Finding pharma links injected into a site

What the pharma check matches

Link Signals matches a destination’s title, description and page text against this list of words and phrases.

• viagra, cialis, levitra, tramadol and xanax
• “online pharmacy” and “no prescription”
• “generic viagra” and “generic cialis”
• “buy” followed within a few words by “pills”

It also flags destination domains with viagra, cialis, pharmacy or pills in the name, which catches sites that are unreachable when scanned.

How a finding is graded

Unlike adult and gambling content, Link Signals has no public blocklist for pharma. A pharma finding therefore comes from the word list or from the AI analysis, and is not a confirmed-list match. See blocklist sources for what the lists cover.

What it will miss

• A pharma link that avoids every word and phrase above, such as an image link or a product name not on the list.
• Links shown only to search-engine crawlers. See accuracy and limits.

Why pharma is the classic injection

Pharmacy spam has been injected into other people’s sites for as long as search engines have existed, because the products are sold on volume and the sellers cannot rank on their own. The links are placed on sites that already have standing. The common routes in are an out-of-date plugin or theme, a stolen password, or a compromised hosting account. Once in, the injected code usually hides the links from the owner, using hidden styles, cloaking or an encoded script.

What it costs you

• Search: pages carrying injected links can lose rankings, and a site can be flagged in search results as hacked.
• Visitors: someone who clicks lands on a pharmacy that was never your choice, which reflects on you.
• Safety: the destination may sell unlicensed medicine or collect payment details.
• Workplace filters: schools, libraries and companies may block a site that links to this content.

Where the finding appears

A pharma finding is tagged with the pharma category. When the page carrying it is not itself about health, the Out of context badge is added, and the finding is grouped under Out of context in the action plan. If it is concealed, a Hidden, Cloaked or Hidden in script badge is added as well.

Legitimate reasons for the same words

• A news article about a drug recall, or an encyclopaedia entry for a medicine.
• A pharmacy, clinic or health charity linking to a regulated pharmacy.
• A forum thread where a visitor mentions a medicine by name.

These match the word list and come back as Needs review, not Not safe, which is why they are left for a person to judge.

What to do when you find one

1. Look at the destinationOpen it in a private window. A shop selling prescription medicine without a prescription is a clear case.
2. Find the link on your pageOpen the page in Found on and search the source for the anchor text. If it is not in the visible page, check for hidden, cloaked or encoded variants.
3. Remove it and close the way inRemove the link and the code that added it, update plugins and themes, delete accounts you do not recognise and change passwords. After a WordPress hack has a fuller checklist.
4. Look for othersInjections rarely come singly. Look through the rest of the report for other pharma findings and check every page they are on.

Common mistakes

• Fixing the one page the report names, when the same code runs on every page through a shared template.
• Assuming a missing word-list match means a clean site: pharma links that avoid the listed words are not caught.
• Leaving the compromised account in place after removing the links.

How to confirm it is fixed

Run a re-check from the report’s Overview tab after the fix. It reads only the pages your flagged links are on, so it takes a minute or two. Marking a finding as reviewed does not close it: the next scan reads the page again and calls the finding resolved only when the link is gone or no longer flagged. On a monitored site, later checks keep watching for it to come back.

In your report

Pharma links are counted on the Pharma card on the Overview tab. It sits under the heading “What the risky links are about”, after the priority cards, and carries a red High risk chip. These cards break the same findings down by subject, so a pharma link is counted both here and in whichever priority card it belongs to. The category cards are not added to the action plan paragraph.

The advice reads “Remove the 3 links to online pharmacies. This is the classic sign of an injected-spam hack, so check your plugins, themes and logins”. Review these links opens the Findings tab on a Pharma view. That view is not on the tab row, but it shows its own tab with the count and the usual detail panel. The small button beside it, labelled “What pharma links are”, opens this page in a new tab, so the report stays where it is.

In the list, each row shows a pharma chip in the Signals column. When the page is not about health it also has an amber Out of context chip and sits in the Out of context priority, and a concealed link adds a red Hidden, Cloaked or Hidden in script chip. The reason says how it was reached: a word-list match is Needs review, a model judgement of an unsafe page is Not safe.

What to do next

1. Start with the rows that also show a red concealment chip. They point to a compromise.
2. Open each Found on page, find the link and remove it at the source, then check your plugins, themes, users and logins.
3. Use Re-check once fixed. If a row is a genuine pharmacy link you meant to publish, mark it reviewed or ignore it in monitoring.

How this counts in your LinkSignal

When the page carrying a pharmacy link is not about health, the link is out of context and is counted in the out of context links row of your site’s external LinkSignal, or in the hidden, cloaked and script-injected links row if it is also concealed. On a page where it fits, it falls under links that need review if it is flagged as risky or unsafe. The LinkSignal overview lists every row. LinkSignal is Link Signals’ own metric, worked out only from what this tool finds, and it is not connected to any search engine or third-party score.