Is someone running a casino on your handyman website? How to check in two minutes

We review a lot of small home-service websites. Handyman shops, plumbers, cleaners, remodelers. And we keep finding the same thing: pages the owner never wrote, sitting inside their own site, selling online gambling.

Casino bonus codes. Betting tips. Slot reviews. Sometimes in English, often in languages the owner doesn't speak. Each page carries the business name in its title, so to Google it looks like the handyman wrote it. The owner almost never knows. Nobody on the team searches their own site for "casino", and the spam is not in the menu, so you only see it if you go looking.

This is not a big-company problem. It mostly hits small sites, because small sites are the easiest to get into and the least likely to be watched.

Why would anyone do this to a handyman site?

Your website is worth more to a spammer than you might think. A local business domain that has been online for a few years, with a real address, real reviews and a Google Business Profile pointing at it, looks trustworthy to search engines. Gambling sites have a hard time ranking on their own. So the likely play is to borrow a trusted local domain and publish their pages on it, riding on your reputation.

There is probably a second reason too. Pages on a real, clean local domain can make scam ads and scam links look legitimate. A link to "yourdomain.com/some-page" gets past filters and people that would block a brand new gambling domain.

We can't say for certain which reason applies to any one site. But the pattern is consistent, and the cost to you is the same either way.

What it costs you

• Your Google results get diluted. When the spam pages outnumber your real pages, Google has to decide what your site is about. It may decide it's not about handyman work.
• Customers can see it. Search your own business name and a gambling page can show up next to your services. That is not a good first impression.
• Your site may be flagged. Browsers and email filters can start warning people about a domain that hosts spam, which hits your website and your emails.
• Whoever got in may still be in. The pages are a symptom. The real problem is that someone has access to your site.

If your site is not on WordPress, steps 1 and 2 still work on any website. Steps 3 and 4 are the fastest way to see everything on a WordPress site at once.

What to do if you find something

Don't just delete the posts. If you only remove the pages, whoever put them there can put them back the same night. Close the door first, then clean up.

1. 1. Change your passwordsWordPress admin, your hosting account and your business email. Use new, long passwords, not variations of the old ones. Remove any WordPress users you don't recognise.
2. 2. Update plugins and themesOld plugins and themes are the most common way in. Update everything, and delete any plugin you're not using.
3. 3. Remove the posts and the spam categoriesDelete every post you didn't write, and the categories they were filed under. Check the trash is emptied.
4. 4. Request removals in Google Search ConsoleUse the Removals tool to ask Google to drop the spam URLs from search faster. If you don't have Search Console set up, set it up now. It's free and it's how Google tells you about problems like this.
5. 5. Turn on two-factor authenticationOn WordPress, hosting and email. This one step makes a repeat much less likely.

Make it part of the routine

Most owners check their reviews. Very few check their website. Add the 2-minute check to your quarterly review, the same way you'd look at your P&L or your price list. It costs nothing, and catching it early can save you months of lost search traffic.

If you want a second pair of eyes, members can send us their domain and we'll run the check for you.