Recovering from a Hack: How long until Google reindexes changes?

[Zachary_Russell]

In a previous post I made, I was able to determine that one of my sites; http://pokeronamac.com/ was hacked and was feeding spam perscription drug content to search engines, then redirecting to another site when clicked on Google.

I then contacted my web host, and, after they did a scan of our files, they determined that something within the wp-includes directory was compromised and malicious. They removed the file, though they weren't able to determine the source of the attack, or how they god in (should we be scared?). Anyway, its been several days now ~5 and if I do a site search the spam pages still show up, but the redirect is no longer working.

At this point, I am at a standstill, because i'm loosing traffic on my site by about 90%, and google hasn't sent us any warnings of malaware or the like. I know I was recommended against this before, but should I attempt to submit a reconsideration request, or should I just wait it out?

Thanks for your help,

Zach

[matbennett]

Your site appears to be infected with a trojan and still redirecting users.   I wouldn't expect traffic and earnings to return until that issue is fixed.

Most WP hacks are down to either a bad installation or a bad plugin. The core files are pretty good as long as they are kept up to date. Get the mess cleared up and reudce your plugins to the absolute bare minimum. They research each one to see if others have had problems.

I wouldn't suggest waiting it out. That will achieve nothing.

[Zachary_Russell]

I didn't realize that it was still redirecting. Do you recommend we completely replace the WordPress core? and then go through the plugins?

[matbennett]

I'm not an expert of wordpress. However my approach for any compromised CMS would usually be something like:

• Ensure that you have a full back up of all content and media
• Put up a test install of the core CMS (most up to date version)
• Import content and media to the test install
• test test test test
• Only install plugins that are ABSOLUTELY ESSENTIAL, and then only if they are well used by others, without reported problems and from trusted sources
• test test
• Once you are happy that your test version is good create a full backup
• Now delete the live site
• Change all passwords
• Copy the test install

[APICDA]

I have had a word press site hacked in the past......

Once we eliminated the issue.  I installed some additional security and changed passwords etc.

This seemed to take care of it.

I am not sure, but I want to say a plugin the customer had called Akismet may have played a role....?

[matbennett]

If I were going to name a plugin that was NOT likely to be the cause then Akismet would probably be top of that list.  Nothing is guaranteed of course, but Akismet probably the mostly widely used wordpress plugin available. If there was an issue with that I think everyone would know.