How to detect and clean website hack

[edwsteel]

One of my clients complained that they see unusual pages in GSC (Google Search console). Their pages, which are viewed OK both in desktop and mobile from browser, would return something like this:
<snip>
when they try to fetch it as Googlebot.
Did someone face this issue here?

[lammert]

You have to check on the script and database level for the site what is going on. It could be that hackers added scripts which are cloaking content, serving different content to end-users than to Googlebot.

Is the site running a well-known CMS like WordPress? Then also check all installed plugins. Some plugins do calls to a home server which might pull up malicious content.

[not2easy]

The access logs for the site can offer clues on where to look for the causes when hacking is a possibility. Sometime it is not hacking but pirating content. The logs can give you insight on where to look. Google offers an array of tools to find and fix it if it has actually been hacked.

You can get information on diagnosing the problem in some similar threads here:
[webmasterworld.com...]
[webmasterworld.com...]

Google's resources and information on hacked sites:
[webmasters.googleblog.com...]