Hacker Adds Thousands of Pages to a Site in Attack

A website owner noticed that hackers had taken over their site and implemented thousands of changes. Those changes included adding custom site maps and thousands of new pages. This person noted that they make a daily backup. They asked a large website ownership discussion group about whether or not they should restore the site back to the day before the hacking took place.

The first commentator stated that the original poster should indeed do this. This person also added that the original poster should go to their Google Search Console page and get rid of anything that is listed as a harmful page. The rest of the pages can go unindexed and will eventually drop off the Google search results if the original poster does not take any additional actions.

Another commentator suggested that the original poster find and fix any vulnerabilities that allowed the hacking to take place. Their suggestions included WordPress and Joomla plugins, admin logins, file and folder permissions and passwords for FTP and SQL files and databases. The original poster agreed and said that they use WordFence, so they will run a scan and change the logins once they restore the site to where it was before it got hacked.

Someone else added comments that setting the site to a day before the hack might remove all the nefarious pages, but it might not. It is possible that the hacking took place well before, and only recently did the new pages load.They said it sounded like a MySQL injection of code. If the code is still there, then those thousands of pages will recreate themselves again within a short period of time.

A person agreed with that individual who surmised that the original poster was hit by a MySQL injection attack. The code has to be located and removed, otherwise it will just run over and over. All it takes is an out-of-date WordPress frame or something similar for a hacker to gain entry into a site, upload code and do whatever they want while the code runs in the background for days or even months. For more information click here https://www.reddit.com/r/SEO/comments/kq5wbg/websitewashackedandhackeraddedcustom/.