A tour operator came to us because their site had "stopped working". It had not stopped working. It had been taken over.
The site still loaded. That was the problem.
A tour operator came to us because their website had, in their words, stopped working. Enquiries had dried up. Google had gone quiet. But the home page still came up, so nobody had treated it as an emergency.
What was actually there
We pulled the full list of pages. There were 1,373 posts on that site. Nineteen of them were the client's real tours. The rest — around 1,370 — had been injected by somebody else: casino and gambling pages in fifteen languages, and adult content, all invisible from the home page and all indexed by Google.
Nobody had defaced anything. That is the point. A defaced site gets fixed on the same day, because the owner can see it. A site quietly stuffed with spam keeps looking fine to its owner while Google decides it is a spam site.
Why it happened
The site ran on WordPress with a stack of plugins. That is not an argument against WordPress — it is an argument about surface area. Every plugin is somebody else's code running on your server with your permissions, and each one is a door you did not build and do not check.
What we did
We did not clean it. Cleaning an injected site means proving a negative: that you found every backdoor, every scheduled task, every modified core file. You cannot prove that, and the reinfection rate says most people do not.
Instead we salvaged what was genuinely theirs — nineteen tours and forty-four itinerary days — and rebuilt on infrastructure with no plugin surface to attack. Every old URL redirects to its new equivalent so the rankings that survived came across.
What to take from it
- A site that loads is not a site that is healthy. Check what Google has indexed, not what your home page shows.
- If you have never looked at Search Console for your own domain, look this week. It is free and it takes ten minutes.
- Ask who can log in to your website. If the answer includes a developer you stopped working with three years ago, that is the job to do first.