Site hacked and several pages disappeared from google the next day

[indyank]

Hello all,

My site was hacked and a malicious script that redirects to <a fake google domain> was placed in the footer.i also noticed alerts from antivirus software on this domain when I loaded any of the pages on the website.

I detected the above described attack in 8-10 hours and removed the malicious script.I also tightened the site security.I check the ranking of a few of may pages on google and it was intact.

But the next morning, several of those pages disappeared from google for the keywords for which they used to rank. But if i search the URLs of those pages in google, I could find them and when I see the google cache, they show a date which is almost 3 weeks earlier.

So how how could they have been dropped from google for the keywords for which they used to rank? But the pages still seem to be there in google index as I could search them using their complete urls.

Can the webmasters here pls. help me on how to proceed further? What should be my next steps? Should I file a reconsideration request? But google webmastertools haven't yet reported anything malicious.(though I know it takes several days for them to actually report).

[edited by: tedster at 3:53 am (utc) on Mar 28, 2010]
[edit reason] I removed the infecting domain name [/edit]

[TheMadScientist]

Should I file a reconsideration request?

The pages may come back in the results naturally when GBot respiders and the malicious code has been removed, but IMO if the site is 'clean' and has good information and content it would not hurt to file a reconsideration request and let them know what happened and that you corrected it before it was even reported in your WTM account, but you want to make sure everything is okay and your rankings will return to normal.

I had one account with some low traffic sites I wasn't really working on get hacked and a bunch of uh, politely 'garbage' links inserted into a hidden div on the pages and didn't notice it for weeks... I simply reuploaded the pages to remove the links and everything returned to normal soon after. This wasn't 'malicious code' or redirects, but there were definitely some 'colorful', 'off topic' links inserted.

On a bit of a 'strange situation' and 'stuff happens to all of us' note: Yesterday I found my .htaccess files from the sites in one hosting account deleted... Just plain gone... I don't know if the host had an issue and tried to restore the sites from a backup and didn't include the invisible files or what the deal was, but there was nothing else missing and once I reuploaded the .htaccess files the sites worked fine without any malicious code or anything else I could find wrong, but somehow, for some reason my .htaccess files were missing from the sites in the account.

Anyway, the point is 'stuff' happens and it's not only you who's had an issue, so as long as you dealt with it quickly and got things back to normal I think you should be fine and IMO your rankings will probably return shortly.

[indyank]

@TheMadScientist thanks for sharing your experiences...

So shall I wait to see if my pages reappear again in Google for the keywords they used to rank?

but I have a question.

get hacked and a bunch of uh, politely 'garbage' links inserted into a hidden div on the pages and didn't notice it for weeks... I simply reuploaded the pages to remove the links and everything returned to normal soon after

How did you know that everything returned to normal? Did you notice any drop in traffic or disappearance of pages from google, in the first instance (after the hack)? Did they reappear after you uploaded the clean pages?

Another question that I have in general is, does google act so quickly to drop pages? Or does it wait for a few days for the site owner to detect and clean it up, before it removes them?

In my case, I notice that one or two pages still rank for their keywords.But quite a few pages have disappeared. (But note that I could still trace them in google by searching their complete url).Also when I search google with my domain name, I could get it on top.

So it doesn't appear to be a site wide drop but quite a few pages have dropped.

[TheMadScientist]

How did you know that everything returned to normal? Did you notice any drop in traffic or disappearance of pages from google, in the first instance (after the hack)? Did they reappear after you uploaded the clean pages?

I started looking at traffic on those sites more closely and there was a lower period of traffic. Like I said they were low traffic sites, meaning they didn't rank for any major traffic and when the traffic first started to drop I just figured whatever, I haven't touched them or developed them at all lately, so it's my fault for not doing anything, but then one 'only keyword domain site in the niche' didn't rank #1 for the keywords in the domain name (it's a really specific 'no brainer number one' two keyword domain name) for a really small niche, so I started to look closer and noticed the links.

Another question that I have in general is, does google act so quickly to drop pages?

I think it depends on what it is... Malicious code detected = Drop as soon as possible, because it's bad for them to have in the results for their visitors, which is why if you have a good quality site I would probably consider a reconsideration request, just so they know you have it cleaned up.

I can't say for sure how fast after the links were added my traffic dropped, because I wasn't watching the traffic on those sites that closely, and I don't know for sure which day the code was added on, but I can say with a fair degree of certainty it was within a day or two.

[indyank]

Thanks for your share.

Yes the site has good quality content but my dilemma is whether to wait for a day or two to see if all those pages regain ranking or go ahead and file a reconsideration request, right now. Moreover, now being a weekend, I am sure that Google may not look into it, until Monday.

How long does google normally take to look into a reconsideration request? If it is going to be two to four weeks and by then things get ok on its own, then the folks at google may not be able to appreciate why I filed a reconsideration request?

[indyank]

Malicious code detected = Drop as soon as possible

shouldn't it have dropped other pages also or the whole site? why only a bunch of traffic driving pages?

There is another traffic driving page on the website, which seem to be intact with it ranking and still drives traffic.

It is kind of strange to me.The pages dropped have a cache dating back to two weeks ago, like the one that is still intact.It is difficult to understand that google has crawled only a few pages (though the cache doesn't seem to indicate it), detected the malicious code and dropped them. It has neither dropped the Home page nor a few other traffic driving pages.

[tedster]

You're asking good questions. First, the cache date can often lag behind that most recent crawl - so if your server logs show a TRUE googlebot request -- that is, the IP address is correct and it passes the reverse-forward verification test [webmasterworld.com] -- then that URL was crawled, no matter how long it takes Google's public cache to be updated.

why only a bunch of traffic driving pages?

That's the question I'd be asking too. It sounds like the timing might be coincidental and your high search traffic pages are penalized for some other reason.

At any rate, a reconsideration request based on the hack you discovered and undid cannot hurt you. I wouldn't be reluctant to submit one in this situation.

[indyank]

Thanks Tedster.

Here is more information from WMT, this morning.

There were several

a) In sitemap errors,
b) network unreachable errors

reported in WMT on the date when the site was hacked.

There were a few HTTP errors (403 forbidden errors) reported for an earlier date.

So I checked, whether the traffic driving pages that disappeared were there in those errors.Many were there except a few.So it looks like those URLs were unreachable for the Google spiders that day, but google seems to have removed them (may be temporarily) because of this.I haven't noticed google removing pages from their search results, for network unreachable errors, earlier.So, this is new to me.

Many of those pages that disappeared had Pagerank and they seem to be intact, as per Google toolbar.

It is turning out to be a nice case study for me, as I don't have much experience on this before.

It is really interesting for me to share my experiences and get the insights of the more experienced and knowledgeable people here.

[indyank]

Hello all,

The hacker had somehow added a noindex meta tag to all posts that are not on the front page.So I didn't even notice it so far.But when i continued to see pages disappearing in google search (though they are still there when i search them with URLs), I investigated further and found the noindex meta tag added to those pages. :(

Now I have added back the index, follow meta tag to all those pages? Will google spider them again and restore them to where it was earlier?

or should I submit those pages again to google and if yes, how?

Note that I have already filed a reconsideration request to google.Thanks to this forum.

[TheMadScientist]

That's just plain mean spirited...

I was actually surfing a bit earlier and searching for some of my domains and I found one which has a very unique name with 'search' added to the beginning of a two word phrase I was the first to use, AFAIK, and not only is it probably trademark infringement I'll have to look into shortly, the domain is listed with a 'this site may harm your computer' listing in Google and when I turned everything off in my browser and tried to visit I got the same warning from FF, so I couldn't even look at it to see what it was, and I'm sure it's worse to have your domain infected, but why the f! can't people let an original thought be an original thought and then go have their own original thought rather than trying to take advantage of what other people come up with and then drag it through the mud?

I don't get the reasoning and I probably won't ever get the reasoning... I mean really is there some 'I'm so good feeling' I don't know about people get from copying and/or trashing other people's creativity or something?

[indyank]

A quick update...it is three hours since i intrdocuded index, follow tag again and one of the best pages has returned to where it was earlier.hope it stays there permanently and this is not something temporary...the others are yet to reappear...

[indyank]

the page has returned to where it was in my country's google search and it is ranked differently in google.com (slightly better).

but it is the only page that ha reappeared so far...