Help! Is this what is called "cloaking"?

[TeamPandoraBeauty]

Friend asked me to look at her website. Ran it through screaming frog and BAM, instead of 4 pages i was expecting it returned HUNDREDS. 99.9% of them are for cheap viagra and pharmaceuticals. I asked her if she was selling viagra, which is fine, I don't judge. But she swears she isn't.

http://janeflahertyesq.com

I ran it through google site:janeflahertyesq.com and sure enough, if you click on some of those, they take you to canadien pharmacys selling half priced blue pills.

a) is this cloaking? if not, what is going on?

b) more importantly, how do I we get rid of those hundreds of pages / de-indexed

She's stumped and scared. Any help would be greatly appreciated. Thank you all in advance and for the work you do.

[Roman-Delcarmen]

Cloaking refers to the practice of presenting different content or URLs to human users and search engines. Cloaking is considered a violation of Google’s Webmaster Guidelines because it provides our users with different results than they expected.

Google has released the Disavow Tool to help webmasters deal with this problem, but the tool should be used with caution and only as a last resort.

To report spam websites here

A rich snippet may be considered spam if it harms the user experience by highlighting falsified or misleading information. For example, a rich snippet promoting a travel package as an Event or displaying fabricated Reviews would be considered spam.

Report spam in rich snippets here

Check out Matt Cutts’s answer VIDEO It usually takes 2-4 weeks for the tool to work. Can you afford to have your website penalized for 1 month? No one can! I will show you how you can prevent these attacks and keep your business safe.

[TeamPandoraBeauty]

Thank you for that response and I totally understand and agree w it. However it didn't seem to answer my questions, namely

• what is happening/how did those urls get added to my friends domain?

• how do we get rid of them?

[Roman-Delcarmen]

Sorry my mistake I misunderstood your question

- what is happening/how did those urls get added to my friends domain?
probably the site was hacked, in my case I had some issues like this one,
caused for malicious scripts,on non official themes or plugins.

- how do we get rid of them?
Go to your Search Console > Google Index > Remove URLs

[Roman-Delcarmen]

The main reason for that, is probably your site has been hacked and it is used as zombie website. Im pretty sure that problem is the theme or some nulled plugin this kind of problem is very usual when some one get a theme of an untrusted website. So make a backup of your site, then delete everything, add a fresh version of your theme and plugins.

Once your site is clean follow these tips

To secure your website
https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/

Another security tips
https://yoast.com/wordpress-security/

[TeamPandoraBeauty]

Thanks, we'll try this.

[Roman-Delcarmen]

You are welcome

[DonnaDuncan]

Check with your hosting company as well. Asking Google to deindex the pages will be a temporary fix if the files still physically reside on your website. A reputable hosting company will secure their servers so content like this is less likely to be added.