing them. The two patterns catch common spellings only. They will miss other CSS formatting, external stylesheets, encoded payloads, and content injected outside the posts table.

Review each match in context

1. Compare the stored HTML with the public page and a known clean revision.

2. Inspect unexpected outbound links, unfamiliar text, and changes to otherwise unrelated posts.

3. Check when the record changed and whether the change was authorized.

4. Look beyond posts: themes, plugins, uploaded files, options, and administrator accounts may also be involved.

Hidden elements are normal in many interfaces. Menus, tabs, and scripts may legitimately hide content, so a match is not proof of malware. Conversely, a query returning zero rows is not a clean bill of health.

Fix the entry point as well as the content

If a compromise is confirmed, preserve evidence, replace affected software with trusted copies, remove unauthorized access, and rotate exposed credentials. Cleaning one post does not remove a backdoor that can recreate the spam.

Restore from a known clean backup when appropriate and verify the restored installation before reopening it. Review search visibility separately after the site is clean; removing injected text does not immediately remove every cached search result.

Start with one suspicious record and establish what changed before expanding the cleanup.

Reference: WordPress guidance for hacked sites.