SEO Recovery After a Hack: Getting Your Rankings Back

The site is clean. The malware is gone, the backdoor is closed, Google has lifted the warning. And your traffic is still down forty per cent.

This is the part nobody warns you about. SEO recovery after a hack is a separate job from the clean-up, and skipping it is why some sites never quite return to where they were.

What a compromise actually does to your search presence

Four distinct kinds of damage, and each needs a different response.

Spam pages in the index. Google crawled and indexed hundreds of pages you never created. Those URLs are still in the index after the files are deleted, now returning errors.

Lost trust signals. A site flagged for malware loses standing. Even after the warning clears, Google is measurably more cautious for a while.

Damaged link profile. Injected content often links out to gambling, pharmaceutical or adult sites. Your domain has been part of a link scheme, whether you knew it or not.

Crawl budget wasted. Googlebot spent weeks crawling spam URLs instead of your real pages. New and updated content went unnoticed.

Step 1: Establish what Google actually saw

Before fixing anything, find the scope. Open Google Search Console and work through:

• Security Issues — confirm it now reads as clear
• Pages report — compare indexed page count against what you actually publish
• Performance report — set the date range wide and find the day traffic fell. That is roughly when the infection became visible to Google, which is often weeks before you noticed
• Manual Actions — a separate report from Security Issues. Check both

Then search site:yourdomain.com in Google and page through the results. You are looking for URLs you never created.

Step 2: Deal with the spam URLs properly

This is where most recoveries go wrong, because the intuitive answer is the wrong one.

Deleted spam pages now return a 404. That is acceptable but slow — Google may take months to drop them all.

Better: return a 410 Gone for known spam URLs. It tells Google the page is permanently removed and is processed faster than a 404.

Do not redirect spam URLs to your homepage. It looks like manipulation, dilutes your homepage relevance, and slows removal rather than speeding it.

For anything ranking or getting traffic, use the Removals tool in Search Console for a temporary suppression while the permanent removal processes. That tool hides results for about six months — it buys time, it does not fix anything on its own.

Step 3: Clean up the outbound links

Check whether injected links are still present anywhere. They hide in post content, widgets, footer areas, and database options — often invisible on the rendered page.

View the page source of your key pages and search for anchor tags pointing at domains you do not recognise. Injected links are frequently styled to be invisible rather than removed from the HTML.

You generally do not need to disavow links pointing to your site — Google is reasonably good at ignoring spam links a hacked site attracted. Focus on links pointing out, which are within your control and are the ones that signalled participation in a scheme.

Step 4: Help Google re-crawl

Once genuinely clean, encourage a fresh look.

1. Submit an updated XML sitemap containing only real URLs
2. Use URL Inspection to request indexing for your most important pages
3. Make sure robots.txt was not modified — attackers sometimes edit it
4. Confirm no stray noindex tags were left behind
5. Check your canonical tags still point where they should

That third and fourth point matter more than people expect. We regularly find sites that were cleaned properly but left with a noindex or a blocked robots.txt, quietly preventing any recovery at all.

Step 5: Rebuild the signals

With the technical cleanup done, the remaining work is ordinary SEO. Publish again on a regular schedule — it signals an active, maintained site. Refresh your most important pages. Make sure the site is fast, since performance is one of the levers still fully in your control.

Resist the temptation to make sweeping changes to structure or URLs while recovering. Two variables changing at once makes it impossible to tell what is working.

A realistic timeline

Being honest about this matters, because unrealistic expectations lead people to abandon a recovery that was working.

• Week 1–2: warning lifted, spam URLs beginning to drop out
• Week 2–6: most spam URLs gone from the index, traffic starting to climb
• Month 2–4: rankings approaching previous levels for most terms
• Month 4–6: full recovery for the majority of sites

Two things drive the variance. How long the infection ran before discovery — a compromise caught in two days barely registers, one running three months does real damage. And whether the clean-up was complete, because reinfection resets the clock entirely.

Why detection speed is the whole game

Notice what that timeline depends on. A site with monitoring catches an infection in hours, Google never flags it, and there is no SEO recovery to do at all.

A site with no monitoring is discovered by a customer six weeks in, gets blacklisted, loses months of rankings, and then spends another four months climbing back.

Same attack, same vulnerability. The entire difference in cost is detection time. That is why our security monitoring service exists — the goal is never needing this article.

If you are recovering now

First make certain the site is genuinely clean. Recovering the rankings of a site that is still compromised is wasted effort, and reinfection undoes everything. Our guides on removing malware from WordPress and reading the Search Console security report cover how to verify that.

If you are not confident the clean-up was complete — particularly if the problem has recurred — our security and error fixing service includes finding the backdoor that was missed, plus the Google review.

Send us your web address and we will tell you what we can still see, usually the same day.