Hacked Site Recovery

Pride Ceilings and Drywall,  a live site compromised by a rogue admin, 3,450 spam pages injected into Google, and a full forensic cleanup completed in under two hours.

 

Solved
< 0 Hrs
Spam Pages Injected
0 +

Incident Summary

The client had been receiving repeated emails from Google Search Console warning about pages on his site that weren’t being indexed. His site only has 4 pages, so there should have been nothing to report. When the GSC account was checked, the full picture emerged: the site had been compromised, a rogue admin user had inserted malware, and thousands of Japanese spam product pages had been injected into the site and indexed by Google under the client’s domain. The attack was actively destroying the site’s SEO and could not be resolved through the wp-admin dashboard, which had been locked out by the attacker.

The Challenge: "GSC Email Breach"

Client flagged repeated Google Search Console warnings:
  • The client had been receiving GSC notification emails about pages on his site that were not being indexed. He had contacted me repeatedly about these, not understanding what they meant. A 4-page business website should not be generating indexing errors, this was the first indicator that something was seriously wrong.
Google search confirmed the spam injection in full:
  • Running a site:prideceilingsdrywall.co.za search on Google revealed everything. Alongside the 4 legitimate business pages, the results were filled with spam product listings in Japanese, Canon laser printers, Nike trainers, and Japanese retail products, all appearing to be hosted on the client’s domain. Google had already crawled and indexed hundreds of these pages, which was actively poisoning the site’s SEO profile.

 
 

Remidiation - Cleaning the site, the database, and Google

  • WordPress core forcibly re-downloaded and reinstalled.
  • With the core files verified as compromised, the only correct response was to replace them entirely. The --force flag overwrites all core files with clean copies from the official WordPress repository, while --skip-content leaves themes, plugins, and uploads untouched
     
  • Malware files in the root folder manually deleted
  • The injected files identified by the checksum verification — including rogue index.php files, unknown .htaccess entries, and fabricated directory structures — were located and deleted from the server root. These were the files responsible for generating the thousands of spam product URLs that had been served to Google’s crawler.
     
  • Security keys reshuffled to invalidate any active attacker sessions
  • Even with the rogue accounts removed and core files replaced, the attacker may have still held valid session cookies. Reshuffling the WordPress secret keys and salts immediately invalidates all active sessions — including any the attacker might still have open — and forces all users to re-authenticate:
     
  • MySQL database repaired to remove any injected spam links
  • The database was inspected and repaired to ensure no spam links or malicious redirects had been inserted into the database itself — a common secondary injection point in this type of attack. Database transients (cached query results) and accumulated post revisions were also cleared to ensure no residual spam data remained in the tables.
  • Google Search Console — spam URLs removed and clean sitemap resubmitted ⭐

  • Cleaning the server was only half the job. The thousands of spam pages that Google had already crawled and indexed under the client’s domain still existed in Google’s index, and would continue to damage the site’s SEO rankings until they were removed. Two actions were taken in GSC:

    __________________
    1.
    A URL removal request was submitted for the entire /items/ path prefix — removing all URLs with that prefix from Google Search for six months, giving the legitimate site time to recover its correct index state.
  •  

    2.

    The clean XML sitemap (containing only the 4 legitimate pages) was resubmitted to GSC, signalling to Google exactly what the site should contain and prompting a re-crawl against the clean state.

Locking the site down against re-entry

  • 2FA enabled on all accounts: Two-factor authentication was activated for all WordPress user accounts. Even if credentials are compromised in future, the attacker cannot log in without the second factor.
  • Login attempts limited Brute-force login protection was configured to limit and lock out failed login attempts. This closes the most common vector for credential attacks against WordPress admin accounts.
  • All passwords changed Every user account password was reset to a strong, unique credential. With salts reshuffled and passwords changed, any previously stolen session data or credentials is completely invalidated.
  • Full security scan performed A complete security scan was run post-cleanup to confirm no residual malware, backdoors, or injected files remained anywhere in the installation — themes, plugins, uploads, or root.

Key Takeaways

  • Why hardening after a hack is non-negotiable:

    Cleaning malware without hardening the site is like fixing a broken lock and leaving the key in the door. Attackers often leave backdoors — hidden access points that allow re-entry even after the visible malware is removed. The hardening steps taken here close the primary re-entry vectors: credential reuse, brute-force login, and active sessions from stolen cookies.

Similar Posts