Case Study: The Redirect Website Project (Episode 2)

Merry Christmas guys.

I have an update on the redirect project.

I haven’t really been working on the site over the past few weeks as I wanted things to settle naturally on their own. First off, the rankings. In the last update, these were the rankings for new domain that I’ve done a 301 redirect to:

That was 10 days ago.

Today, here are the rankings:

Well, an average of position 86 is an improvement. However, I expected that the site would be ranking better than it is. As I checked my ranking report, I noticed most of the “money” pages that I’d copied from the old site were not ranking. I wondered why. Could it be be due to duplicate content?

I did a quick search on Google and saw that the site URLs were already indexed, So, I decided to check the content, just a by the way. Guess what I found? This below.

Yes, apparently my site had been hacked again and I had no clue. What the hacker did is change the site Title and put a lot of gibberish content on the posts/pages. Here is one of the posts and how it looks like:

So, could this be the reason why the posts I expected to be ranking not be performing well? I don’t know.

I am trying to clean up the site, and will go through every post to see whether they have been changed. Some posts were not affected by the hacker and those are the ones that are ranking in the SERP lab report above.

I am suspecting this is a database intrusion as the way it is right now, any new content I post  turns out gibberish on the output. Should be some JavaScript or something.

Time to clean my website database.

Have a Merry Christmas!

UPDATE: ToC Plugin is the Culprit

After doing a couple of troubleshooting, I found out that he gibberish text was being output when the Table of Contents plugin is activated. Now, I do not know whether the plugin has a vulnerability or if this is something that the hacker took advantage of to penetrate my site. But what I’ve found it is that when I disable the plugin, the gibberish content disappears.

I’ve deleted the plugin and the problem has disappeared. So, how the plugin came to be hacked is something I really don’t know