A business website showing someone else’s content
A UK service business came to us with a compromised WordPress website. Visitors were experiencing unwanted redirects, and Google was displaying unrelated Japanese product listings under the business’s domain.
The first job was to regain control and deal with the compromise. Improving the website came afterwards. This case study explains the recovery work, the search problems we addressed and the practical improvements that followed.
The client name, domain and identifying business details have been withheld. The search-result image has been edited to obscure the name and URL; the Search Console images are cropped extracts.
Establishing what had happened
We reviewed the WordPress installation, hosting files and database, preserving backups before making destructive changes. The recovery work covered suspicious files, injected content, unauthorised accounts and potentially unsafe plugins. Administrator access was restored while legitimate access was retained, and Wordfence supported the security audit.
Evidence in a backup identified WP2Shell activity, confirming that the site had been compromised. That finding did not prove how the attacker originally got in. The available historical server logs were not sufficient to attribute the initial breach to a particular plugin.
That distinction matters. A useful recovery report should explain what the evidence establishes and where the investigation cannot give a definite answer.
Addressing the damage in Google
The incident affected more than the pages visitors could see on the website. Unwanted URLs had also become part of Google’s view of the domain. We worked through Search Console verification and access, and submitted removal requests for indexed spam.
One important problem was how the website responded when an unwanted URL was requested. Some spam URLs returned a successful page response, even though that content should no longer have existed. We addressed this behaviour so removed spam could return the appropriate 404 or 410 response, indicating that the page was not found or was gone.
We also reviewed crawling restrictions as part of the cleanup, so Google could revisit removed URLs and see their updated status. Removing the malicious content, correcting the responses and dealing with search results were separate parts of the work.
Removal requests were not treated as a substitute for fixing the website. Search recovery still depended on Google recrawling and processing the changes.
Reading the indexing evidence accurately
The supplied Search Console capture recorded 177K pages not indexed and 187 indexed. The detailed table included 176,144 URLs listed as discovered but currently not indexed, and 385 listed as crawled but currently not indexed.
These are indexing-status figures. They do not mean that 177,000 spam pages were appearing in Google, and they do not establish that every excluded URL was malicious. They show the scale of the URL inventory being reported at that point.
Making the recovered website more useful
After the immediate recovery work, the project expanded into improvements to the site’s structure, content and usability. The aim was to give the business a website that was easier for customers to use and easier for its owner to maintain.
- Clearer services and navigation. Dedicated service pages explained the work, answered common questions and provided consistent routes to make an enquiry.
- Useful coverage information. Distinct local pages and an areas-covered section helped visitors find relevant information.
- Editable WordPress content. Custom fields separated everyday content changes from the theme code. A testimonials library allowed each page to select and order appropriate reviews.
- A better mobile layout. Larger text, clearer navigation, more compact calls to action and improved image ordering addressed practical browsing problems. A delayed heading reveal was removed.
- Stronger business information. Contact details, company information and customer-facing terms were made more consistent and accessible.
- Improved image handling. Meaningful alternative text, responsive images and more suitable sizing supported usability and the site’s technical foundations.
What the work achieved
The project moved from urgent hack recovery into a more usable, manageable WordPress website. Control was restored, the identified search-spam response problems were addressed, and the business gained clearer service content, more consistent contact routes and improved mobile presentation.
The website changes were in place at the time of writing. Their effect on search visibility, enquiries and bookings had not yet been established, so this case study does not claim a traffic increase or a commercial return.
The original entry point also remained unconfirmed. Recovery is not a promise that a site can never be compromised again. Reviewing access, keeping components maintained and checking backups remain important parts of WordPress security and aftercare.
The lesson from this recovery
A hacked website can look normal again while unwanted URLs and search results still need attention. In this project, recovery meant working through the installation, access and search behaviour, then making the website easier to maintain.
If your website is redirecting visitors or showing search results you did not create, describe the symptoms rather than trying to diagnose the attack yourself. Our WordPress recovery service starts by establishing what can be investigated and agreeing the next step.