My website was hacked: what I did, step by step

What happened

My website was a WordPress install with security and anti-spam plugins, and this is exactly what I do for a living. Even so, someone found a way in and used it for two things:

• Hidden links to casino websites in the footer of my pages, invisible to visitors but not to Google.
• Hundreds of spam pages created inside my domain, in folders I had never created. Some had names like other websites, to look legitimate.

The target wasn't my website as such, but the trust Google had in my domain, used to rank gambling pages. It is one of the most common attacks on WordPress.

You don't need to be a big company to be attacked. A WordPress install with something exploitable is enough.

How I found out

The website looked normal. The first clue was something else: my hosting server kept hitting 100% CPU and RAM usage for no apparent reason. While investigating what was causing it, I found the source: WordPress was serving hundreds of spam pages I hadn't created, and bots kept visiting them non-stop.

I then confirmed it on Google: searching for site:josecabello.net casino returned around 630 results with casino pages under my domain.

Search Console, Google's free tool for site owners, showed no security warnings or manual actions. That is why it is worth checking now and then which of your pages Google shows: the problem can be there even if nobody warns you.

If you want to know how to spot the signs of a hack, I explain it in my website has been hacked: what to do.

The decision: clean it or rebuild it

Cleaning a hacked WordPress site is possible, and I have done it many times for clients: reinstall the core, theme and plugins, review the database, change every password and close the door they came in through. But there is a risk: if a single back door remains, they come back.

Restoring a backup wasn't an option either. I did have backups, but the hack had been there for months without anyone noticing, so all of them were infected.

In my case, the website was mainly for presentation: my services, my projects and my articles. It didn't need a content management system. So I decided to rebuild it from scratch in HTML and CSS, with no WordPress, no plugins and no database. Without the software they had exploited, that way in disappeared too.

If you are torn between the two options, I cover it in WordPress pros and cons and what a CMS is and whether your business needs one.

What I did, step by step

1. I rebuilt the website in static HTML, first with the same design and then improving it, in Spanish, English and German, and published it in place of WordPress.
2. I deleted WordPress from the server completely, spam folders included. The hosting wasn't affected: only that installation.
3. I set up a new contact form without WordPress, with a secure sending service and spam protection, so as not to lose enquiries.
4. I made the spam pages respond “410, gone”. It tells Google those pages no longer exist and won't come back, so it removes them sooner than with a simple 404 error.
5. I asked Google to hide them right away: in Search Console, under Removals, I requested removal of each spam folder. They were approved the same day.
6. I redirected the old articles worth keeping to their new, rewritten versions, so as not to lose what already worked on Google.
7. I submitted the new sitemap to Search Console so Google would discover the new website.

The result

On the same day the removals were approved, the search site:josecabello.net casino went from around 630 results to 5, and those 5 were old pages that already responded as removed or redirected.

It is important to be honest about timings: a Search Console removal hides pages for a few months, and the 410 is what makes Google drop them for good as it recrawls them. That is why you need to keep checking the results over the following weeks until they reach zero.

I also took the opportunity to change strategy: instead of articles to add traffic, guides that answer what my clients ask. I explain it in the hard truth about SEO.

What I learned

• Security plugins help, but they don't make you bulletproof. I had them and they got in anyway. Security comes from fewer exposed parts, not from adding more.
• An overloaded server for no reason is a warning sign. If CPU or memory usage spikes and you have no extra visitors, investigate: it could be a hack.
• Check Google now and then. A site: search for your domain tells you more than many dashboards.
• A backup is no use if it is infected too. I had backups, but the infection had been there for months and every one of them carried it. Keep older backups for longer, outside the website, and don't rely only on the most recent one.
• Choose technology for what you need. For a presentation website, a static site is simpler to maintain and much harder to attack.
• Act quickly and methodically. The sooner the spam is removed, the less time Google associates your domain with it.

Common questions