7

I have a Wordpress website that is indexing some URLs on Google that seems like my website was hacked.

SERP

I've tried:

  1. Search my host for infected files and folders, but didn't find anything. Both manually and using Wordfence.
  2. I've installed a fresh Wordpress with a different theme and manually imported the content.
  3. I've tried to Remove the URL's in Google Search Console, and it kind of work, but it seems that whatever that is generating those URL's just creates a bunch more. Search Console
  4. And finally I did a 301 redirect in my .htaccess

Now I'm changing my host provider, but I'm afraid that it won't help.

Am I missing something?

P.S.: Those pages aren't indexed on other search engines, like Bing. P.S.2: I'm currently in a shared hosting enviroment with no SSH access.

Improve this question
9

I got the same problem once with a website with an old version of Joomla, the server was safe but the pages were generated by an hack on at PHP level that I was not able to discover fast.

In the end I preferred to delete DB and all files, recover from a valid backup and update everything to latest version.

After that I removed all bad URLs using Google removal tool in Google Search Console and resubmit the website to Google for a check of hacking.

Improve this answer
4

If Google is indexing these, it means they are resolving. Your domain is serving bad pages - possibly JUST to Search Engines if you've been hacked at the server level. They won't resolve or show up otherwise.

Changing host provider works - shift your content to a new server and these will begin to disappear.

To get them removed ASAP you'll want to use a URL removal tool. Gather all the bad URLs and use Google Search Console to submit them for removal.

Improve this answer
5
  • 3
    To get them removed ASAP you'll want to use a Disavow File. This sounds dangerous to me. This is not what the disavow file is intended for. Using the remove URL tool seems more appropriate.
    – closetnoc
    Mar 29 '17 at 18:39
  • 1
    I agree with closetnoc, disavow is for links to your site, not for pages on your site.
    – Stephen Ostermiller ♦
    Mar 29 '17 at 21:19
  • Call that a brain fart, it was the URL removal tool I had in mind. Edited.
    – L Martin
    Mar 30 '17 at 8:43
  • How do you remove 1500 wrong indices by hand? Impossible. I don't know how to tell them to remove them.
    – darkgaze
    Apr 11 '18 at 10:08
  • Add a noindex directive to the page. Next time they're scraped, they'll be dropped. It takes longer than a manual removal request but allows you to do it in bulk. You can also use a submitted sitemap to try and speed an update.
    – L Martin
    Apr 12 '18 at 10:24
1

You don't need to change host provider. The problem was/is within your own webpage. In some plugin or in theme. It was/is located somewhere in code.

So, if nothing was found, download your site locally and scan it with antivirus software. Then if nothing shows up, put site back online.

You don't need to do any redirects, it won't help. Basically there was/is an exploit in your page, and if wordfence didn't detect anything.

You just need to reindex your page with google and if everything is ok, that won't be happening anymore. Afterwards, put some security up and monitor your site for few weeks.

Improve this answer
0

Without knowing your FQDN or any extra info, it looks like they may have hacked your DNS (likely added a wildcard DNS entry for a subdomain, or just an A-record) and might be hosting the illegitimate content themselves.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.