Some viagra spammer somehow fooled Google into thinking the title and description metatags of a site pointing to me are about viagra. How did they do that? How do I fix this?

[KatMouse]

In performing a link: to my site, I found this:

Video Of People Using Viagra - Online Drug Store, Guaranteed Shipping

<cite>www.planetherbs.com/affiliate-program.html</cite> - Cached -Block all www.planetherbs.com results1 day ago – Video Of People Using Viagra. Online Drug Store, Guaranteed Shipping. Check Order Status. Natural and healthy products!

If you go to that url, you will see it's just an affiliate program page.

Some viagra spammer somehow changed the title and description metatags that google sees (not actually) and links from what appears to be spammy pages are pointing to me. I don't want to get dinged for this. How do I fix these for myself and planetherbs.com? And how did the spammer do this???

[RyanKent]

A search of your site shows this issue is more widespread then the one link. Perform a Google search for "viagra insite:planetherbs.com"

I have seen this issue before and my recommendation to resolve it asap in Google is to add the canonical tag to your pages.

As to how this happened, you can review server logs in an attempt to gather more information but I would recommend taking all steps possible to secure your server. I am not a security expert nor a Joomla expert but I notice you are using Joomla 1.5 as a CMS. Joomla 1.7 was just released and addresses numerous security issues.

There are a few other SEOs who have more experience with Joomla then myself who can offer more details. In general, upgrade your software then do a basic security check of your site. There are many Joomla guides online for this, but here is one of them: http://docs.joomla.org/Security_Checklist_7

[KatMouse]

Thanks, Ryan. An upgrade was my first recommendation to them as well. I found some advice in the Google Webmaster forum. Apparently, hackers hide some code on a file deep in the site, then add an include statement in the header. I need to remove the code in the header, figure out how to keep them out, then clean this out of Google's index which, unfortunately, might be the hardest part. Any tips on that? I don't want to de-index the entire site.

[RyanKent]

Do not request for Google to remove the URL. It would mean the page would be de-indexed for 90 days.

The cleanup will depend on the root cause. If there is an issue on the site right now then you cannot resolve the problem until it is fixed. Report the issue to your host and ask they run a security scan. Meanwhile run your own scans and upgrade the site to 1.7. Change all passwords then check the site again.