3

First, I wish you all a pleasant weekend.

I have a unique situation. My client's website was hacked before working with me, and now I'm trying to fix it to the best of my abilities.

We started working on 19th August 2023. The site was hacked around 15th June 2023, I believe. At least, that's what the data says.

The site is using WordPress. They used an unlicensed (you know what I mean) SEO plugin, and the hacker managed to create random files ending with .htm and .do, and submitted (somehow) 316,000 fake URLs to Google. I think they changed/edited the sitemap; that's how this must have happened.

Image: https://prnt.sc/a_BSYofISt5H

Not only that, but the hacker managed to change the canonical URL of entire pages. There are like 50,000 errors on GSC right now.

Now, I have fixed everything I can think of. The site is clean right now. Our next problem is to remove these submitted unreal/fake URLs. They are killing the entire SEO process, the site went from 400-500 hits a day to 50s... Most of the ranks are lost and most of the pages are gone from the results. The funny thing is Google indexed these fake URLs and allowed this. I can't share the website name because owner asked me not to.

It was 125,000 URLs added and 200,000 not added at first. I tried redirecting everything ending with a .htm and .do with a 301 to the homepage. This didn't do anything. As mentioned, it went up to 316,000 ULS in time.

Images:

The next step was disallowing .htm and .do files from the robots.txt file. And this didn't do anything either. Google was still indexing these fake/false pages.

The next step was another approach. I removed disallows from robots.txt and removed the 301 redirecting. I let crawlers get to those fake .htm and .do pages, resulting in a 404 page. Because they are fake, not present. The site contains only 475 real URLs. I also made .htm, and .do pages signal a 410 content deleted header.

Currently, all of the canonical problem is fixed. Google currently reads all of the real/existing URLs correctly. They were broken, too...

But fake URLs ending in .htm and .do are still at 312,000. I'm glad 4,000 got deleted after the 410 header, but what else can I do? Can you guide me here, guys?

Note: I deleted the unlicensed theme and all plugins, and did a full virus scan from cPanel and Imunify360. Also cleaned the database. I also didn't forget to check and clean the root folder. We have bought licensed theme and plugins. I even changed the server (hosting). Fixed all titles/headers/descriptions, and technical SEO aspects as well. Currently, I'm fixing the content one by one. I even fixed keyword canib. and duplicate content issues.

I asked some friends about this situation, but they told me to change the domain or start from scratch.

What else can I do? This is the first time I have seen this...

Kind regards.

2
  • What makes you so sure the hacker used a flaw in the SEO plugin? There have been a lot of major vulnerabilities found in a lot of legitimate plugins. (I am not saying that the SEO plugin is not the source - but I've seen a lot of compromises of licensed/blessed plugins then what you are calling unlickensed ones [ which are actually licensed and legal to use despite what some devs want you to believe - because of how the GPL license works ]. In fairness, I and my clients tend to avoid plugins from third party sites because its right to pay people for their work.
    – davidgo
    Nov 15, 2023 at 20:58

1 Answer 1

3

Here are some steps / guidance:

  1. The URLs must return a 404 or 410 status to clean up the site.
  2. Do not block the crawlers' access via Robots.txt
  3. Use different tools to scan and verify the site is clean.
  4. To expedite removal in Google, you can check use the Temporary Removal tool in Google Search Console.
  5. To expedite removal in Bing, you can use the Block URL feature in Webmasters tools.
  6. You can get more info on cleaning up / removing content from Google here: https://support.google.com/webmasters/answer/9689846?hl=en
  7. Check other steps to follow here: https://web.dev/articles/hacked

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.