School, university, or agency website hacked with illegal gambling spam: how to recognise it, clean it up, and report it

By Mohammad Hilmi Bisri, S.Kom.. Published 12 October 2026.

Many school, university, and government agency websites have had pages or links for illegal online gambling slipped into them. The intruders get in through a security hole, then create new pages or insert links into existing ones. These insertions often appear only in Google, so the people who manage the website do not see them when they open it.

The Ministry of Communication and Digital Affairs (Kementerian Komunikasi dan Digital, Komdigi) recorded 86,826 page addresses (URLs) on government agency websites with injected gambling content between January 2022 and May 2026. Of these, 75,136 have been taken down, but as of 19 May 2026, 767 URLs were still active.

Signs that a website has been hacked

• Type site: followed by your website address (without spaces and without https://) into the Google search box. The results show the pages of your website that Google has recorded, including any pages the intruders added. Titles or descriptions containing gambling words, or page addresses you never created, are a clear sign.
• Pages that show gambling content in Google look normal, or show "not found", when you open them yourself. This technique is called cloaking: Google and visitors are given different content. The URL Inspection tool in Google Search Console (Google's free service for website owners) shows the page as Google sees it.
• The Security Issues report in Search Console shows findings such as "Hacked: Content injection" (spam links or text added to your pages) or "Hacked: URL injection" (the intruder created new pages). Affected pages may be given a warning label in the search results.
• There is an admin account you do not recognise in the CMS (content management system, the software used to manage a website's content, for example WordPress). Also check Settings, then Users and permissions, in Search Console. Intruders can register themselves as owners and change settings there.
• Managers of government websites receive an email from Komdigi about gambling content inserted into their site.

Who to report to

A website operator is an electronic system operator under Government Regulation (Peraturan Pemerintah, PP) No. 71 of 2019 on the Operation of Electronic Systems and Transactions. If another party's actions cause a system failure or disruption with serious consequences, the operator must secure its electronic information and documents, then report immediately, at the first opportunity, to law enforcement officers and the relevant ministry or agency (Article 24(3)).

• The Pusat Kontak Siber (cyber contact centre) of BSSN (Badan Siber dan Sandi Negara, the National Cyber and Crypto Agency) accepts reports of cyber incidents from the public, government agencies, and the private sector, including website hacking. The channels are: email bantuan70@bssn.go.id, WhatsApp or phone 0811-1065-2018, the dedicated line 183, and the portal aduansiber.bssn.go.id. Prepare a photo of your identity card, the service form, and a description of the affected system. BSSN checks the requirements within 24 hours of receiving the documents, then gives an initial analysis within 72 hours of the report being declared valid.
• Regional government agencies should also notify their regional government's CSIRT (computer security incident response team). In Jombang Regency, for example, JombangKab-CSIRT is headed by the head of the Communication and Informatics Office (Dinas Komunikasi dan Informatika). It can coordinate with the East Java Provincial CSIRT and with BSSN's Gov-CSIRT for incidents it cannot handle. Gov-CSIRT itself serves the CSIRTs of central and regional government.
• Websites with a .go.id domain: notify the team at Komdigi that manages government agency domain names, at helpdeskdomain@mail.komdigi.go.id.
• The gambling sites that the injected links point to can be reported to Komdigi's content complaints portal, aduankonten.id (external site).

If the intruders were able to access personal data, for example data on students or residents, the notification duties in the Personal Data Protection Law (Undang-Undang Pelindungan Data Pribadi, UU PDP) also apply (see the article UU PDP for villages, schools, and agencies).

How to clean up the website

1. Secure access. Take the website offline temporarily, for example by asking your hosting provider to show a maintenance page served from outside the infected folder. According to Google, taking a website offline temporarily during recovery is unlikely to affect its ranking in search results. Make a note of unknown accounts, then delete them, and change the passwords of all website accounts.
2. Make a copy of the website in its current state and label it "infected". This copy is only a precaution in case some content is deleted along with the spam.
3. Find the source of the injection. Check the .htaccess file (a server settings file). Google's guide describes one type of hack that uses this file to create spam pages automatically by pointing to PHP files with random names. Also check the database contents, the plugins and themes, and the server access records (logs) to find out when the intruders first got in. Scan the administrators' computers with antivirus software, because spyware on those computers can record passwords.
4. Restore from a clean backup, meaning a backup made before the website was hacked. The date the intruders got in, found in step 3, helps you choose the right one.
5. Update the CMS, plugins, and themes to the latest versions. Google recommends a clean reinstallation, because a normal update can leave old infected files behind. Delete the files of all plugins and themes you do not use. Deactivating them is not enough.
6. Close the hole the intruders used, then change all passwords once more: CMS admin, hosting panel, FTP (access for uploading files), and database.
7. Set the pages created by the intruders to return a 404 code (page not found). These pages will drop out of Google over time. To speed this up, use the Removals tool in Search Console, but only for pages that will never be used again.

HanzCodes takes on the work of cleaning up injected gambling content. The details are on the website repair page.

Asking Google for a review

Request a review once ownership of the website has been verified in Search Console, the injected content has been removed, the security hole has been closed, and the website is back online. Make sure the pages are not blocked from Google, for example by robots.txt or a noindex tag.

1. Open the Security Issues report in Search Console.
2. Make sure every issue listed has been fixed across the whole website. Fixing only some of the pages is not enough.
3. Select Request Review. Describe the problem, the steps you took to fix it, and the results. An example from Google's guide: for content injection URLs, the spam content was removed and the hole was closed by updating an outdated plugin.

According to Google, most reviews take from several days to several weeks. Reviews of sites hacked with spam may involve a manual check. Do not send the request again before the final decision comes out. A request submitted before the problem is fully resolved can make the next review take longer, or cause the site to be flagged as a repeat offender.

Stopping it from happening again

• Make automatic backups regularly, covering files, the database, and images.
• Update the CMS, plugins, and themes regularly. Do not install free copies of paid plugins or themes downloaded from dubious sites. Google notes that this is a common way to insert malicious code.
• Use a strong, different password for each account, and turn on two-step verification (an extra code, for example sent to your phone, when you sign in).
• Give admin access only to staff who need it, with a separate account for each person. Delete the accounts of staff who have moved to other duties.
• Always keep the operating system and browser up to date on the computers used to manage the website.
• Check the site: search results and the Security Issues report regularly. Make sure the administrator email addresses in Search Console and in the domain registration are still active, so that notices from Google or Komdigi are read.
• Government agencies can ask BSSN for an ITSA (Information Technology Security Assessment) free of charge, subject to quota. It consists of a search for security holes and recommendations for fixing them. Requests are sent to itsa@bssn.go.id.

This article is a summary, not legal advice. For specific decisions, refer to the text of PP 71/2019 in the BPK legal database (JDIH BPK) (external site) and consult the competent official or unit, for example the Communication and Informatics Office (Dinas Komunikasi dan Informatika), the regional CSIRT, or BSSN.