The news: 30 million URLs on government sites

Thailand's Ministry of Digital Economy and Society reported roughly 30 million gambling-related URLs scattered across about 1,000 Thai public-sector websites, with servers under the Ministry of Public Health alone hosting some 8 million injected scripts. A case studied by international researchers involved a Thai college website used as a relay: ads led to Google results where the college's trusted domain ranked at the top, then redirected visitors to illegal casinos — exploiting the educational domain's reputation rather than any fake infrastructure.

How SEO poisoning works

  1. 1Attackers break in through outdated CMS/plugin vulnerabilities, leaked passwords or insecure hosting configuration.
  2. 2They plant large volumes of hidden pages or scripts — thousands to millions of URLs — invisible from the normal site.
  3. 3The compromised site's domain authority pushes those gambling pages up the Google rankings.
  4. 4Users searching or clicking ads see a result on a trustworthy-looking domain, click, and get redirected to gambling or phishing sites.
  5. 5Site owners often stay unaware for months because the homepage and core systems keep working normally.

The damage to the owner is worse than it looks: rankings of your real pages sink because Google sees spam on the domain, browsers may flag the site as dangerous, email from the domain starts landing in spam folders, and customer trust collapses the moment someone finds gambling links under your brand.

How to check whether your site is hit

  • Search Google for site:yourdomain plus words like “casino”, “slot”, “baccarat” — pages you never created mean you are compromised.
  • Open Google Search Console: check Security Issues, and watch the Pages report for an abnormal spike in indexed pages.
  • Inspect files on your host: odd .php files in upload folders, files modified when you deployed nothing, obfuscated (base64) code in index.php or .htaccess.
  • Compare your real sitemap against how many pages Google knows — a gap of thousands is a red flag.
  • View the site from other networks and via Google's cache — some spam only shows itself to Googlebot (cloaking).

Thailand's new NCSA web standard

In the same week as this news, Thailand's National Cyber Security Agency (NCSA) website-security standard came into force (mid-September 2026), setting minimum security requirements for government agencies, regulators and critical-infrastructure (CII) organisations — with private-sector adoption strongly encouraged. Companion cloud-security standards also require personal data stored in cloud systems to be classified at least “medium” confidentiality, with implementation reports submitted to the agency within 30 days of completion. The direction is clear: Thailand is raising the security bar for websites and cloud across the board, and businesses that adapt early gain the advantage.

8 ways to protect your site

  1. 1Update your CMS, theme and every plugin promptly — old WordPress/plugin vulnerabilities are the #1 entry point for spam injection.
  2. 2Delete unused plugins and themes entirely; deactivated code is still attackable.
  3. 3Use strong passwords plus MFA on admin pages, FTP/SFTP and your hosting panel.
  4. 4Run a WAF (web application firewall) to filter malicious requests before they reach the site.
  5. 5Set correct file permissions (never 777) and disable PHP execution in upload folders.
  6. 6Enable file-integrity monitoring, or at minimum a daily automated malware scan.
  7. 7Verify the site in Google Search Console so Google emails you the moment it detects a security issue.
  8. 8Automate site + database backups and keep copies off the primary server so a clean restore is always possible.

If you are already compromised

  1. 1Change every password immediately (admin, database, FTP, panel) from a machine you trust.
  2. 2Find and remove every rogue file and backdoor — the surest path is restoring a clean backup, then updating everything before going live.
  3. 3Audit .htaccess, config files and the database users table for planted admin accounts.
  4. 4In Google Search Console, remove the spam pages via Removals and submit a review request if Google flagged the site.
  5. 5Keep watching for at least 30 days — a single leftover backdoor brings the spam back within days.

Sources