How small business websites get hacked: a first-hand account

This is awkward to write about, and more useful than another “ten security tips” article. So here is ours.

What happened

In 2024, pages we never created appeared on sweb.com.ua: Italian product listings like /Coffee-Remover-32oz-Pack-Of-2-Made-In-USA-m-372907. Several hundred of them. We could not see them — they were not in any menu and never showed up in navigation. Only the search crawler saw them.

This is called parasite hosting. The attacker does not want your business; they want a domain with some reputation so that someone else’s pages get indexed faster.

How they usually get in

In the overwhelming majority of cases it is not a sophisticated attack but one of three things:

• An outdated plugin. The vulnerability is published, the fix ships, your site updates six months later.
• A weak admin password. Especially when the login is admin and a bot is doing the guessing.
• A pirated theme. The backdoor arrives together with the design.

Cleanup is only half the job

We removed the files, verified the core against checksums, cleaned the database. It felt finished.

Two years later Search Console still listed 623 URLs under errors. The pages were long gone and returned 404 — but Google kept coming back for them, because a network of other sites still links to them. Every indexing report opened with somebody else’s rubbish.

What finally worked

410 instead of 404. This is the key move. A 404 means “not found right now” — the crawler assumes the page might return and comes back. A 410 means “permanently gone”, and the URL drops out of the crawl queue far faster.

A sitemap of the dead URLs. It sounds odd but it works: collect every dead address into a separate sitemap.xml and submit it in Search Console. Google re-reads them in one pass, receives the 410 and retires them. Without the sitemap the same process drags on for months.

Patience. Nothing makes this happen in less than a few weeks. The URL Removal tool does not help here — it hides indexed pages for six months, and these were never in the index to begin with.

What to do on your own site today

• Open the indexing report in Search Console and look for URLs you never created.
• Rename the admin user if you have one.
• Turn on two-factor authentication for the admin panel.
• Make sure backups are stored off the hosting account.

That last point matters most. A backup sitting on the same server is usually encrypted along with the site at exactly the moment you need it.