There May Be Dogs About: How I Restored My Hacked WordPress Site & Recovered Its SEO Value
By Ethan Lazuk
Last updated:
What should you do when your WordPress website gets hacked?
The truth is, there isn’t a definite answer.
Every situation is unique.
So while I can’t tell you exactly how to handle your WordPress site being hacked, I can tell you about my experience and how I handled it.
Hopefully, some of the lessons I learned, and steps I took, will be beneficial for you, as well.
Here’s an overview of what I’ll talk about:
- History of my personal website
- How my site got hacked
- How I recovered my site
- How it’s performing today
- What other resources say
- Takeaway
While this case study is about recovering my website’s content, a big part is also about restoring the site’s SEO value.
That said, let’s set the stage for this conversation …
The history of my personal website, ethanlazuk.com
To understand my website’s history, it helps to know about my personal journey working in SEO.
I started doing SEO in 2015.
Before then, I was a grant writer for a nonprofit organization called Goodwill Industries based in Fort Myers, Florida. Even earlier still, I studied cultural anthropology and Islamic studies as an undergrad in college. Back then, I thought I’d end up working in politics or international relations. I didn’t anticipate becoming an SEO one day. Yet, I couldn’t be happier. 😉
From 2015 to 2019, I was involved in SEO work largely as a content specialist. This role consisted of writing all sorts of webpage and blog content, as well as optimizing title tags, image alt text, and other miscellaneous website text. But, I also did a fair bit of technical work.
In my first role as a content specialist, for example, I often hand coded the webpages for my content using HTML and CSS. In future content roles, I published webpages in custom CMSs by creating unique layouts using Bootstrap, inline styling, and image editors.
Of course, this involved a fair bit of on-page SEO work as well, including everything from optimizing internal linking to heading wording and hierarchies.
I had some professional sidesteps along the way, as I’ll call them, including short stints working at a public relations firm outside of Washington, D.C. and signing up for AmeriCorps to live in a shelter for people impacted by homelessness run by an organization in Key West, Florida (both pre- and post-Hurricane Irma).
But “SEO content” was my primary focus professionally. By 2019, I was working at a small digital agency in Gainesville, Florida, yet because I was doing more technical and on-page SEO work than I was creating content, I decided to change roles (and agencies) to become an SEO strategist. I haven’t looked back since.
But what I want to talk about is the year 2016, early in my career. That’s when I was first learning how to code webpages in HTML and CSS (and a little JavaScript). To grow those skills and put them to more creative uses, I built a personal website. “Built” being the operative word.
A developer I worked with told me about this company called A Small Orange.
I registered the domain ethanlazuk.com and then proceeded to host a website with them.
That website I built straight up using HTML and CSS files that I hand-coded in a text editor. It was a very plain design, with just two pages, a few colors, and an image. But it was mine. 🙂
A little later on, I created a WordPress website on the same domain. Really, it was more of a blog than a website. The domain was still registered with A Small Orange, but I hosted the site with WordPress.com.
The website’s content was mostly copies of my academic papers that I’d turned into blog posts. At the time, I was a part-time grad student in the American Government department at Johns Hopkins University, as well as working as a content specialist in digital agencies.
I believe the homepage’s hero image was Abraham Lincoln. That was the vibe.
My graduate thesis, or at least the final version of it, was about the intersection of political campaigns and digital marketing. However, shortly after I became a dedicated SEO strategist in 2019, I dropped out of grad school to focus more on SEO. It had become my passion, and I needed all of my brain power to learn and get better at it.
A lot of how I got my SEO knowledge, especially in the early years, was by following people on Twitter (now X) and reading the articles or tidbits they shared. (That’s why I created Hamsterdam, because if I learned SEO that way, maybe others could too.)
Another way I got better at SEO, though, was by trying new things on my website. I translated my old about page into Spanish, for example, so that I could learn how to implement hreflang.
Then around 2020, I think it was, I decided to make ethanlazuk.com a real SEO website. It was still hosted on WordPress.com, but I changed the theme and added new content, mainly blog articles about generic SEO topics.
At the time, I was an agency-side SEO exclusively, so my website wasn’t to promote myself or any services, but rather to learn new skills.
Design-wise, it got a few upgrades over the years, eventually taking on this theme:
Then getting a few more upgrades of its content and menu to look closer to this:
I created a handful of blog posts overall, including a couple where I got creative — a harbinger of my blogging style today — but nothing that got any significant traffic.
Outside of one blog article about Microsoft Clarity (which I’ve since updated), most of the traffic was from navigational searches that led to my about page.
To give you a sense of how inactive this website was, here’s a screenshot of my Google Search Console performance report data for a 6-month period from late 2022 to early 2023:
That 2-3 click per month average represents about how much organic traffic my website got most of the time.
So, when I saw on Twitter that an SEO who I followed was starting a managed WordPress hosting company and looking for beta customers to sign up, I volunteered and became an early client.
Me joining was mostly a way to experience the process of transferring a website’s hosting firsthand. Since I got into SEO as a content specialist, website hosting and site migrations (from the backend) weren’t familiar territory to me.
As expected, I botched the migration of my site files to this new hosting environment trying to do it all myself.
It wasn’t that big of a deal, though, because my site wasn’t hugely important to me at the time. It was more of a testing ground. This was just another test. 😉
Nevertheless, the person who runs the hosting company came to the rescue and rebuilt as much of my site’s content and design as possible.
I left the company a 5-star review on their Google Business Profile (then probably still called Google My Business) as a result.
That all happened sometime in early 2021, I believe.
Then for the next two years or so, this company hosted my website for free. They also updated my plugins and WordPress versions regularly.
I was super grateful.
I offered to pay for their hosting services early on. I also made sure my payment information on file was up to date, just in case they wanted to charge me.
I had no qualms about paying for hosting services.
Aside from a few emails while transferring my site to this company and receiving their help, we never really spoke.
I also didn’t touch my website for a while after it was transferred. Then in early 2023, I decided that I wanted to add a webpage about free SEO consulting for nonprofit organizations.
By this point, I’d been working in SEO for around 7+ years, and I was ready to offer help privately. I’d worked with plenty of colleagues who had their own clients, yet here I was, their manager, giving them guidance every day, and I’d never offered SEO services to non-agency clients. So, I figured doing it for free for charitable organizations (and later artists and musicians) would be a good start. This later grew into a full range of consulting services, and a company to boot, but I digress. 🙂
When I tried to log into my WordPress site (for the first time in a while) to add this new nonprofit services page, I wasn’t able to access the login page.
I opened a support ticket with the managed WordPress hosting company I was using. Heard nothing back, and nothing with the site changed for about 2-3 weeks. Then one day, the login page was fixed. I never got an email notification.
That may have been my fault, because my primary email on file with them was from an old job at Bayshore Solutions, an agency that no longer exists (regrettably). I added a secondary email, tried to update my primary one, and I think I even submitted a support ticket about it.
Anyway, I took it as a bad sign that this hosting company took 2-3 weeks to fix my site’s login page, and didn’t bother to email me about it.
That was my first mistake.
I should have said, “thanks for the help,” and changed hosting providers. I should have trusted my gut.
One of the reasons I didn’t is because my website, as you saw earlier, was only getting like 2 or 3 clicks per month. It wasn’t a priority.
But then things changed …
In April of 2023, I started The Twitter Files. This was a series of weekly blog posts with my liked Tweets about SEO.
The project eventually grew into Hamsterdam weekly SEO news recaps, which before the hack was starting to rank as a top result for “weekly SEO news”:
Well guess what? The Hamsterdam newsletter is officially back!
Feel free to sign up. 😉
Also around this time, I had updated my homepage to say that I planned to start writing blog articles again and included information about consulting services.
One of the first original blog articles I published in a while was in July 2023 about Google rankings volatility. In November and December of 2023, I updated that article again, in light of insights from the September 2023 helpful content update and subsequent core updates. It’s now one of my favorites.
I also created an article about this idea for a framework called 11x content for SEO, which then led to a guide to creating helpful, reliable, people-first content, which then led to a guide on people-first SEO.
In between, I had published other articles plus 36 weeks of Hamsterdam recaps.
Suffice to say, my site had grown in importance to me.
I was on a roll with writing.
As a result, traffic was picking up.
My site got hacked on December 23rd, 2023.
Here’s how my Google Search Console performance report data looked in the 6 months prior:
Bear in mind, the first 6-month screenshot I included showed 15 clicks. This one shows 574 clicks.
Looking at the last 16 months, though, I think you can really get a sense for the site’s trajectory (including its recent growth and fall to 0 clicks at the end):
Considering that by January 1st, 2024, my site’s Google Search traffic had fallen to 0, and my content wasn’t available for 10+ days from December 23rd to January 2nd, this email update I got from Google Search Console about its December 2023 performance is pretty impressive:
Those 233 clicks equal about one-third of the site’s total Google Search traffic from the last 16 months in just the last month!
And that’s not including the visits I was getting from Google Discover, my Hamsterdam email newsletter (which I recently restored), and other referral channels, like social media.
The sad part is that 233 number likely would have been even better …
But, it turned out ok. 🙂
Alas, now that you have a little back story on ethanlazuk.com, I’ll get into the details of the website hack, the SEO impact, along with the steps I took and how the site is performing today.
How my site got hacked, and what it was like
On Friday, December 22nd, 2023, I was putting the finishing touches on my latest blog article. Throughout the month of December, I had been putting in work daily on my site, both on the weekends and evenings.
The next day, Saturday, December 23rd, my wife and I went to the park near our apartment (Lake Eola) to take some holiday photos.
One of the best parts of having a personal website is adding cool photos!
Here’s one I found in my 2023 end-of-year slideshow on my phone:
That one is from a tree-obstacle course we ran in early 2023. Nice huh? 🙂
Anyway, we got home around noon on Saturday, and I was ready to upload our holiday photos.
I visited the usual login URL for my website and …
The login URL redirected to /wp-admin/setup-config.php.
I immediately opened a support ticket with my hosting company.
I also started searching on Google and found this question-and-answer page on StackExchange: Domain redirect to wp-admin/setup-config.php file.
I sent a link to the hosting company as well.
That answer suggested there was an issue with the wp-config.php file. If you aren’t aware:
“One of the most important files in your WordPress installation is the wp-config.php file. This file is located in the root of your WordPress file directory and contains your website’s base configuration details, such as database connection information.”
– WordPress.org, Editing wp-config.php
I didn’t do anything that would impact that file.
So it either happened due to a change the hosting company made, or it was the start of the hack.
I’m not sure.
Either way, I couldn’t access my site’s front end at this time.
I logged into CPanel and found my WP-Config file and other site files.
It showed changes had been made recently.
Ok, the hosting company is taking action, or so I thought.
I tried to visit my domain again. This time I saw another theme loading in its place:
I hovered over a couple of the page’s links. They pointed to other domains.
Ok, seems sketchy.
I tried visiting the site again, and the domain 302 redirected to /wp-admin/install.php.
I continued to see either of those events happen for the next hour or so. Sometimes the theme changed.
I was finally able to visit my login page using /wp-admin. Except, it redirected to another root domain in Spanish.
I did a site search on Google Search for that Spanish domain to see what came up.
It was lots of random content.
That’s when I realized it wasn’t the hosting company working on my site, but a spammer uploading who knows what.
I continued to see files added to the file manager over the next few hours.
By the next day, the site was just a blank page. Same for all historical pages.
When I tried to view the source code of a page, there was none.
The site was totally erased; the content was totally erased.
I guess that’s better than it redirecting users to some casino website or something, but still, not great!
That night, I woke up in a cold sweat at 4 a.m., sick to my stomach from stress.
The next morning, Christmas Eve, I sent a post on X to the hosting company asking if anyone was working and had seen my support ticket with (then 3) follow ups.
No reply.
That’s when I decided to write-off the hosting company and take what actions I could.
My concern wasn’t just losing my content, but losing the SEO equity I’d built with it.
It was now a race against the clock.
Here’s how it all went …
How I recovered my site after it was hacked (including preserving its SEO value)
The first lesson I learned through this whole ordeal is to have a site backup.
In fact, have multiple.
Ironically, I read an article on Search Engine Journal by Roger Montti after this happened on site redesign tips:
“Always have multiple backups of a website. There are so many things that can go wrong with a website backup. I’ve learned the hard way to have multiple redundant backups.”
– Google: It’s Easy To Mess Up A Site Revamp, Roger Montti, SEJ
I assumed that because my website was with a managed WP hosting company they would have backups of my content, in case a hack like this ever happened.
What I didn’t count on was not hearing from that company. And I’m not sure if I ever will.
The hack happened on December 23rd. As of January 25th, I still haven’t heard back from the hosting company. I informed them they can close my account. 😉
But still … not cool.
So, my second piece of advice is to not wait for help.
If you’re using a hosting company, a digital agency, whatever it is, hopefully they’ll help you quickly, but don’t count on it.
Take action right away to recover your content.
The worst that might happen is you didn’t need to do that work. But then all you’ve lost is time and effort.
People told me the same thing when I got hacked: “I’m sure the hosting company will restore your site on Monday.”
Had I listened, I would have lost way more than I did.
Here’s how I recovered the content that I was able to:
1. Cached webpages on Google Search
As an SEO, I was constantly monitoring which queries my webpages were ranking for on Google Search, Bing, and other search engines.
My first step was to search for my webpages on Google, one keyword at a time. I also used the site: query (or site:ethanlazuk.com) to find multiple pages at once, except this doesn’t return all of a site’s indexed pages).
I didn’t click on the results like normal. Had I done so, it would have visited the live page, which was blank.
So instead, I viewed the cached version of each page (the version when Google last crawled the content).
I was racing against the clock, though, because if Googlebot recrawled any of the pages, it would see the source code was erased and likely remove the page from its search index.
In fact, that’s what happened. As Googlebot recrawled a page while the site was hacked, the page subsequently got dropped from the index. Technically, it went into the “Crawled, currently not indexed” report under Pages in my Google Search Console.
Without a backup of my site, by the time a page reached that point, it was toast.
That’s why it’s important to act quickly to find as many of the cached versions of your content as you can.
Note: It appears as of 1/25/24 that cached versions of webpages are no longer available using the method below, as reported in SERoundtable.
Instead, I’d first use a site: command (site:example.com) for your domain to view all pages (or get the list of pages another way, like a site crawler tool or XML sitemap).
Next, I’d use the cache: command (cache:example.com/page) to view each URL. (This is discussed more in the video at the end.)
Important update (2/1/24): It appears caching is going away on Google Search!
I was fortunate to have my site get hacked when it did, haha.
Well, I guess what I’m about to share is kind of a legacy story, then.
*However, as PC Mag points out, you can still use Bing to view cached versions.
You can also use Internet Archive’s Wayback Machine’s Save Page Now feature to preserve pages yourself:
Even still, it’s good to know, but makes it even more important to have multiple backups of your site!
Keeping the above note in mind, these are the steps I took at the time to view cached webpage content:
Click the three dots beside the breadcrumb or page URL:
Click the dropdown arrow on the About this result box to see More options:
Click the “Cached” button:
This will open a Google URL with your page’s cached content.
The top of the page will have a gray box saying it’s a cached version:
From there, you can also view a text-only version or view the source code.
I’d recommend copying the source code as a backup. But I mostly just used the full version’s text.
The page content itself might look normal, a little wonky, or it might just be plain HTML without CSS styling. Here’s an example:
I must have opened 50+ tabs of cached website pages. My computer was slow as hell. But I didn’t want to close any tabs until I’d recovered the content.
That was step 1, the content recovery.
Step 2 was having a place to put that content.
2. Spin up a replacement dev site
My site had been built on WordPress. I quickly looked into other CMSs. For example, I have another site built on Wix. It’s easy enough to use.
However, since my original content and settings were all done in WordPress, I decided to dance with the one who brought me.
Keep in mind, this was Christmas Eve, as well, so my options were limited.
I went to WordPress.com and paid for a new site, intending to transfer my ethanlazuk.com domain ASAP.
I browsed through the themes until I found one that looked similar to my old site.
To be honest, I like this new theme’s default UX better, and this version of WordPress its on has more features and functionalities to play for editing the theme’s design. So it’s not like a total loss.
Anyway, WordPress.com gave me a dev-domain to play with until my ethanlazuk.com domain transferred from A Small Orange to WordPress.com’s ownership. That process would take 5-7 days I was told. Each day was agony, let me tell you.
I probably could have updated the nameservers with A Small Orange first, in hindsight. But TBH, I wasn’t thinking straight; I was acting quickly and frantically; and I didn’t know who to trust. (For the record, I trust A Small Orange, however, I reached out to their technical support during this ordeal looking for help, and they almost made the situation worse, so that’s partly why I decided to leave them entirely. But no hard feelings!)
Now with a new WordPress.com site at my disposal, I recreated each page using the content from the cached versions.
At first I just copy pasted the whole cached page’s content into the new CMS.
This created two problems:
First, any embeds, like social media posts from X.com, didn’t transfer. (This has made transferring over Hamsterdam recaps very time consuming!)
Second, the images pasted right. Except, they were hosted elsewhere, so as soon as that connection was severed, the images would break.
So once I pasted in the images, I published the page. This usually converted the image files to a WebP file type. Then I downloaded that image and re-uploaded it into the site’s media library.
I tried to preserve the same file names and alt text. I haven’t 301 redirected any image files yet, but not for lack of trying. (For some reason, the Redirection plugin I use, which is great, couldn’t process the old images’ URLs.)
When redesigning a site (just like migrating between domains), it’s best to keep as many of your SEO signals (content, links, title elements, URLs, etc.) the same as possible. The less relearning of your site Google has to do, the less volatility or traffic or rankings losses you’re likely to see.
So something else I did was make sure the title elements and URL structures matched the original site.
I also made all of the internal links relative instead of absolute (for example, putting the /slug/ instead of the full URL), to prevent unnecessary redirects when I finally switched the domain back to ethanlazuk.com later.
The last thing I did was add the same Profile page structured data to my about page, particularly the sameAs schema, to help reassure Google this site was in fact representing me.
I spent all day Christmas Eve on these tasks.
The same during Christmas Day, except I was simultaneously styling the theme, as well.
For example, the default heading font size for pages and posts was crazy huge. So I got the site looking how I wanted it to.
After two days, I’d spun up a dev site that had a good amount of my content restored on it. I had 3-5 more days to go until my domain was available.
So, I went to step 3, and pushed the site live on an alternate domain.
3. Push live a duplicate site
Something else I did on Christmas day was bought a new domain at ethanlazukconsulting.com and pushed the site I was rebuilding live.
Here was my rationale …
I didn’t know how long the ethanlazuk.com domain transfer would actually take given it was the holidays.
I also didn’t know if there’d be some issue given the site had been compromised.
I wanted to start getting a new domain earning some SEO equity just in case. Also, my content wasn’t available anyway, so this new site would at least be a place I could send people to view my content in the meantime.
So I published about 50% of my original content on ethanlazukconsulting.com, verified it in Google Search Console, and submitted the XML sitemap.
Wasn’t I worried about duplicate content, or Google canonicalizing the wrong version?
Here’s where that SEO gamesmanship came into play …
My old pages on ethanlazuk.com were already indexed; they would likely be seen as the canonical versions once these new duplicate versions were crawled.
This means the content on ethanlazukconsulting.com would get canonicalized to ethanlazuk.com and not rank in search results.
However, once the pages on ethanlazuk.com got recrawled by Googlebot, they’d be seen as blank and dropped from the index.
The canonicalized versions on ethanlazukconsulting.com would then become the only versions available, and thus the canonical versions.
This is exactly what happened (as far as I can tell).
My ethanlazukconsulting.com content wasn’t indexing at first, except for the homepage. Technically it was in the Discovered, currently not indexed report. Implying it hadn’t been crawled yet. Again, this was a totally new domain. But those seemed like less important pages. The status of more key content wasn’t showing yet.
Then, as a page with the same content on ethanlazuk.com got dropped from the index (Crawled, currently not indexed), the corresponding ethanlazukconsulting.com page became indexed. Again, as far as I could tell.
This was all happening in the course of about a week, and GSC’s Pages reports typically lag behind a few days, and even then the data can be slow or susceptible to bugs.
After 6 days, by Friday, January 29th, I finally got back ownership of ethanlazuk.com. It was connected to WordPress.com. Except, it didn’t work as expected at first. I went into the domain settings and erased all the old stuff I could find, then reset the defaults and ensured the nameservers pointed to WordPress. Once I did that, the domain redirected to ethanlazukconsulting.com.
I immediately made ethanlazuk.com the primary domain. Except, it didn’t have an SSL certificate yet! So that wasn’t good for users or Google.
I reverted that setting, but the domain being HTTP also impacted the redirection on the user’s side, as they now had to manually bypass the non-secure website warning on Chrome and some other browsers.
WordPress says the SSL certificate happens automatically, usually in a few hours, but can take up to 72 hours.
So I left the redirect in place over the weekend. Monday was also a holiday.
This expedited the process of ethanlazukconsulting.com content getting indexed — again, it seemed.
By the morning of Tuesday, January 2nd, it had been just over 72 hours. Still no SSL certificate!
I sent an email to WordPress.com’s support asking for help.
Within a few hours, they confirmed ethanlazuk.com was on HTTPS. Hurray!
Immediately, I logged in and switched the primary domain to ethanlazuk.com. This 301 redirected ethanlazukconsulting.com to ethanlazuk.com. Once I confirmed that was working, then I did a change of address in GSC for ethanlazukconsulting.com.
The change of address, according to Google, is for “when you move your website from one domain or subdomain to another [which] tells Google about your change, and helps to migrate your Google Search results from your old site to your new site.”
The support doc also mentions when not to use the tool. But in this case, it applied.
The question is, did this all work?
How the site is performing today (after its recovery)
January 1st. 2024, was the first day in a while that my site had 0 traffic from Google Search. That’s because most of the significant pages were now indexed on ethanlazukconsulting.com.
However, I switched everything back to point to ethanlazuk.com on January 2nd, resubmitted the new XML sitemap in GSC, and manually crawl requested all of my top pages.
As of around January 11th, all of my available content was restored, with a few new pages added.
The site went from 0 clicks on January 1st to 12 clicks on January 2nd and 20 clicks on January 3rd. It’s since kind of leveled off, as some of my blog rankings slid in late January. (Working on it!)
Unfortunately, I lost all Discover traffic, but I hope to regain that in due time.
What other resources say to do when your WordPress site gets hacked
As I mentioned, my site getting hacked was unique because I was dealing with a hosting company who’d been backing up my site and now I couldn’t get in touch with them.
Also, my concern above all was restoring my site’s SEO value, so I acted quickly and focused on that.
Hopefully, some of what I talked about is helpful to you.
If you’re still looking for answers, here are additional guides on what to do when your WordPress site gets hacked:
- FAQ My site was hacked – WordPress.org
- Has Your WordPress Site Been Hacked? How to Check & Fix it – Jetpack
- WordPress Hacked: What to Do When Your Site Is in Trouble – Kinsta
- WordPress Website Hacked? We’ll Show You What to Do Next – HostPapa
- WordPress Hacked: Effective Steps to Recover Your Site – Hostinger
I also shot a video recently summarizing this with additional context. It also explains Google’s recent change to cached pages and how to find them today.
(Update: the method I showed for accessing cached pages in this video will soon no longer be valid, as explained earlier. Instead, Internet Archive may be your best bet! That is, next to having backups.)
My wife Dania also suggested breaking up some of these tips into shorter articles with more detail for easier help. She’s smart. 🙂
I hope to add those related articles soon!
“March cheerfully out of obscurity into the dream”
Stay tuned for more updates. I plan to add further details about performance (and refined writing) to enrich this, as well.
Until then, enjoy the vibes:
Thanks for reading. Happy optimizing! 🙂
Leave a Reply