SEO spam in Belgium: 87 working business sites carry casino or pill pages

On 8 November 2026, 87 of 23,676 working Belgian business websites carried inserted casino, pill or other spam: 1 in 272, or 0.4%. The business is still there, with its own name and its own offer. That sets these sites apart from the expired domains in our previous study, where the business had lost the address altogether.

What we counted as hijacked

A site counts when two things hold at once: the business still shows its own content, and somewhere on the same domain sits text or a run of links that has nothing to do with it. Picture a restaurant with its menu online and, at another address on the same site, a long page about online slots. That is the pattern we counted. We read every site ourselves, because a word such as roulette or poker also turns up on a pizzeria's menu or in a street name.

We cannot prove that an owner knew nothing. We used no web archive and no domain registry, so we do not see who placed the pages or when. Google calls content hacked when it was put on a site without permission through a security weakness. We say hijacked, since the content does not belong to the business and is nearly always kept out of sight.

Casinos first, in fourteen languages

79 of the 87 sites (90.8%) show gambling content. Four carry pills and four something else, such as replica watches or essay writing. Language tells you more than subject. On 57 of the 81 sites (70.4%) where we could establish both the language of the site and the language of the spam, the two differ.

English is the most common, on 25 sites, followed by French on 15 and Dutch on 9. Russian, Turkish and Indonesian each appear on 5 sites, then Italian, German, Polish, Hindi and Uzbek. On 18 of the 87 sites (20.7%) the text names Belgium or Belgian players outright. That is a floor: we counted only what we saw while reading. On the other sites we did not see it. A Belgian domain then serves as a billboard for a market in which the business itself sells nothing.

Hidden on the home page, or absent from it

For each site we read the home page of 8 November and checked whether the spam sits in an element the visitor cannot see. On 44 sites it does: the text or links are in the code, but off screen.

The tricks are simple. A block sits thousands of pixels left of the screen, stands one pixel tall, or has an opacity of zero. Nothing changes on a phone or laptop, yet anyone reading the source finds a row of links. Of the 9 sites with no hiding style, some simply have an odd page title that you only notice in a browser tab or on Google. Those 9 may be overstated too, as we did not read separate style files.

So on 83.9% of cases the home page gives nothing away. That explains how spam can stay in place: an owner who opens the site to change the opening hours sees nothing strange.

Up to 3,938 spam addresses on one site

A sitemap is the list of addresses a site hands to search engines, and whoever hijacks a site sometimes uses it too. On 41 of the 87 sites (47.1%) it holds at least one address with a gambling or pill term. Together those 41 sitemaps hold 22,527 such addresses.

We read at most five sitemap files per site, so these numbers are floors as well: on 4,033 sites some files stayed unread. A small business with a handful of pages of its own can pick up dozens or thousands of addresses it never asked for. A site can pass all four basic checks in our report on Belgian business websites and still carry them.

What the sitemap misses

Reading the sitemap is a good first step and no more than that. On 46 of the 87 sites (52.9%) it holds no suspect address at all. Our calibration set makes the point sharper. Of the 50 sites we labelled hacked in our previous round, 46 still show spam today, and only 13 of those (28.3%) have a suspect address in the sitemap. On the other 33 you find it only in the pages themselves.

The reverse holds too. Reading home pages alone would have cost us 29 sites, and for 27 of those the sitemap pointed the way. That helps explain why this count reaches 87 where the earlier one, which read home pages only, stopped at 50. Through the sitemap alone we reach 41 of 17,360 sites with a readable sitemap (0.2%). Another 6,316 working sites (26.7%) have none we could read, which leaves only the home page.

WordPress has the most cases

70 of the 87 sites (80.5%) run on WordPress, while WordPress makes up a third of our sample. We recognise a platform by traces in the HTML, and our CMS detector does the same for your own site.

Every share stays below 1% and the gaps fall below our threshold of 5 percentage points. We therefore call the rate per platform about equal and draw no cause from it. For what WordPress does mean for security, read is WordPress safe.

Look at the row for version 7. On 28 of the 59 hijacked sites (47.5%) version 7 is already installed, and 23 of those run 7.1.4, the newest version we saw in the measurement. A recent version does not rule out spam. Updating after a break-in leaves in place whatever was already put there. Whether that happened here we cannot see, and a group of 59 is too small to weigh versions against each other.

No sector stands out

Hospitality and retail supply the most cases, but they are also the largest groups in our sample, which comes from OpenStreetMap and so holds more cafés, restaurants and shops than the Belgian small business population as a whole. No group passes half a percent.

All differences stay below 5 percentage points: about equal. An owner of a garage or a building firm cannot conclude from this table that they are safer than a brasserie.

Small in every province, absent from none

We found cases in all ten provinces and in Brussels. The share runs from 0.1% to 0.7%. With counts this small a single site moves the whole order, so do not read the map as a ranking.

Here too each difference stays below 5 percentage points: about equal. Antwerp and Brussels count 15 sites each, East Flanders 13, Liège 11. We see no local cause in that.

Why owners do not notice

Five things work together. The spam is not in your menu. It is often in another language, so it does not catch your eye in a search result. On the home page it sits off screen. It lives at addresses you never open. And sometimes the site shows it only to Google: that is cloaking, different content for search engines than for people.

What does the person who placed it gain? Reputation they did not have to build. An older domain of a Belgian business has links and trust, and their page leans on both. Google calls that link spam and targets it in spam updates such as the one of September 2026. The damage lands with you. Pages can get a warning label or an interstitial in Google, and Google says a review can take several days or weeks. Your own visibility can suffer too: this check shows whether Google still sees your pages.

The fastest place to see it is Google Search Console. Its report shows only what Google itself found, with a sample list that need not be complete. A green tick there does not mean your site is clean.

The Dutch count used another setup

On 3 September 2026 the Dutch broadcaster BNR reported that at least 1,000 websites of businesses, foundations and freelancers carried casino promotion, and DutchNews wrote that the number could exceed 8,000. What we could read of it gives no denominator and no counting method, so no share follows from it. Our 87 sit on a fixed base of 23,676 Belgian sites. Setting the two numbers side by side says nothing about whether Belgium is doing better or worse. The mechanism does look alike: pages on the site of a business that has no interest in them.

Within our own series the figure differs for another reason. The study of expired domains found 50 hacked sites on 31,123 domains by reading home pages only. Here we add the sitemap, look only at working sites and fetched the pages again. A domain can be abused in another way as well, as a fake mail sender: see our count on email spoofing.

What Belgian advertising rules say

For readers abroad: since 1 July 2023, gambling advertising has been the exception in Belgium. Article 2 of the Royal Decree of 27 February 2023 allows only the forms listed in its chapter 2. Article 3, 3° defines advertising broadly: any communication meant to promote games of chance or encourage gambling, whatever the place, the means or the technique. Article 11 leaves licence holders room on their own website.

The Belgian Gaming Commission states on its website that all other forms of gambling advertising are prohibited and that offences are criminal in nature. On the pages we looked at, it does not mention business sites carrying such spam. A member of the Commission named social media as a channel for advertising by illegal operators, speaking to the broadcaster VRT in August 2026. Our count shows a second channel, one that also stays out of sight. We say nothing about the position of an owner who is a victim: that question belongs with a lawyer.

How to check whether your site carries spam

All you need is a browser. Work through these in order, since each step catches something else.

1. Search Google for your own domain. Type `site:yourdomain.be casino`, then `site:yourdomain.be viagra` and `site:yourdomain.be slots`. Results in a language you do not write are your signal.
2. Open your sitemap. Go to yourdomain.be/sitemap.xml and look for addresses you do not recognise. Found nothing? Carry on, as more than half of the cases are not listed there.
3. Read the source of your home page. Press Ctrl+U or Cmd+Option+U and search for casino, bet and slot. A list of strange links or a style like `left:-9999px` does not belong there.
4. Check Search Console. Open the security issues report, then the list of pages. No account yet? Follow this walkthrough. The SEO checker reads your page the way Google does, so you can see whether your title and description still hold.
5. Found something? Clean up in the right order. Copy the site first and change the passwords. The full runbook is in our guide to a hacked website. Then turn on two-factor authentication and ask Google for a review.
6. Stay on top of it. Plan updates and a look at Search Console each month, yourself or through website maintenance. If the site is old and you would rather not go back into it, look at having a new website designed, and go through the SEO checklist so your old addresses are not lost.