Recover WooCommerce SEO After a Hack: Step-by-Step Recovery Guide

Key Areas to Check:

1. 1
   Security Issues: Navigate to Security & Manual Actions → Security Issues. Look for "Site Hacked" or malware warnings.
2. 2
   Manual Actions: Check for penalties like "Hacked: Spam Injection" or "Cloaking and/or Sneaky Redirects."
3. 3
   Index Coverage: Look for sudden spikes in indexed pages (spam URLs) or drops (deindexing).
4. 4
   Performance Report: Identify which pages lost rankings and which keywords were affected.
5. 5
   URL Inspection: Test suspicious URLs to see how Googlebot renders them.

• Scan with Multiple Tools:

  No single scanner catches everything. Use:

  • • Wordfence Security (WordPress plugin)
  • • Sucuri SiteCheck (free online scanner)
  • • iThemes Security (malware detection)
  • • Malwarebytes (for server-level scans)
• Remove Malicious Files & Scripts:

  Delete all infected files identified by scanners. Common locations:

  • • /wp-content/uploads/ (PHP backdoors disguised as images)
  • • /wp-includes/ (modified core files)
  • • Theme files (especially header.php, footer.php, functions.php)
  • • Plugin directories (backdoored/nulled plugins)
• Clean Database Injections:

  Run SQL queries to find and remove spam content:

  SELECT * FROM wp_posts WHERE post_content LIKE '%<iframe%';
  SELECT * FROM wp_options WHERE option_value LIKE '%base64%';

  Backup database before making changes!

• Remove Rogue Admin Users:

  Check wp_users table for unauthorized admin accounts. Delete any suspicious users.

• Replace Core Files:

  Download fresh WordPress and WooCommerce files from official sources. Replace all core files (keep wp-config.php and .htaccess—inspect them separately).

• Inspect .htaccess and wp-config.php:

  Look for malicious redirects, base64-encoded code, or suspicious require/include statements.

Include These Elements:

1. 1
   Acknowledge the Issue:

   "We discovered our WooCommerce site was compromised on [date], resulting in [malware/spam injection/redirects]."

2. 2
   Explain How It Happened:

   "The breach occurred due to [outdated plugin / weak passwords / vulnerable theme]. We've identified the exact entry point."

3. 3
   Detail Cleanup Steps:

   List specific actions taken:

   • • Removed all malicious files (provide file paths)
   • • Cleaned database injections
   • • Replaced core files with fresh versions
   • • Set 410 status codes on spam URLs
4. 4
   Show Prevention Measures:

   Demonstrate you've hardened security:

   • • Updated all software
   • • Changed all credentials
   • • Implemented 2FA
   • • Installed WAF and monitoring
5. 5
   Provide Evidence:

   Attach or reference:

   • • Security scanner reports showing clean site
   • • Server logs proving malware removal
   • • Screenshots of removed spam pages
6. 6
   Be Professional & Humble:

   Thank the reviewer, acknowledge your responsibility, and commit to ongoing security.

Optimization Checklist:

• Update & Republish Content: Refresh dated content on affected pages. Change publish date to signal fresh content to Google.
• Strengthen Title Tags & Meta Descriptions: Ensure target keywords are present and compelling.
• Add Internal Links: Link from high-authority pages to affected pages to pass link equity.
• Improve Page Speed: Hacks often leave residual performance issues. Use Google PageSpeed Insights to identify problems.
• Request Indexing: Use Google Search Console's URL Inspection tool to request reindexing of specific high-value pages.