A US venture fund that backs AI companies in healthcare runs its website on WordPress. It’s the first place founders and investors check before a meeting. At the client’s request, the fund’s name is kept private here.
The problem
The site had been hacked, cleaned by someone else, and hacked again. Google had indexed thousands of spam pages under the fund’s domain: online casinos, roulette “strategies” and betting apps, written in Polish, Italian, Spanish, Dutch and Portuguese. A search for the fund showed gambling pages instead of its portfolio.
The client messaged me late at night her time. It was past midnight in Bangladesh too, but the site needed to be fixed that day, so I started right away.
What I did, through the night
1. Assessment
- Mapped the spam in Google and collected the URL patterns the hack used.
- Found two extra staging sites on the old hosting, one of them likely left behind by the attacker.
- Found the premium theme was running without a valid license, so it had missed security updates. The client bought a genuine license and I installed the clean, official copy.
2. Cleanup and migration to SiteGround
- Moved the site off the old hosting to SiteGround for better performance and stronger security.
- Moved only clean files: fresh WordPress core, the licensed theme and clean plugin copies, with the uploads checked for hidden PHP backdoors.
- Cleaned the database of injected spam content.
- Had the site live and loading from the new hosting by around 4 a.m. my time.
3. Locking out the attacker
- Reviewed every admin account. A former contractor’s admin user was still trying to log in repeatedly from an outside IP address, so with the client’s agreement I removed it.
- Had all remaining admin passwords changed and kept only the accounts the client actually uses.
- Advised removing the leftover sites from the old hosting entirely.
4. Getting the spam out of Google
- Made sure every spam URL returns “not found”.
- Submitted the spam URLs to Google for removal. Within a day they were gone from the results.
Before and after
Before, a search for the site returned page after page of casino spam. After, Google shows only the fund’s real pages.
Where it stands
The site is clean, running on SiteGround with a licensed, up-to-date theme, and the old admin access is gone. The whole job was finished ahead of the two-day deadline.
Spam pages showing up under your domain? Let’s get your site cleaned up.
