It doesn't end with disappearing from searches
A red warning screen appears on the company site, which was opening normally until yesterday. When Google puts a red flag on something, the search traffic disappears within a day. In the case covered in this section, the search influx occurred the day after the mark was placed. From 1,380 sessions per day to 128 sessionsreduced to . 91% were lost on the first day alone.
More importantly, this warning isn't just attached to search results. Chrome, Safari, Samsung Internet all Google Safe BrowsingIt refers to the same block list called . So, even if you enter the address directly, a warning screen appears first, and even visitors coming to the address written on your business card or catalog are blocked.
If you understand this as a problem of missing search exposure, the response will be delayed. In this state, even if you run an ad, the landing page is blocked, so only advertising costs are consumed.
Verification ends in one place: Search Console
You can check what caused the mark in the path below.
Search Console → Security and Manual Actions → Security IssuesThe example address that appears here is the infected page that Google actually caught. The type of problem, date of first detection, and number of pages affected are also recorded. This list will serve as a starting point for your recovery, so be sure to save your screens.
If you delete just one file, it will come back in the same place a few days later.
If you open the address provided by Search Console, you will see a page that the company has never uploaded. If you just delete that page and be done with it, the same page will appear again in the same location a few days later.
If you look at the list of files on the server in order of modification time, you will see why. In this case, spam pages 02:41It was created in wp-conf.php just one 02:39was 2 minutes ahead. This file was uploaded before the spam page, and this is the one that continues to create pages. These files are called webshells.
Where does the invasion begin? If the administrator address is /admin, how many times will it be attacked per day?How the results appear in search results How to check if your website has been hacked in 10 secondsYou can continue watching here.
Four Step Recovery Sequence
- Deletes infected pages and webshells together. You should check not only the address provided by Search Console, but also all files created at the same time.
- Blocks the entry path. Update vulnerable plugins and themes, remove PHP execution permissions from upload folders, and strengthen authentication on admin pages.
- All new administrator, FTP, database, and API keys are issued. It is safer to assume that it was leaked during the breach and replace it all.
- Then request a review in Search Console. When making a request, please include which files were deleted and which paths were blocked to speed up the review.
If you skip step 2, you will get the same warning again after your review is approved. Keeping order is the surest way to reduce workload.
After review request
The review usually takes place within a few days, but if it's approved, your search rankings won't immediately return to normal. Since it takes time for the index to be reorganized even after the block is lifted, it is recommended to delete the index of infected pages and request recollection of normal pages during this period.
To prevent the same thing from happening again, we recommend checking the entire server after recovery. Breaches usually occur when multiple positions are open, not just one.
