Learn how to bulk delete WordPress spam posts using SQL while removing post meta and taxonomy data safely.

How to Bulk Delete WordPress Spam Posts Using SQL

If your WordPress website has been infected with malware, you may suddenly discover hundreds or even thousands of unwanted blog posts containing keywords like casino, bet, or gambling. These spam posts are commonly created by hackers to manipulate search engine rankings and damage your website’s SEO.

Deleting each post manually from the WordPress dashboard is time-consuming and often impractical. Fortunately, you can bulk delete WordPress spam posts directly from the database using a single SQL query.

In this guide, we’ll explain how the SQL query works, why it’s effective, and how to use it safely without leaving unnecessary database records behind.

Why Hackers Create Spam Posts

Once a WordPress website is compromised, attackers often use automated scripts to publish spam content. These posts are designed to rank for high-value keywords and redirect visitors to malicious or unauthorized websites.

Common spam keywords include:

• Casino
• Bet
• Gambling
• Poker
• Slots
• Crypto
• Viagra
• Loans
• Adult content

These posts can quickly number in the hundreds or thousands, making manual removal nearly impossible.

Before You Run Any SQL Query

Before making changes to your WordPress database, always take a complete backup.

Back up:

• WordPress database
• Website files
• wp-config.php
• Uploads folder

Having a recent backup ensures you can restore your website if anything is accidentally deleted.

The SQL Query

The following query removes spam posts along with their related metadata and taxonomy relationships.

DELETE p, pm, tr
FROM wp_posts p
LEFT JOIN wp_postmeta pm ON p.ID = pm.post_id
LEFT JOIN wp_term_relationships tr ON p.ID = tr.object_id
WHERE p.post_type = 'post'
AND (
p.post_title LIKE '%casino%'
OR p.post_title LIKE '%bet%'
OR p.post_title LIKE '%gambling%'
);

This is much more efficient than deleting posts one by one because it also cleans up related database records.

Understanding the SQL Query

Let’s break down each section of the query.

DELETE p, pm, tr

DELETE p, pm, tr

Instead of deleting records from only the wp_posts table, this command deletes data from three related tables simultaneously:

• wp_posts
• wp_postmeta
• wp_term_relationships

This prevents orphaned records from remaining in your database.

FROM wp_posts p

FROM wp_posts p

The query starts with the WordPress posts table.

The alias p simply provides a shorter name for wp_posts, making the query easier to read.

LEFT JOIN wp_postmeta

LEFT JOIN wp_postmeta pm
ON p.ID = pm.post_id

Every WordPress post can have associated metadata, such as:

• Custom fields
• SEO information
• Plugin settings
• Featured image data

If you delete only the post, this metadata remains in the database unnecessarily.

This JOIN ensures the metadata is deleted as well.

LEFT JOIN wp_term_relationships

LEFT JOIN wp_term_relationships tr
ON p.ID = tr.object_id

WordPress stores category and tag relationships in the wp_term_relationships table.

Without removing these entries, your database will contain broken taxonomy relationships.

The query deletes them automatically.

Filtering Only Blog Posts

WHERE p.post_type = 'post'

WordPress stores multiple content types in the same table, including:

• Posts
• Pages
• Attachments
• Products
• Custom Post Types

This condition ensures that only standard blog posts are removed.

Finding Spam Titles

AND (
    p.post_title LIKE '%casino%'
    OR p.post_title LIKE '%bet%'
    OR p.post_title LIKE '%gambling%'
)

This is the heart of the query.

It searches post titles containing any of these keywords:

• casino
• bet
• gambling

The % symbol is a wildcard that matches any characters before or after the keyword.

For example, it will match:

• Best Casino Guide
• Online Betting Tips
• Gambling Strategy
• Free Casino Bonus

Add More Spam Keywords

You can expand the query by adding additional keywords.

For example:

OR p.post_title LIKE '%viagra%'
OR p.post_title LIKE '%crypto%'
OR p.post_title LIKE '%loan%'
OR p.post_title LIKE '%slot%'
OR p.post_title LIKE '%poker%'

Adding more keywords helps remove additional spam posts in a single execution.

Preview Results Before Deleting

A best practice is to replace the DELETE statement with a SELECT query first.

Example:

SELECT *
FROM wp_posts
WHERE post_type='post'
AND (
post_title LIKE '%casino%'
OR post_title LIKE '%bet%'
OR post_title LIKE '%gambling%'
);

This allows you to verify which posts will be deleted before making permanent changes.

Change the Table Prefix If Needed

Many WordPress websites use a custom database prefix instead of wp_.

For example:

abc_posts
site_posts
wor670_posts

If your website uses a different prefix, replace every wp_ table in the query with your own prefix.

How to Run the Query

You can execute the SQL query using:

• phpMyAdmin
• Adminer
• MySQL Command Line
• Hosting control panel database manager

Paste the query into the SQL editor and execute it only after confirming your backup is complete.

Why This Query Is Better Than Deleting from the Dashboard

Deleting posts through the WordPress dashboard can be slow and may leave related database records behind, especially when dealing with thousands of infected posts.

This SQL query offers several advantages:

• Deletes thousands of posts in seconds
• Removes related post metadata
• Deletes taxonomy relationships
• Reduces database clutter
• Eliminates orphaned records
• Improves overall database cleanliness

Important Limitations

While this query removes spam posts, it does not remove the malware that created them.

If your website was hacked, you should also:

• Scan all WordPress files for malware.
• Remove malicious PHP files.
• Update WordPress, themes, and plugins.
• Change all passwords.
• Remove unauthorized administrator accounts.
• Install a trusted security plugin.
• Enable two-factor authentication.
• Review scheduled tasks and cron jobs.

Otherwise, the attacker may simply recreate the spam posts.

Frequently Asked Questions

Will this delete pages?

No. The query only targets records where post_type = 'post'.

Will categories and tags be deleted?

The categories themselves remain intact, but the relationships between the deleted posts and those categories or tags are removed.

Can I search for more keywords?

Yes. Simply add more OR post_title LIKE '%keyword%' conditions to the query.

Is this query safe?

Yes, provided you verify the matching posts first with a SELECT query and create a complete database backup before running the DELETE statement.

Final Thoughts

If your WordPress website has been flooded with spam articles, using a well-structured SQL query is one of the fastest and most efficient ways to clean up your database. The query above not only removes the unwanted posts but also deletes their associated metadata and taxonomy relationships, keeping your database clean and optimized.

However, remember that removing spam posts is only part of the recovery process. To fully secure your website, identify the source of the compromise, remove any malicious code, update all software, and strengthen your site’s security to prevent future attacks.