0

My WordPress website was hacked. I had built a drupal website on the same server without security and they took out all the websites on my server.

I found out all this happened when google ads pulled my ads because my website had malware. I looked over the website and found that my /post-sitemap.xml page was flooded with urls that contained malware. For example: https://example.com/2oLKWmhnU

I went in and removed the malware and it kept sneaking back in, so I deleted the entire website and the SQL server and rebuilt the website from scratch.

I then resubmitted the sitemap with a single url on it to google search console. Google has added about 400 of these malware urls that are 404ing now. When I inspect them they show that they are referred from https://example.com/post-sitemap.xml. I searched Google's scan of the page and found that their version of the page failed to scan properly last time and had an error so I scanned it again and submitted it for indexing. It appears that it is successful this time.

The issue appears to be that updating the page with all the malware links and repeatedly submitting it to google has had no effect and google continues to index these pages that at one time had malware that are now 404ing. I don't seem to be able to get google to scan the new site map.

Here is the list of malware urls, mixed in with the pages I still have to rebuild Malware Urls being reffered from sitemap Here is the inspection of the page showing that google is still using the old version of the posts sitemap. Sitemap that's been fixed is still the source of new malware urls Here is google showing that it knows the posts sitemap only has one url on it. Posts Sitemap Only Has One Url I tried deleting the sitemap and resubmitting it.

Today, I've manually reasked google to scan the sitemap and it appears to have scanned it. I've done this a few times before. Resubmitted sitemap

The only other thing I can think of is perhaps the malware is switching the sitemap to include the bad urls and then switching it back. My hosting provider assured me that they deleted everything though and nothing remained. I can think of no way for malware to get back into the website currently as I have it extremely locked down.

Do you think this could be malware flipping the sitemap back and forth? How could I detect this?

Could google be refusing to view the new sitemap because of the malware in the past? Could this be an active bug with google where it keeps accessing the old sitemap with the malware urls despite the fact a new sitemap has been put in it's place at the new url?

Update: Google won't take the new updated posts page and has listed it under crawled but currently not indexed. I updated the posts page to remove all the malware links that google had indexed when my site was taken over by malware. Currently Google has over 500 pages in 404 not found and in crawled currently not indexed that originated from that sitemap. I have been submitting the /post-sitemap.xml page repeatedly trying to get google to crawl it again to index the new links, and they've placed it into crawled not indexed. In the meantime my traffic has dropped to zero because they website's quality is seen as low due to all the 404s and the crawled but not indexed pages.

Is there some way to reach out to google to ask them to crawl that sitemap page to fix all of the other issues?

I cleaned the malware off of the website by rebuilding it from scratch. Next I tried resubmitting the new post sitemap that was cleaned off, but google put it under crawled and not indexed.

Then I tried to submit the 404s as fixed because most of the 404s are from sitemaps that no longer refer to those pages, but the fix failed for an unknown reason. I also tried to submit the crawled but not indexed into it so they would hopefully see that the malware pages are no longer linked from anywhere or referred from anywhere, but google decided to fail it and none of these pages were removed.

I noticed that on the 21st of June, there is a new 404ing page supposedly linked from the /posts page, which has only 1 link on it. This /posts page was supposedly scanned by google, but the scanned copy shows just 1 link to a test page on it. I also went into the FTP to check if the sitemap was edited and the last time was may 27th. I cannot get google to scan the new sitemap no matter how many times I suggest it and it keeps adding 404ed pages that are not linked to anywhere on the site or sitemaps. It will not remove the malware pages removed from the sitemap either. I am very frustrated. No amount of sitemap submissions or error fixed submissions seems to get google to realize the issue is fixed.Post sitemap last edited on may 27th Google Claims To Have Crawled The Page With Just 1 Link On It Malware Link Shows Up When It Isn't Present On Sitemap.

4
  • 1
    Not my area of expertise, but I'm pretty sure the keywords to look up are "deindex pages" - I believe you can create a list of URL's you want to remove and you can upload that list.
    – davidgo
    Commented May 30 at 4:18
  • I have submitted them for deindexing, but the problem is the old scan of the sitemap continues to refer an endless amount of pages for submission that subsequently 404. This effects my overall site quality score. It's like playing whack a mole in a giant field of moles. Commented May 30 at 4:25
  • What do you mean by "overall site quality score"? Commented May 30 at 7:08
  • The overall score of the website from a value perspective to google. Commented May 30 at 20:06

1 Answer 1

0

I may be missing something, but I don't see any unexpected behavior here. The malware created those pages and then Google indexed them. Then, you removed the malware. Naturally, Google re-crawls the pages as it does for every page in its search index. It found them to be 404, which is the first step towards removing them from the index. After Google performs repeat crawls of the 404 URLs a few times (to confirm they are actually permanently removed), then they will naturally drop out of the index.

Davidgo is on the right track about expedited removals, however Google's removals tool that I am aware about only supports URL entry one by one as far as I know. So it might not be particularly useful for expediting the deindexing of 400 URLs.

The easiest way to get these paths deindexed is to ensure that every malware path does properly return a 404, then simply wait. If a page is 404, Google usually removes it from their search index within a matter of weeks. Importantly, you shouldn't need to wait for the Google index to catch up before Google is able to see that you've removed the malware so you can reinstate your ads.

Ensure your old sitemap is not accessible to Google anymore, and then Google will finish updating that soon too. Google's indexing process is a slow, lumbering one, at least for small independent sites, so it's normal for it to look like nothing is happening for many days and then boom, one day Google suddenly does the deindexing and none of the 404 URLs will appear in search anymore.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.