Home Page Deindexed Only at Google after Recovering from Hack Attack

[killthebillion]

Hello, Facing a Strange issue, wordpress blog hghscience[dot]com was hacked by someone, when checked, I found index.php file was changed & it was showing some page with a hacked message, & also index.html file was added to the cpanel account.All pages were showing same message, when I found it, I replaced index.php to default wordpress index.php file & deleted index.htmlI could not find any other file which was looking suspicious. Site started working fine & it was also indexed but cached version was that hacked page. I used webmaster tool to fetch & render it as google bot & submitted for indexing. After that I noticed home page get deindexed by google. Rest all pages are indexing like before. Site was hacked around 30th July & I fixed it on 1st Aug. Since then home page is not getting indexed, I tried to fetch & index multiple time via google webmasters tool but no luck as of now. 1 More thing I Noticed, When I used info:mysite.com on google, its showing some other hacked site ( www.whatsmyreferer.com/ ) When Searching from India But when same info:mysite.com is searched from US a different hacked site is showing ( sigaretamogilev.by )However when I search "mysite.com" my site home page is appearing on google search but when I check cached URL its showing hacked sites mentioned above.As per my knowledge I checked all SEO Plugins, Codes of homepage, can't find anything which is not letting the homepage indexed.PS: webmaster tool has received no warning etc for penalty or malware.

I also noticed I disallowed index.php file via robots.txt earlier but now I even removed that. 7Dj1Q0w.png 3krfp9K.png

[killthebillion]

.htaccess file has nothing but

BEGIN WordPress

<ifmodule mod_rewrite.c="">RewriteEngine On
RewriteBase /
RewriteRule ^index.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]</ifmodule>

END WordPress

Installed Plugins

Yoast SEO, Google XML Sitemaps, Akismat, Udinra All Image Sitemap, Social Share Bar (Digg Digg Alternative), Jetpack by WordPress.com, AuthorH Review.

Apart from Yoast, it seems nothing can block site, and Yoast settings are fine, just disabled tag indexing & subpages along with author archive.

Problem is something else I guess

[_nitman]

Hi Ankit,

Though I have checked for the pages you're serving to bots, could you please have a look at your .htaccess file once? Does it contains something like:

RewriteEngine On 
RewriteCond %{HTTP_USER_AGENT} (google|yahoo) [OR] 
RewriteCond %{HTTP_REFERER} (google|aol|yahoo)

Do you have your code's copy in github or bitbucket or any other source code management tool? If yes, please scan last few commits thoroughly.

You can create a list of plugins installed recently. Remove them one by one and submit your home page URL to GWT for fetching a fresh copy it every time. Not sure what's the issue here, let's do hit-and-trial to deep dive a bit.

[killthebillion]

Hey Alan,

Do let me know if you find some solution or identify the problem.

[_nitman]

That's what. Not able to find any good information to go next-step for this. But, still checking random things with a "hope".

[AlanBleiweiss]

Domaintools domain report shows no more info that could be helpful.  Leaving me at a complete loss as to what else to check.

[AlanBleiweiss]

More info.

Because Nitin was able to run a ping and traceroute without problem, I went to DomainTools.com - the worlds leading resource for forensic digital investigative research. I use it whenever I am doing investigations for expert witness work I do.

When I ran the domain there, it had a screen-capture of the home page from June. So I submitted a refresh, and it came back as not being able to provide a screen-shot of the home page.

While not a smoking gun issue, it further clouds my trust in regard to whether the domain is actually functioning properly in the hosting environment as I originally thought it might not be.

I will run a deeper test to see if I can get more information, however I wanted to post this update because I believe it relevant.

[_nitman]

Well, this is probably 1 of the most interesting issues an SEO can come across with. Google is showing different cached version in different countries. For me, that's strange too. Is that usual thing?

[AlanBleiweiss]

Nitin

Thanks for doing that - Now I'm stumped - I've never had Pingdom fail before with both ping and traceroute.  And I now wonder if it's a non-issue, or part of the confused mess that Ankit referenced somehow.

[_nitman]

That's right, its showing different cached versions in different countries. Just checked for US here. Screenshot attached.

55ymGkF.jpg

[killthebillion]

I think that index.php disallowed was not an issue, I took suggestion and removed it but many sites disallow index.php via robots.txt to avoid duplicate content issue in site.com & site.com/index.php

here is an example - http://www.shoutmeloud.com/robots.txt

Still I did it about 10-12 days ago, fetched & submitted to index & also put rendering request.

Attaching current Screenshot of last rendering request.

I think some other issue, what's your view on that info:site.com showing some other hacked sites, how's this happening & sites are also changing. Its different in India, Different in US.

dRHCC0v.png

[_nitman]

Ping and traceroute worked for me when I tried using my terminal (screenshot is attached).

Well, I agree that the problem is actually bigger. If you see its cached version on google, it was last cached on 16th Aug i.e after the issue of index.php/index.html was fixed by the admin (another screenshot attached).

I tried to see this page as googlebot as well, couldn't find the issue (wanted to check it for cloaking as well).

0xR3w7s.jpg r8i8Chi.jpg

[AlanBleiweiss]

UPDATE TO MY ORIGINAL COMMENT

I initially found a problem doing a ping and traceroute test using Pingdom.com - both returned an "invalid host name" error, something I have not seen previously for both ping and traceroute simultaneously.

Nitin (see his comment below) did a similar test locally and found both to be okay.  Though he has other thoughts.

I just wanted to clarify here now, that my original finding may not be a key to this issue, though I want to understand why my test came back that way...

[MoosaHemani]

You said you remove the index.php from the robots.txt. I just wanted to when did that happened? Because after removal, it usually took some time to get back in index (crawler need to recrawl the website accordingly).

My advice is to resubmit your robots.txt and updated sitemap.xml to Webmaster console and wait for the next crawl and this should be fixed.

Hope this helps!

[killthebillion]

Just sent SC, Nothing helped so far, Its quite strange that the info:domain.com is now showing some other hacked URL. SC attached.

yhGZD77.png

[killthebillion]

It was quite strange for me as well, Just attached Screen Shot after fetching for 1 more time.

1 more thing I noticed, that info:mysite.com is not showing some other Hacked domain. Not sure How it's happening & why It's happening.

Sorry for the delay in reply, I was not getting email updates so I though no one answered my question.

NDq8vSD.png

[MattRoney]

Hi Ankit! Did Nitin's suggestions help at all? And are you able to share the screenshot he asked for?

[_nitman]

Check the following, may be it'll help you resolve the issue:

https://moz.com/community/q/de-indexed-homepage-in-google-very-confusing

https://moz.com/community/q/site-de-indexed-except-for-homepage

[_nitman]

That's really strange. Could you please share the screenshot when you're trying to fetch it as google in the GWT?