Hit with an SEO poisoning attack — what's the usual goal, and how do you spot it?

SSH into your server and run a curl test spoofing the Googlebot user-agent. When you send a request disguised as a crawler from the terminal, you'll see the redirects and injected spam links right in the raw HTML response. They usually drop an obfuscated one-line include at the very top of wp-blog-header or index.php.

edit: typed from phone, sorry for typos.

First thing to do is hop into search console and use the URL removal tool. Identify those weird script URL patterns and get them purged from cache and index immediately, otherwise your domain getting blacklisted within weeks is practically guaranteed.

Don't assume you're clean just because you scanned the files. These actors almost always set up server cron jobs that re-download the payload. You delete the file, midnight hits, the cron runs, and it pulls the same PHP right back from a remote host. You won't get rid of it until you scrub those scheduled tasks.

happened to us last year, spent two weeks hunting it down and turned out they got in through an old form plugin exploit and injected rows straight into the db then btw only fixed it by purging the plugin completely and restoring a clean database backup.

On our wholesale food site, 24,000 spam URLs got indexed overnight. We did the cleanup, but it took a full 5 months for the search results to be completely purged on Google's end and for us to win back our old organic keywords.

Is the server you're using a shared hosting account or a cloud server dedicated to you? If you're on shared space, could they have jumped into your directories because of a security hole in some completely unrelated other customer on the same server?

The way the attack works basically consists of three steps: First, they get in through a vulnerability in an outdated theme or plugin. In the second step, thousands of virtual pages generated with spam keywords are served up to the search engine. In the third step, real users coming from these keywords are redirected to the target fake sites.

There are four mandatory steps that must not be skipped during cleanup: 1) Renew all database user passwords, 2) Reset the security keys (salt keys), 3) Delete the executable PHP files in the file upload folder, 4) Examine the access logs on the server side and close off the source of the initial breach.

you're right. when we decide without measuring we always end up in the same place.

everyone rushing into seo poisoning gets stuck at the same point. tbh that's all, sorry if I went on too long.

don't miss this: Trying to do this alne is the most expensive way.

most incidents start with a leaked password, not a vulnerability and btw if you post the result here, it will help others too.

i didn't know that.

just a heads-up. the bigggest time-waster for us was not knowing who had the final say.

of course, it variies if your situation is different.

Quick summary for newcomers: Taking measures without an inventory leaves doors you haven't seen open.

If I were you, I'd go this route.

Here's how it went for us. If it's your first time, start small; scaling comes later.

The biggest time-waster for us was not knowing who had the final say. If I were you, Id go this route.

i agree and I'd like to emphasize that. don't hesitate to ask; those who don't ask always pay more.

hasty decisions become decisions you have to fix six months later. proven by experience.

There's one point I'm curious about. Don't hesitate to ask; those who don't ask always pay more.

Mistakes made on the seo poisoning side are usually reversible but expensive. Hope this helps.

My questions are cleared up, thanks. The biggest time-waster for us was not knowing who had the final say.

If 2FA is on, a stolen password alone is useless.

I'll try it.