Challenge
aqarland.net, a bilingual WordPress real estate platform, had been compromised since late July. The attacker served a gambling page to Googlebot (cloaking), got spam pages indexed and left several layers of persistence on the server, so the site kept getting re-infected. Organic traffic had dropped to around 20 clicks a day.
What I did
- First cleanup (Aug): removed 58 malicious files, including 20 web shells and 19 re-infection files in mu-plugins; repaired the cloaked index.php; deleted 2 planted admin accounts and cut administrators from 6 to 3; rotated salts; removed WP File Manager
- Search verification (16–17 Aug): confirmed Googlebot saw the real site, GSC showed no Manual Action or Security Issues, and spam URLs had left the index
- Follow-up (28 Sep): caught and removed a second-stage backdoor (a dropper in wp-config and an uploader in wp-includes)
- Containment (8 Oct): a Search Console alert about an unknown owner led to the attacker's remaining access. I removed the hidden theme backdoor, the scheduled re-infection task and unauthorized SSH keys, ended the attacker's sessions, blocked their IPs and removed the unauthorized Search Console owners
- Hardening: rotated server, database and WordPress credentials; enabled the firewall; closed FTP, unused services and external database access; blocked PHP execution in the uploads and theme folders
- Quarantined every malicious file with a rollback path for each step, and wrote the incident report for management
Search Consoleprev 28 days → last 28 days
Daily clicks~20 → 120+
Recovered within days of the August cleanup and held since (read from the daily chart)
8 Oct incidentContained same day
Spam reached Google on one URL for about 3.5 hours. The site stayed online, no content was lost and lead emails kept arriving normally.
