Our business website was hacked by a Russian gang late November last
year. One week later, I cleaned up the site. On 2 January, we moved to
another more secure web host and uploaded our original untouched web
files (with some design improvements). Our site is 320+ static html
pages.
Since the hack, our Google referrals had dropped by over 90%, with a
consequent loss to our income. Even though we had submitted two
reconsideration requests to Google, our page rankings have not
improved. Our rankings in the other SERPs have bounced back largely to
where they were before. I check our Google Webmaster tools account
daily, and all of the status reports show that everything is normal:
all pages cached and indexed, inbound links OK, robots.txt and sitemap
OK, no problem urls, etc.
I can't think of anything else that we can do and we have not heard
back from Google except for their auto response. Our income is
bleeding badly. Can anyone help? Since the hack, the other variables
that had changed are:
-moved to a new secure web host
-moved to a new domain name registrar
-have our own dedicated IP address (no longer sharing)
-removed Google Adsense adverts from many of our pages
-updated Google Analytics tracking code on all of our pages
-added bookmark this page javascript on all of our pages
Our site is not banned. We still get very good results for a very
small number of important keywords. With all of the others, either our
pages are not returned at all in Google's SERPs or they are very, very
low down.
For example, these were all on page 1 results in Google. Now they have
been dropped altogether:
business improvement
business performance
human resources tools
career enrichment
Others, such as these, have only gone down a few places on page 1 of
the results:
training best practice
managing resistance
communication survey
Our website is at www business perform . com [remove spaces]. Any
help that anyone can give on where I should be looking would be very
much appreciated.
What was the name of the software you were using? and when you moved
to another host... did you also change the website template of the
content management software you were previously using...
If you changed your site... your content... ect... you can expect to
change your position in the search results...
Hello MrGamma. The web authoring software we use is NetOjects Fusion.
The pages are created on our desktop and then uploaded to the host's
server. We don't use a CMS and the changes we made were mostly
cosmetic. The site structure remained the same. We did move to ver 9.1
of our authoring software, which creates more W3C compliant code.
Hello Craig. The urls that were previously on page 1 of Google's
results were:
business improvement - http://www. business perform .com/index.html
business performance - http://www. business perform .com/index.html
human resources tools - http://www. business perform .com/index.html
career enrichment - http://www. business perform .com/html/
career_management.html
Please remove the spaces to reconstitute the urls. Thank you both for
your interest. I appreciate it.
> Hello Craig. The urls that were previously on page 1 of Google's
> results were:
> business improvement -http://www. business perform .com/index.html
> business performance -http://www. business perform .com/index.html
> human resources tools -http://www. business perform .com/index.html
> career enrichment -http://www. business perform .com/html/
> career_management.html
What I am seeing, not that it is conclusive, is that the content
leading to relevancy for the various terms you are targeting on the
pages you are expecting to show up is rather thin compared to the
other sites that rank closer to and at the top. "human resources
tools" doesn't even appear on the entrance page.
I think what may have happened is that while your site was recovering
after the hack, that a re-evaluation was done and the pages that had
previously ranked well, were found wanting.
Just before, during or after the hack attack, were substantial changes
made to the entrance page?
By the way, although Google seems to have dealt with it well, you
really shouldn't use /index.html in your navigation since that will be
served when requesting the root, /, anyway so it could be seen as a
duplicate. Again, Google seems to have dealt with it but it would be
good to clean up the site's navigation so that the root is always used
instead of a /index.html.
Also, if at any time a /index.html was indexed or crawled, which they
surely had to have been with them in your navigation, it is best to
also use a permanent redirect from /index.html back to root, /.
"... you really shouldn't use /index.html in your navigation ..."
Sorry I misled you. The landing page to which the Google searchers was
referred was in fact /. I simply pasted the full url from my Firefox
address bar, without realizing that I could be misleading you. I had a
look at the internal navigation on our site and see that the home page
is referred to as ./index.html. This internal relative ref hasn't
cuased a problem before, but I should look at my logs to see how many
visitors are referred to /index.html. Should I put a redirect in
our .htaccess in any case?
"... the content leading to relevancy for the various terms you are
targeting on the pages you are expecting to show up is rather
thin ..."
Craig, that might be true in some cases. I had a look at the key
phrase "business performance" and the landing page. I counted 15
instances of this exact phrase in the html, most imporantly in the
title and description tags. Our business name is Business Performance
Pty Ltd and I use this as the anchor text on a lot of forum posts,
ezine articles, etc. So, there are a lot of external incoming links
with that as the anchor.
"... while your site was recovering after the hack, that a re-
evaluation was done and the pages that had previously ranked well,
were found wanting."
This doesn't match with what I know. Before 28 Nov 2007, Google
referrals were averaging 350 per day. Within two days, they were
languishing in the gutter around 20 per day. Looking at Google's
graph, the drop is very dramatic. And I can time the day of the hack
to exactly 28 Nov 2007. That was the day that the hackers left one of
their calling cards; an sd.php file dated on that date. From then on,
Google went into a tail spin, with my Webmaster tools reporting
hundreds of 404 (not found) url errors. It's just too much of a
coincidence that a general Google reevaluation occurred exactly at the
same time as the hack.
If I'm right, I'm still perplexed as to why some pages are dropped
from the SERPs completely, whilst others suffered a small drop.
Although, I suspect that the ones suffering a small drop are the ones
that did not bring in much traffic anyway, hence why we lost most of
our referrals. And maybe that's why those pages didn't suffer much.
Because the relevant terms were not competitive anyway.
Craig, you have helped me think this through. Thanks for your valuable
input. I welcome any more thoughts that you, or anyone, may have.
> > Hello Craig. The urls that were previously on page 1 of Google's
> > results were:
> > business improvement -http://www. business perform .com/index.html
> > business performance -http://www. business perform .com/index.html
> > human resources tools -http://www. business perform .com/index.html
> > career enrichment -http://www. business perform .com/html/
> > career_management.html
> What I am seeing, not that it is conclusive, is that the content
> leading to relevancy for the various terms you are targeting on the
> pages you are expecting to show up is rather thin compared to the
> other sites that rank closer to and at the top. "human resources
> tools" doesn't even appear on the entrance page.
> I think what may have happened is that while your site was recovering
> after the hack, that a re-evaluation was done and the pages that had
> previously ranked well, were found wanting.
> Just before, during or after the hack attack, were substantial changes
> made to the entrance page?
> By the way, although Google seems to have dealt with it well, you
> really shouldn't use /index.html in your navigation since that will be
> served when requesting the root, /, anyway so it could be seen as a
> duplicate. Again, Google seems to have dealt with it but it would be
> good to clean up the site's navigation so that the root is always used
> instead of a /index.html.
> Also, if at any time a /index.html was indexed or crawled, which they
> surely had to have been with them in your navigation, it is best to
> also use a permanent redirect from /index.html back to root, /.
> Craig
> > Please remove the spaces to reconstitute the urls. Thank you both for
> > your interest. I appreciate it.
> Sorry I misled you. The landing page to which the Google searchers was
> referred was in fact /.
Actually, you didn't mislead me and in fact, I didn't even notice the
index.html in your postings! :-()
I saw it in your site navigation.
> I simply pasted the full url from my Firefox
> address bar, without realizing that I could be misleading you.
You did the right thing. But, that just pointed out a problem what
would be good for you to fix.
> I had a
> look at the internal navigation on our site and see that the home page
> is referred to as ./index.html.
Exactly. I'm glad you mentioned it though so I didn't start thinking
I was crazy. :-()
> This internal relative ref hasn't
> cuased a problem before, but I should look at my logs to see how many
> visitors are referred to /index.html. Should I put a redirect in
> our .htaccess in any case?
Right, Google seems to deal with things like this well but it is
usually best to clean things up anyway.
> "... the content leading to relevancy for the various terms you are
> targeting on the pages you are expecting to show up is rather
> thin ..."
> Craig, that might be true in some cases. I had a look at the key
> phrase "business performance" and the landing page. I counted 15
> instances of this exact phrase in the html, most imporantly in the
> title and description tags.
Forget about the description tag, Google only uses it if it is a
perfect match as a description snippet for the search results and even
then, often won't use it.
The Title tag is of course very important but by itself, is not enough
to ensure relevancy. There needs to be content on the page related to
the content of the title tag or its value is reduced.
> Our business name is Business Performance
> Pty Ltd and I use this as the anchor text on a lot of forum posts,
> ezine articles, etc. So, there are a lot of external incoming links
> with that as the anchor.
That is a horse of a different color although you may have gone
overboard a bit. It seems Google doesn't like obvious anchor link
duplication suggesting all the links are coming from a single source.
It would be best to mix them up a bit.
> "... while your site was recovering after the hack, that a re-
> evaluation was done and the pages that had previously ranked well,
> were found wanting."
> This doesn't match with what I know. Before 28 Nov 2007, Google
> referrals were averaging 350 per day. Within two days, they were
> languishing in the gutter around 20 per day. Looking at Google's
> graph, the drop is very dramatic. And I can time the day of the hack
> to exactly 28 Nov 2007. That was the day that the hackers left one of
> their calling cards; an sd.php file dated on that date. From then on,
> Google went into a tail spin, with my Webmaster tools reporting
> hundreds of 404 (not found) url errors. It's just too much of a
> coincidence that a general Google reevaluation occurred exactly at the
> same time as the hack.
But, it is a very possible coincidence if Google noticed the hack and
then went back for a re-evaluation.
I can't say that is what happened though and if it doesn't fit other
data you have, then it is a suggestion that may easily be ignored.
> If I'm right, I'm still perplexed as to why some pages are dropped
> from the SERPs completely, whilst others suffered a small drop.
> Although, I suspect that the ones suffering a small drop are the ones
> that did not bring in much traffic anyway, hence why we lost most of
> our referrals. And maybe that's why those pages didn't suffer much.
> Because the relevant terms were not competitive anyway.
This may be a stretch but when I see some pages/search queries
performing the same as previous while others drop significantly, over-
optimization of one sort or another comes to mind, e.g. too high of a
keyword density, too often that same anchor text being used etc.
Does that sound like a possibility?
> Craig, you have helped me think this through. Thanks for your valuable
> input. I welcome any more thoughts that you, or anyone, may have.
All I can do is make guesses and then you to try them on and see how
they "fit". Right now, other than a lack of performance for some
keyword/phrases possibly due to being under-optimized, it seems
possible that for other keywords/phrases, you have the opposite
problem. But again, do these things seem possible to you?
I can't change easily the internal refs to the home page on our site
as the nav bars are constructed by our web authoring software,
NetObjects Fusion. I can change the hrefs manually, but for 320+
pages, I'm not convinced that it would payoff in benefits. Google
seems to be distributing the internal pagerank just fine over the last
five years.
Re the possibility of some pages being under optimized and others
being over optimized, I spend a lot of time optimizing each potential
landing page. I follow pretty standard white hat SEO guidelines in
authoring our pages. I'd be most surprised if have been swinging from
one extreme to the other.
With the Business Performance Pty Ltd anchor text, please note that we
have a lot of links with this as the anchor. We also have a lot of
links with other anchor texts. I do vary the anchor text wherever I
can. So, it's not a case of flooding the net with one anchor text.
I see that our key phrase "business performance" has returned our home
page on page 3 of the Google SERPs - after being dropped altogether.
Maybe that's a sign of a comeback, although the visits graph is as yet
not showing a definite trend upwards.
> > Sorry I misled you. The landing page to which the Google searchers was
> > referred was in fact /.
> Actually, you didn't mislead me and in fact, I didn't even notice the
> index.html in your postings! :-()
> I saw it in your site navigation.
> > I simply pasted the full url from my Firefox
> > address bar, without realizing that I could be misleading you.
> You did the right thing. But, that just pointed out a problem what
> would be good for you to fix.
> > I had a
> > look at the internal navigation on our site and see that the home page
> > is referred to as ./index.html.
> Exactly. I'm glad you mentioned it though so I didn't start thinking
> I was crazy. :-()
> > This internal relative ref hasn't
> > cuased a problem before, but I should look at my logs to see how many
> > visitors are referred to /index.html. Should I put a redirect in
> > our .htaccess in any case?
> Right, Google seems to deal with things like this well but it is
> usually best to clean things up anyway.
> > "... the content leading to relevancy for the various terms you are
> > targeting on the pages you are expecting to show up is rather
> > thin ..."
> > Craig, that might be true in some cases. I had a look at the key
> > phrase "business performance" and the landing page. I counted 15
> > instances of this exact phrase in the html, most imporantly in the
> > title and description tags.
> Forget about the description tag, Google only uses it if it is a
> perfect match as a description snippet for the search results and even
> then, often won't use it.
> The Title tag is of course very important but by itself, is not enough
> to ensure relevancy. There needs to be content on the page related to
> the content of the title tag or its value is reduced.
> > Our business name is Business Performance
> > Pty Ltd and I use this as the anchor text on a lot of forum posts,
> > ezine articles, etc. So, there are a lot of external incoming links
> > with that as the anchor.
> That is a horse of a different color although you may have gone
> overboard a bit. It seems Google doesn't like obvious anchor link
> duplication suggesting all the links are coming from a single source.
> It would be best to mix them up a bit.
> > "... while your site was recovering after the hack, that a re-
> > evaluation was done and the pages that had previously ranked well,
> > were found wanting."
> > This doesn't match with what I know. Before 28 Nov 2007, Google
> > referrals were averaging 350 per day. Within two days, they were
> > languishing in the gutter around 20 per day. Looking at Google's
> > graph, the drop is very dramatic. And I can time the day of the hack
> > to exactly 28 Nov 2007. That was the day that the hackers left one of
> > their calling cards; an sd.php file dated on that date. From then on,
> > Google went into a tail spin, with my Webmaster tools reporting
> > hundreds of 404 (not found) url errors. It's just too much of a
> > coincidence that a general Google reevaluation occurred exactly at the
> > same time as the hack.
> But, it is a very possible coincidence if Google noticed the hack and
> then went back for a re-evaluation.
> I can't say that is what happened though and if it doesn't fit other
> data you have, then it is a suggestion that may easily be ignored.
> > If I'm right, I'm still perplexed as to why some pages are dropped
> > from the SERPs completely, whilst others suffered a small drop.
> > Although, I suspect that the ones suffering a small drop are the ones
> > that did not bring in much traffic anyway, hence why we lost most of
> > our referrals. And maybe that's why those pages didn't suffer much.
> > Because the relevant terms were not competitive anyway.
> This may be a stretch but when I see some pages/search queries
> performing the same as previous while others drop significantly, over-
> optimization of one sort or another comes to mind, e.g. too high of a
> keyword density, too often that same anchor text being used etc.
> Does that sound like a possibility?
> > Craig, you have helped me think this through. Thanks for your valuable
> > input. I welcome any more thoughts that you, or anyone, may have.
> All I can do is make guesses and then you to try them on and see how
> they "fit". Right now, other than a lack of performance for some
> keyword/phrases possibly due to being under-optimized, it seems
> possible that for other keywords/phrases, you have the opposite
> problem. But again, do these things seem possible to you?
> I can't change easily the internal refs to the home page on our site
> as the nav bars are constructed by our web authoring software,
> NetObjects Fusion. I can change the hrefs manually, but for 320+
> pages, I'm not convinced that it would payoff in benefits. Google
> seems to be distributing the internal pagerank just fine over the last
> five years.
No argument. If it was easy to do, it would be good to do but if not,
as you and I have also said, Google doesn't seem too terribly bothered
about it at the moment.
Don't fix what ain't broke.
> Re the possibility of some pages being under optimized and others
> being over optimized, I spend a lot of time optimizing each potential
> landing page. I follow pretty standard white hat SEO guidelines in
> authoring our pages. I'd be most surprised if have been swinging from
> one extreme to the other.
I was just thinking about the entrance page and some of the search
phrases you were targeting appearing to be a little "thin" at the
moment. That may not be the case though as I gather from your
discussion further down.
My idea about what might be wrong, may be wrong itself but I think we
can agree that for whatever reason, Google is not seeing the same
thing it saw before or at least Google may not appreciate as much now
as what it saw before.
> With the Business Performance Pty Ltd anchor text, please note that we
> have a lot of links with this as the anchor. We also have a lot of
> links with other anchor texts.
True.
> I do vary the anchor text wherever I
> can. So, it's not a case of flooding the net with one anchor text.
Ok, I had to check though.
> I see that our key phrase "business performance" has returned our home
> page on page 3 of the Google SERPs - after being dropped altogether.
> Maybe that's a sign of a comeback, although the visits graph is as yet
> not showing a definite trend upwards.
There are some tools at oy-oy.eu that you might find useful. The one
I think applicable in this case is the one that allows you to execute
a search across numerous data centers at the same time. I found that
tool invaluable for monitoring trends in my sites' performance,
whether rising or falling, over a period of time. Checking it at
about 12 hour intervals seems to give interesting and useful results.
One thing that is very possible is that nothing is wrong, things may
just be on an upside of a recovery curve.
When I slit the link-love throat of one of my websites one time and
watched its recovery, I saw some very interesting as well as confusing
as hell things going on so who knows.
> Thanks again for your insights.
Um, you mean thanks for nothing, so far, right? :-()
Don't start thanking till things start working! ;-)
"Um, you mean thanks for nothing, so far, right? :-()"
I really did mean thanks for something. Talking it through with you
made me
realize that perhaps the pages hardly impacted may be so because the
keywords relevant to those pages are not competitive. And you
highlighted my
need to do a redirect from index.html to /. Don't sell yourself
short.
I checked out oy-oy.eu, as you suggested. They certainly have a good
set of
webmaster tools. I've added them to my list resources. I tried
"business
performance" across a range of DCs with very different IPs and they
all
returned our home page on page 2 of the results.
I've left the best news for last. Yesterday, we got double the number
of
visits to our site, with Google referring 500 visits, up from our post-
hack
result of around 20 per day. It looks as if Google finally switched
the
switch (whatever switch that is). We are trying not to get too excited
with
just one day's worth of results, but it does look as if after three
months
in the wilderness, we have been returned to the holy land.
> > I can't change easily the internal refs to the home page on our site
> > as the nav bars are constructed by our web authoring software,
> > NetObjects Fusion. I can change the hrefs manually, but for 320+
> > pages, I'm not convinced that it would payoff in benefits. Google
> > seems to be distributing the internal pagerank just fine over the last
> > five years.
> No argument. If it was easy to do, it would be good to do but if not,
> as you and I have also said, Google doesn't seem too terribly bothered
> about it at the moment.
> Don't fix what ain't broke.
> > Re the possibility of some pages being under optimized and others
> > being over optimized, I spend a lot of time optimizing each potential
> > landing page. I follow pretty standard white hat SEO guidelines in
> > authoring our pages. I'd be most surprised if have been swinging from
> > one extreme to the other.
> I was just thinking about the entrance page and some of the search
> phrases you were targeting appearing to be a little "thin" at the
> moment. That may not be the case though as I gather from your
> discussion further down.
> My idea about what might be wrong, may be wrong itself but I think we
> can agree that for whatever reason, Google is not seeing the same
> thing it saw before or at least Google may not appreciate as much now
> as what it saw before.
> > With the Business Performance Pty Ltd anchor text, please note that we
> > have a lot of links with this as the anchor. We also have a lot of
> > links with other anchor texts.
> True.
> > I do vary the anchor text wherever I
> > can. So, it's not a case of flooding the net with one anchor text.
> Ok, I had to check though.
> > I see that our key phrase "business performance" has returned our home
> > page on page 3 of the Google SERPs - after being dropped altogether.
> > Maybe that's a sign of a comeback, although the visits graph is as yet
> > not showing a definite trend upwards.
> There are some tools at oy-oy.eu that you might find useful. The one
> I think applicable in this case is the one that allows you to execute
> a search across numerous data centers at the same time. I found that
> tool invaluable for monitoring trends in my sites' performance,
> whether rising or falling, over a period of time. Checking it at
> about 12 hour intervals seems to give interesting and useful results.
> One thing that is very possible is that nothing is wrong, things may
> just be on an upside of a recovery curve.
> When I slit the link-love throat of one of my websites one time and
> watched its recovery, I saw some very interesting as well as confusing
> as hell things going on so who knows.
> > Thanks again for your insights.
> Um, you mean thanks for nothing, so far, right? :-()
> Don't start thanking till things start working! ;-)
i read your story here , and i might have a simular story here.
today i got a chat request from a person who offered his resvices as a
webdesigner , after some chat he sait that if we didnt hire him things
would happen to our site , he would destroy the site he said.
we thought , must be another loony but when i see my google results
tonight theres a sharp drop in visitors to 1/10 of the quantity
before.
is there a way to detect if this is an attack of is there any other
explenation possible??
> > Sorry I misled you. The landing page to which the Google searchers was
> > referred was in fact /.
> Actually, you didn't mislead me and in fact, I didn't even notice the
> index.html in your postings! :-()
> I saw it in your site navigation.
> > I simply pasted the full url from my Firefox
> > address bar, without realizing that I could be misleading you.
> You did the right thing. But, that just pointed out a problem what
> would be good for you to fix.
> > I had a
> > look at the internal navigation on our site and see that the home page
> > is referred to as ./index.html.
> Exactly. I'm glad you mentioned it though so I didn't start thinking
> I was crazy. :-()
> > This internal relative ref hasn't
> > cuased a problem before, but I should look at my logs to see how many
> > visitors are referred to /index.html. Should I put a redirect in
> > our .htaccess in any case?
> Right, Google seems to deal with things like this well but it is
> usually best to clean things up anyway.
> > "... the content leading to relevancy for the various terms you are
> > targeting on the pages you are expecting to show up is rather
> > thin ..."
> > Craig, that might be true in some cases. I had a look at the key
> > phrase "business performance" and the landing page. I counted 15
> > instances of this exact phrase in the html, most imporantly in the
> > title and description tags.
> Forget about the description tag, Google only uses it if it is a
> perfect match as a description snippet for the search results and even
> then, often won't use it.
> The Title tag is of course very important but by itself, is not enough
> to ensure relevancy. There needs to be content on the page related to
> the content of the title tag or its value is reduced.
> > Our business name is Business Performance
> > Pty Ltd and I use this as the anchor text on a lot of forum posts,
> > ezine articles, etc. So, there are a lot of external incoming links
> > with that as the anchor.
> That is a horse of a different color although you may have gone
> overboard a bit. It seems Google doesn't like obvious anchor link
> duplication suggesting all the links are coming from a single source.
> It would be best to mix them up a bit.
> > "... while your site was recovering after the hack, that a re-
> > evaluation was done and the pages that had previously ranked well,
> > were found wanting."
> > This doesn't match with what I know. Before 28 Nov 2007, Google
> > referrals were averaging 350 per day. Within two days, they were
> > languishing in the gutter around 20 per day. Looking at Google's
> > graph, the drop is very dramatic. And I can time the day of the hack
> > to exactly 28 Nov 2007. That was the day that the hackers left one of
> > their calling cards; an sd.php file dated on that date. From then on,
> > Google went into a tail spin, with my Webmaster tools reporting
> > hundreds of 404 (not found) url errors. It's just too much of a
> > coincidence that a general Google reevaluation occurred exactly at the
> > same time as the hack.
> But, it is a very possible coincidence if Google noticed the hack and
> then went back for a re-evaluation.
> I can't say that is what happened though and if it doesn't fit other
> data you have, then it is a suggestion that may easily be ignored.
> > If I'm right, I'm still perplexed as to why some pages are dropped
> > from the SERPs completely, whilst others suffered a small drop.
> > Although, I suspect that the ones suffering a small drop are the ones
> > that did not bring in much traffic anyway, hence why we lost most of
> > our referrals. And maybe that's why those pages didn't suffer much.
> > Because the relevant terms were not competitive anyway.
> This may be a stretch but when I see some pages/search queries
> performing the same as previous while others drop significantly, over-
> optimization of one sort or another comes to mind, e.g. too high of a
> keyword density, too often that same anchor text being used etc.
> Does that sound like a possibility?
> > Craig, you have helped me think this through. Thanks for your valuable
> > input. I welcome any more thoughts that you, or anyone, may have.
> All I can do is make guesses and then you to try them on and see how
> they "fit". Right now, other than a lack of performance for some
> keyword/phrases possibly due to being under-optimized, it seems
> possible that for other keywords/phrases, you have the opposite
> problem. But again, do these things seem possible to you?
|
