Google can't crawl sitemap after Japanese hack

[BlackFawkes]

Hello BHW !

I'm facing an issue I can't resolve, so I hope someone will be able to help me.

One of my client's website has been hacked with Japanese keywords. Basically, the hacker created thousands of pages with Japanese keywords to rank on Google.

The infected pages have been deleted now. But Google index still shows all Japanese pages and not English ones. I can't even submit a new sitemap in the GSC, I get an Http error. Something is definitely blocking Googlebot from crawling the website but I don't know what.

Send help please, this is driving me crazy

 

[JayMay]

God damn that sounds crazy, I have 0 experience with SEO, but I will reply here to bump the thread for someone to hopefully see

 

[fb3003]

Hello BHW !

I'm facing an issue I can't resolve, so I hope someone will be able to help me.

One of my client's website has been hacked with Japanese keywords. Basically, the hacker created thousands of pages with Japanese keywords to rank on Google.

The infected pages have been deleted now. But Google index still shows all Japanese pages and not English ones. I can't even submit a new sitemap in the GSC, I get an Http error. Something is definitely blocking Googlebot from crawling the website but I don't know what.

Send help please, this is driving me crazy

how about going down this route
https://www.google.com/webmasters/sitemaps/ping?sitemap=http://www.YOUR DOMAIN.com/sitemap.xml

 

[BlackFawkes]

how about going down this route
https://www.google.com/webmasters/sitemaps/ping?sitemap=http://www.YOUR DOMAIN.com/sitemap.xml

I already tried a few days / weeks ago. Sitemap is well received but nothing happens in the SERPs unfortunately :/

 

[BlackFawkes]

God damn that sounds crazy, I have 0 experience with SEO, but I will reply here to bump the thread for someone to hopefully see

Thank you ! I really appreciate it

 

[693840]

Is the GoogleBot being blocked in your .htaccess file?

 

[chipsie1102]

What's the specific error GSC is throwing when you submit the sitemap?
Are you on CloudFlare? Sometimes it can block GoogleBot by accident.

Double check your robots.txt, make sure GoogleBot isn't blocked.
Live Test a URL in GSC and see if it has any errors, or if the page is showing different content for the bot - perhaps your website is still hacked and showing different content for googlebot vs users?

 

[200]

It will take a long time for google to forget your indexed pages not matter if you submit the sitemap or not.

Just saying

 

[FatBee]

i guess its time for someone to deobfuscate the malware and find out how they force Google to index.

 

[BlackFawkes]

Is the GoogleBot being blocked in your .htaccess file?

N

Is the GoogleBot being blocked in your .htaccess file?

Nope, already checked. Thanks for the help

 

[BlackFawkes]

What's the specific error GSC is throwing when you submit the sitemap?
Are you on CloudFlare? Sometimes it can block GoogleBot by accident.

Double check your robots.txt, make sure GoogleBot isn't blocked.
Live Test a URL in GSC and see if it has any errors, or if the page is showing different content for the bot - perhaps your website is still hacked and showing different content for googlebot vs users?

Error is HTTP 403. That's why I think GoogleBot is blocked somewhere.
Robots.txt + .htaccess are clean.
And the website is not using Cloudflare.
I'll check to test a live URL but I'm almost sure I did that and it was clear

 

[BlackFawkes]

It will take a long time for google to forget your indexed pages not matter if you submit the sitemap or not.

Just saying

Yes I know that, but at least I would like to submit one ahah

 

[BlackFawkes]

i guess its time for someone to deobfuscate the malware and find out how they force Google to index.

Yes you're most probably right. Headache incoming

 

[200]

Yes I know that, but at least I would like to submit one ahah

And you have tried adding the sitemap multiple times?
Sometimes that works - it's cluncky at times.

 

[BlackFawkes]

And you have tried adding the sitemap multiple times?
Sometimes that works - it's cluncky at times.

I almost raped that "Submit" button

 

[bartosimpsonio]

Hello BHW !

I'm facing an issue I can't resolve, so I hope someone will be able to help me.

One of my client's website has been hacked with Japanese keywords. Basically, the hacker created thousands of pages with Japanese keywords to rank on Google.

The infected pages have been deleted now. But Google index still shows all Japanese pages and not English ones. I can't even submit a new sitemap in the GSC, I get an Http error. Something is definitely blocking Googlebot from crawling the website but I don't know what.

Send help please, this is driving me crazy

Are you sure the hacked pages aren't being cloaked when googlebot crawls them?

 

[BlackFawkes]

Are you sure the hacked pages aren't being cloaked when googlebot crawls them?

How can I be sure ? When I check them manually, everything looks fine.
And every Japanese page indexed in Google is now deleted, so basically every Japanese page indexed is a 404

 

[BlackFawkes]

So in the root of the FTP, the .htaccess file is this one :

# php -- BEGIN cPanel-generated handler, do not edit
# Définissez le package « ea-php56 » comme langage de programmation « PHP » par défaut.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php56___lsphp .php .php5 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit

There are MANY MANY other .htaccess located everywhere (dozains).

There are way more, is this normal? Does an normal e-commerce website have that much .htaccess? Because in my experience, it doesn't.

The website is a prestashop btw.


All those other .htaccess are the same (I didn't checked em all) :

<FilesMatch ".*\.(phtml|php|PhP|php5)$">
Order Allow,Deny
Deny from all
</FilesMatch>

Thanks guys for your help.

 

[bartosimpsonio]

So in the root of the FTP, the .htaccess file is this one :

# php -- BEGIN cPanel-generated handler, do not edit
# Définissez le package « ea-php56 » comme langage de programmation « PHP » par défaut.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php56___lsphp .php .php5 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit

There are MANY MANY other .htaccess located everywhere (dozains).


View attachment 158067

View attachment 158068

There are way more, is this normal? Does an normal e-commerce website have that much .htaccess? Because in my experience, it doesn't.

The website is a prestashop btw.


All those other .htaccess are the same (I didn't checked em all) :

<FilesMatch ".*\.(phtml|php|PhP|php5)$">
Order Allow,Deny
Deny from all
</FilesMatch>

Thanks guys for your help.

You need a clean install. I think the hack is still live.

 

[BlackFawkes]

You need a clean install. I think the hack is still live.

Thank you for your reply. I'm also pretty sure something is still here bugging around. I'll check if we can get an older version of the website (probably not haha)