SEO Spam on a WordPress Site Running The7: How to Find It, Remove It and Keep It Out

Key Takeaways

• The7 is a popular premium theme, so sites built on it are a frequent target. The theme itself has had published vulnerabilities, including a local file inclusion flaw (CVE-2025-63074) fixed in version 12.8.1.1, but the entry point is just as often an outdated bundled plugin, a nulled copy or a weak admin password.
• SEO spam is usually cloaked: visitors and site owners see a normal site, while Google sees pharmacy, casino or Japanese-language pages. Check what Google sees, not what your browser shows.
• Cleanup order matters: back up, find every backdoor, reinstall from clean sources, rotate credentials, then ask Google to recrawl. Deleting the visible spam first just tells the attacker to come back.
• Premium themes and their bundled plugins don't update through WordPress.org. Without an active licence, sites quietly fall years behind.
• On a client's The7 site we cleaned in 2026, Google had indexed about 3,400 spam pages. The cleanup found six separate persistence mechanisms; removing only the visible spam would have left five of them in place.
• After cleanup, rankings recover over weeks, not days, and only if the spam URLs return 404 or 410 and the infection doesn't return.

If a search for your brand brings up pages you never wrote, or Search Console reports thousands of new URLs in a language you don't use, your WordPress site has almost certainly been hit by SEO spam: attackers use your domain's reputation to rank their own pages. We draw throughout on a real cleanup we carried out on a client's The7 site, described below. This guide is for owners of sites built on The7, a widely used multipurpose premium theme, though most of it applies to any theme-based WordPress site. We've previously written up a full SEO spam investigation on an Elementor site, including the persistence mechanisms that make a quick cleanup fail.

What we found on a client's The7 site

In the spring of 2026 a B2B manufacturer contacted us because its brand searches were returning Japanese-language pages selling replica watches. The site, a twelve-page corporate showcase built on The7 by an agency in 2019, looked perfectly normal to everyone at the company. Search Console told a different story: the number of indexed pages had gone from about 40 to more than 3,000 in five weeks.

How they got in. The theme licence had lapsed in 2022 when the original agency stopped working with the client, so neither The7 nor its bundled plugins had been updated since. The server logs had been rotated past the initial compromise, so we couldn't prove the exact entry point; the most likely candidate was a known vulnerability in the outdated bundled slider plugin, whose directory contained the first malicious file we found.

What made it persistent. We found six separate mechanisms, any one of which would have rebuilt the infection:

1. A rewrite rule in an .htaccess file inside wp-content/uploads/2023/ that sent requests from search engine crawlers to a PHP script.
2. That script, disguised as an image cache file, which generated the spam pages on the fly from a remote template.
3. A fake must-use plugin in wp-content/mu-plugins/ with a plausible caching-related name, invisible in the normal plugin list.
4. Eleven lines of obfuscated code appended to the child theme's functions.php.
5. An administrator account created to look like a system user.
6. A scheduled task stored in the database that re-downloaded the script if it was deleted.

The attacker had also verified a second owner in the client's Search Console property and submitted a sitemap listing the spam URLs, which is why Google found them so quickly.

What we did. We followed the order described below: full backup, an inventory of all six mechanisms before removing any, a clean reinstall of WordPress core and of The7 and its bundled plugins at their latest versions under a renewed licence, database cleanup, rotation of every credential, and server rules returning 410 Gone for the spam paths. We then removed the rogue Search Console owner and sitemap and submitted the clean sitemap. The client now has a monthly update routine and file integrity monitoring.

Why sites built on The7 get hit

There's nothing uniquely unsafe about The7. Popular themes get targeted for the same reason popular plugins do: one working exploit reaches many sites. On theme-based sites, the entry point is usually one of four things.

1. Theme vulnerabilities. Like any large codebase, The7 has had published vulnerabilities over the years, mostly cross-site scripting. The most serious recent one, CVE-2025-63074, published on 9 December 2025, is a PHP local file inclusion flaw rated 7.5 (high) that affects versions before 12.8.1.1 and requires a low-privileged account. If your site runs an older version and allows user registrations, treat it as exposed.
2. Outdated bundled plugins. Premium themes often ship with premium page builders and sliders. Those plugins update through the theme's licence, not through the normal WordPress update screen, so sites without an active licence keep running old versions long after fixes are released.
3. Nulled copies. Pirated "free" versions of premium themes are a well-known malware delivery route: the backdoor is installed with the theme.
4. Credentials and hosting. Reused admin passwords, old accounts for former agencies or freelancers, and shared hosting where one compromised site reaches its neighbours.

Knowing which one applies matters, because removing the spam without closing the door just restarts the cycle.

Confirm the infection: look at what Google sees

SEO spam is usually cloaked. The malicious code checks who is visiting: a normal visitor or a logged-in admin gets the real site, while Googlebot gets the spam. That's why owners are often the last to know.

• Search Google for site:yourdomain.com and scan for unfamiliar paths, foreign-language titles or product keywords. Add terms like viagra, casino or Japanese characters if you suspect a specific campaign.
• Use Search Console's URL Inspection tool on a suspicious URL and view the crawled page. That shows the content Google actually received, which can differ from what your browser shows.
• Check the Security issues report in Search Console, and the Pages report for a sudden jump in indexed URLs.
• Check Search Console users and owners. Attackers sometimes verify themselves as owners so they can submit their own sitemaps. Google's guide to the Japanese keyword hack describes this pattern.
• Look at your sitemaps. An unfamiliar sitemap file, or thousands of new entries in an existing one, is a strong signal.

Where the spam usually lives

On theme-based WordPress sites, check these places before deleting anything:

Search PHP files for the usual obfuscation functions (base64_decode, eval, gzinflate, str_rot13, assert) and for very long single-line strings. Legitimate code uses some of these too, so compare with a clean copy rather than deleting on sight.

A cleanup order that works

1. Back up everything first, files and database, even infected. You'll need it to compare, and to recover anything a cleanup removes by mistake.
2. Put the site in maintenance mode or restrict access if the spam is serving anything harmful to visitors.
3. Find the persistence. List every backdoor, rogue admin account, scheduled task and modified file before removing any of them. Attackers usually leave several, and removing one triggers the others to reinstall it.
4. Reinstall from clean sources. WordPress core from wordpress.org; The7 and its bundled plugins from your licensed download, at the latest version; every other plugin from its official source. Don't copy plugin folders back from the infected site.
5. Clean the database. Remove spam posts, injected options and unknown users. Check the siteurl and home options.
6. Rotate every credential. WordPress users, hosting panel, FTP/SFTP, database password, and the secret keys in wp-config.php. Remove accounts for anyone who no longer needs access, and turn on two-factor authentication for administrators.
7. Confirm the spam URLs now return 404 or 410, including when requested with a Googlebot user agent.
8. Tell Google. Remove rogue Search Console owners and sitemaps, submit your clean sitemap, use the Removals tool for the worst URLs if needed, and request a review in the Security issues report if a warning was shown.

If you don't have a licence and can't get a clean copy of the theme at the version you run, that's the moment to decide whether to renew it or move off it, not to keep running an unpatched copy.

Keeping it out

• An active licence and a monthly update routine for the theme and its bundled plugins, since they won't update on their own.
• Remove what you don't use: unused themes, deactivated plugins, demo content imported with the theme.
• Disable file editing from the dashboard (DISALLOW_FILE_EDIT in wp-config.php) and block PHP execution in uploads.
• Close user registration unless you need it; several of The7's published vulnerabilities required a logged-in account.
• File integrity monitoring and off-site backups, so the next change is noticed in hours, not months.
• A web application firewall in front of the site.

How long until rankings recover?

Once the spam pages consistently return 404 or 410, Google drops them as it recrawls. That typically takes a few weeks for most URLs, longer for a large infection. Your own pages recover as Google regains confidence in the site. Reinfection resets the clock, which is why step 3 matters more than any other.

Frequently asked questions

Is The7 safe to use? It's a maintained commercial theme, and its published vulnerabilities have been fixed in later releases. The risk comes from running old versions, outdated bundled plugins or unlicensed copies. Keep it licensed and updated, or don't use it.

Can a security plugin clean this for me? It can find known malware signatures and is a useful first step. It often misses custom backdoors, database injections and server-level persistence, which is why infections come back after a "successful" scan.

Should I rebuild the site from scratch? Not necessarily. A rebuild doesn't help if the entry point (credentials, hosting, an outdated plugin) stays the same. Understanding how the attacker got in, then cleaning methodically, is usually faster and keeps your content and URLs.

My site shows spam only in Google, not when I visit. Is it really hacked? Yes. Cloaking is the norm for SEO spam. Use URL Inspection in Search Console to see what Google receives.

---

We investigate and clean compromised WordPress sites, then close the entry point so the problem doesn't come back. See our security incident response service, or tell us what you're seeing.

Sources

• CVE-2025-63074, The7 local file inclusion (OpenCVE): affected versions before 12.8.1.1, CVSS 3.1 score 7.5
• Google Search Console Help, Security issues report
• web.dev, fix the Japanese keyword hack: cloaking, rogue Search Console owners, .htaccess and obfuscated PHP
• Google Search Central, malware and unwanted software