Help Recover Hacked Site with 1000's of Spam Pages Indexed

[vortex]

So I had severe medical issues the past 3 years and neglected my site, it got hit with that wordpress kind of hack where they make 91929312 pages on your site and spam it. I managed to deleted all the sites and im trying to get it out of the index. So far about 4k pages are removed but still 8k spam pages or something remaining - its dropping slowly.

My question is do you think this could be the reason my "new" posts - i made about 30-40 days ago are not yet ranking in google? They are indexed, but dont rank even though they are fairly easy and targeting KGR keywords. Seems like something is wrong with my site - maybe this is it and just patience is needed for google to deindex all those spam pages?

I removed the hack fully on the wordpress install, its gone, I saw your kitchensink post.

 

[Ryuzaki]

My question is do you think this could be the reason my "new" posts - i made about 30-40 days ago are not yet ranking in google? They are indexed, but dont rank even though they are fairly easy and targeting KGR keywords. Seems like something is wrong with my site - maybe this is it and just patience is needed for google to deindex all those spam pages?

I don't think that issue is related to what you're experiencing. The days of being indexed and starting to rank immediately are slowly leaving us. It's more and more rare for that to happen, unless you're a giant, trusted site. Even then every page has to become trusted too. I think the move is to hit publish and then not look at that new page's performance for 3 months. That keeps your mind in the mode of always planting seeds rather than stopping and making sure each seed starts growing. Just keep planting. People do this with links, too, and gone are the days of links always providing a reaction immediately. 3 months is a good bare minimum before you start to worry about it.

You can help remove those hacked pages by making them show a 410 error instead of 404. But even with a 404 error, a good move is to use Search Console's Coverage Report to gather up all those remaining URLs in the index and shoving them in a new XML sitemap (search "generate XML sitemap" to find easy tools to do this).

You can then upload that sitemap for a month, which prompts Google to crawl those pages. They'll drop a good half of them in about a month. Then you can repeat the process with the remaining URLs. In about 6 months you'll have the number of indexed pages very low, then just let the rest get gone naturally.

 

[vortex]

Can someone tell me what happened here? Background: I got sick with lyme disease and was nearly bedridden for 3 years. This is one big contributing factor, I could barely work on the site. But I have a feeling there is more going on, could I have been hit by the Product Review update?

I want to get my site back to where it was at 1500pageviews/day - or even more - but it seems like the site is stuck now. Published 30-40 new blog posts about 1.5 months ago, nothing so far. I did a technical audit and removed some spam pages someone created from my site and from the index. I have a feeling there is something algorithmic going on like too much commercial content. I may push the informational ratio up now by publishing more info content and hope the site recovers. @Ryuzaki

 

[ToffeeLa]

I did a technical audit and removed some spam pages someone created from my site and from the index.

You are possibly skating over this potentially crucial fact a bit too blithely - as if now you have sorted it out it should never affect the domain any more. Did your site get hacked? What was the spam? And how bad were any links coming into those pages and/or leaving those pages?

 

[vortex]

You are possibly skating over this potentially crucial fact a bit too blithely - as if now you have sorted it out it should never affect the domain any more. Did your site get hacked? What was the spam? And how bad were any links coming into those pages and/or leaving those pages?

Yes, it was very bad - in fact someone created thousands of spam pages that got index. Im in the process of deinxeding them - around 50% removed so far. Site got hacked and I removed it from the folder.

I'm trying to figure out whats wrong with my site - I have a second site and new posts usually rank within 3 days after I post. Something seems really wrong with my site

 

[ToffeeLa]

Yes, it was very bad - in fact someone created thousands of spam pages that got index. Im in the process of deinxeding them - around 50% removed so far. Site got hacked and I removed it from the folder.

The problem here is that you are looking at recent updates and events and comparing your hacked site with a 'normal' site that you have when the fact that it was hacked and thousands of spam pages were created is a far more likely cause for your site's problems.

Depending on the degree of darkness of the 'spam' - could be anywhere from simple affiliate links through to trojan installation and identity theft or far more illegal stuff - your domain may be screwed because it has a big black mark against it.

(Why would Google or other search engines place that black mark? In the worst case, you were knowingly complicit in those links. At the best you are a webmaster who allowed a site to be hacked and thousands of spam pages to be indexed.)

It is possible to recover a hacked site in search engines but (in my experience) it takes time and sometimes it just doesn't work and you need to put the content on a new domain.

 

[vortex]

The problem here is that you are looking at recent updates and events and comparing your hacked site with a 'normal' site that you have when the fact that it was hacked and thousands of spam pages were created is a far more likely cause for your site's problems.
Depending on the degree of darkness of the 'spam' - could be anywhere from simple affiliate links through to trojan installation and identity theft or far more illegal stuff - your domain may be screwed because it has a big black mark against it.
(Why would Google or other search engines place that black mark? In the worst case, you were knowingly complicit in those links. At the best you are a webmaster who allowed a site to be hacked and thousands of spam pages to be indexed.)
It is possible to recover a hacked site in search engines but (in my experience) it takes time and sometimes it just doesn't work and you need to put the content on a new domain.

I know this sucks big time, someone created basically 10 000 spam pages which all got indexed. Im now in the process of removing all those from the index (theyre removed from the site already), and hoping the site jumps back. So far it seems my traffic is sloowly going up the last months, so I guess thats a good sign, but i dont know if it can fully recover. I think it will take more time until all the spam pages are deinxed. Someone told me to wait for a new google update in which those pages will get recrawled and removed.

Edit: This is my organic traffic:

 

[ToffeeLa]

It would be more interesting and perhaps more revealing to see your traffic numbers pre- and post-hack.

In general, it looks like your numbers were something like 300-400 a day in 2020/21 (?) after your illness so that's probably the practical number you should be attempting to see if it is still possible first.

 

[vortex]

It would be more interesting and perhaps more revealing to see your traffic numbers pre- and post-hack.

In general, it looks like your numbers were something like 300-400 a day in 2020/21 (?) after your illness so that's probably the practical number you should be attempting to see if it is still possible first.

Peak was 1500 per day. Agree, I will try my best to get the site to 300-400 a day as first milestone. Im updating old content, building links to it, and making new blog posts (these dont really rank unfortunately) - I hope with the next google update my site gets recrawled and those spam pages drop further from the index.

 

[Ryuzaki]

When was the site hacked? How long were the spam pages sitting in the index?

The site is recoverable but we need to know ALL of the details to give you informed opinions here. Before I moved all these posts to their own thread, I did provide guidance on how to get the spam out of the index, which is now the 2nd post in this thread. It works if you stay on top of it.

You see how the traffic drops around April 2019, then again sharply around February 2020? I'm not looking at a list of updates but I can almost guarantee those are core updates. The first one was a shot across the bow, warning you to get it together. You didn't so you took another hit in the next related update.

If they were core updates, we can't tell you what the problem was. It could be Panda from having the spam pages indexed, it could be Penguin with bad links, it could be mobile responsiveness and core web vitals related. There's not really any point in trying to find the exact problem if it's not super obvious like the spam pages. It's better to clean up the whole site. I've created a lot of guidance you can work through if you want to get real serious about it.

Someone told me to wait for a new google update in which those pages will get recrawled and removed.

This is incorrect. Follow the coverage report and sitemap advice I mentioned above to get the pages out of the index. Google doesn't only crawl during updates, they're constantly crawling. And if you wait till an update in hopes of those pages being deindexed, even if they magically did get deindexed during the update, you'll have to wait another 6 months or more for the next update before the penalty is lifted.

They collect data BEFORE they use them in the updates. You need to have this problem solved months before the next update that deals with it so that new data is calculated and used in the coming update. If you miss that window of time, you'll be waiting another giant block of time.

Peak was 1500 per day. Agree, I will try my best to get the site to 300-400 a day as first milestone. Im updating old content, building links to it, and making new blog posts (these dont really rank unfortunately) - I hope with the next google update my site gets recrawled and those spam pages drop further from the index.

I can tell you with full certainty that you have bigger problems and doing routine SEO tasks won't solve them, as you've discovered. New posts, updated posts, and more links aren't going to fix this algorithmic penalty. What will fix it is solving the hidden problem that you may or may not be aware of. It could be the spammed pages in the index, depending on how long they've been live. No amount of new content and links will make those go away or convince Google to ignore them. It has to be solved, and whatever other problems you have going on, before you're going to get the results you want.

 

[vortex]

When was the site hacked? How long were the spam pages sitting in the index?

The site is recoverable but we need to know ALL of the details to give you informed opinions here. Before I moved all these posts to their own thread, I did provide guidance on how to get the spam out of the index, which is now the 2nd post in this thread. It works if you stay on top of it.


You see how the traffic drops around April 2019, then again sharply around February 2020? I'm not looking at a list of updates but I can almost guarantee those are core updates. The first one was a shot across the bow, warning you to get it together. You didn't so you took another hit in the next related update.

If they were core updates, we can't tell you what the problem was. It could be Panda from having the spam pages indexed, it could be Penguin with bad links, it could be mobile responsiveness and core web vitals related. There's not really any point in trying to find the exact problem if it's not super obvious like the spam pages. It's better to clean up the whole site. I've created a lot of guidance you can work through if you want to get real serious about it.


This is incorrect. Follow the coverage report and sitemap advice I mentioned above to get the pages out of the index. Google doesn't only crawl during updates, they're constantly crawling. And if you wait till an update in hopes of those pages being deindexed, even if they magically did get deindexed during the update, you'll have to wait another 6 months or more for the next update before the penalty is lifted.

They collect data BEFORE they use them in the updates. You need to have this problem solved months before the next update that deals with it so that new data is calculated and used in the coming update. If you miss that window of time, you'll be waiting another giant block of time.


I can tell you with full certainty that you have bigger problems and doing routine SEO tasks won't solve them, as you've discovered. New posts, updated posts, and more links aren't going to fix this algorithmic penalty. What will fix it is solving the hidden problem that you may or may not be aware of. It could be the spammed pages in the index, depending on how long they've been live. No amount of new content and links will make those go away or convince Google to ignore them. It has to be solved, and whatever other problems you have going on, before you're going to get the results you want.

Thanks I needed a reality check.

Im working hard to deindex all these pages.

My site only has ~90 pages /posts so theres still around 6k spam pages indexed in google. @Ryuzaki

Honestly I dont remember when the site was hacked, i have barely any recollection of the last years because lyme and brain inflammation.

 

[Ryuzaki]

Honestly I dont remember when the site was hacked, i have barely any recollection of the last years because lyme and brain inflammation.

Sounds like it's been a year or more. If you're diligent about getting them removed (just staying on top of the sitemap method every few weeks) you should be able to recover. It won't be immediate but at some point you'll cross the threshold where you have so few of these pages left in the index that they "release" your site again in the next related update.

I'd go ahead and give the site a look at everything in the Kitchen Sink post I linked above, just to give it a good once-over, then you'll know you're in good shape and just waiting to clean up the indexation, which will largely be a waiting game. In that case, if you do intend on continuing with this site, resuming regular activities isn't a bad idea, so you aren't losing more time. Is there a risk to sinking time into it and having it not recover? It's possible. Just depends on what your goals for this site are. I know you can recover from stuff like this, as I've done it. Keep your head up!

 

[vortex]

Sounds like it's been a year or more. If you're diligent about getting them removed (just staying on top of the sitemap method every few weeks) you should be able to recover. It won't be immediate but at some point you'll cross the threshold where you have so few of these pages left in the index that they "release" your site again in the next related update.

I'd go ahead and give the site a look at everything in the Kitchen Sink post I linked above, just to give it a good once-over, then you'll know you're in good shape and just waiting to clean up the indexation, which will largely be a waiting game. In that case, if you do intend on continuing with this site, resuming regular activities isn't a bad idea, so you aren't losing more time. Is there a risk to sinking time into it and having it not recover? It's possible. Just depends on what your goals for this site are. I know you can recover from stuff like this, as I've done it. Keep your head up!

Thanks, at this point I'm hoping it will recover - I already invested in Links and content. Im also getting a second project started now though as this is my only site. Any idea when such update will come? Are these Google Core updates?

 

[Ryuzaki]

Any idea when such update will come? Are these Google Core updates?

Nobody knows when the updates will come but a safe bet based on historical averages (in my opinion, as they don't say anymore) would be every 6 months.

You're looking at a Panda issue, and those are supposed to be "everflux" meaning they're in the live algorithm and always being calculated. That may be true, but the resulting data from those calculations only seem to be rolled out during "core updates". So maybe the Panda algo (which is no longer announced as an update) is running all the time but the results only show during announced core updates.

 

[vortex]

update: 4000 Sites still in Index, I have about 99 posts

So its still alot of spam, hope the decrease will finally be picked up by google and my site starts ranking again.

 

[vortex]

Update: Site is still not ranking even with the spam removed and deindexed. im giving it a bit more time but thinking about moving the 50 or so articles I newly added over to a new domain

on old site, they barely any of the new articles shows up on the serps

I just copied a few to my new site and made a 301 redirect for each of them

Now they start to rank in the top 100, some of them are already top 10 even, this seems to work

I don't plan on migrating the whole site, just the 50 or so posts I newly added which dont rank

@Ryuzaki

 

[Ryuzaki]

About a month ago you had 4,000 spam pages still in the index. How many are there now? Because compared to your 99 posts, it could still be a pretty high ratio.

Also, on September the 6th you had 8k pages. But you started with 12k, with my point being that even if you got every single one of those 12k pages out of the index by September 6th, not enough time has passed. You're waiting on a Panda update, in my opinion, and that hasn't happened yet. And you'll need all that crap out of the index not just before the update, but well enough ahead of the update that the data they calculate on shows that the spam is gone. Just keep working on getting the spam out of the index is all you can do in that regard and wait.

301 redirecting the problematic articles over to the new site might possibly transfer the problem over to the new site. We used to do this back in the day when a site would tank from link spam so Google got wise to what was going on and started basically canonicalizing the two sites together and passing over the penalties.

The conundrum is the Panda problem is a sitewide penalty as you've seen, but you're only talking about moving 50 posts. You're calling them newly added, in which case I wouldn't do any redirects. I'd just move them over, if you're planning on doing that. That could work, possibly even with the 301 redirects, but it sounds like they probably don't have backlinks, being new, so I don't see the point in using redirects at all.

But regarding the core problem on the old site, I think the plan remains the same. Keep getting the posts out of the index and wait for the Panda refresh. They say Panda is ever-flux, meaning it's always running, but that's a crock of bologna, at least in this respect.