Your website may be publishing pages you never wrote

Why nothing looks wrong when you visit your own site

This campaign does not deface anything. Your homepage, your menu and your content keep working exactly as before, which is the point: nobody reports a problem they cannot see.

1. Someone signs in with administrator rights. Not through a plugin exploit. In every case I have been able to reconstruct, the entry point was a password, either to WordPress or to the hosting control panel.
2. Pages are written straight into your database. One site I examined has 17,509 of them behind six real pages. Another has 6,385 posts behind 17 pages.
3. Nothing links to them from your navigation. They are reachable only by direct address, so a normal visit to your site reveals nothing.
4. Your robots.txt is edited to hand them to Google. Extra sitemap entries are added, and the SEO crawlers that would let you spot the link network are blocked by name.

The damage is not cosmetic. Google eventually decides your domain is a gambling site, and the ranking you built for your actual business goes with it.

Three checks you can run yourself in two minutes

You do not have to take my word for any of this, and you should not have to. Each of these works from your own browser, without logging in anywhere.

1. Search Google for site:yourdomain.com casino. If pages come back that you did not write, they are on your domain and indexed.
2. Open yourdomain.com/robots.txt. Sitemap lines pointing at files like sitemap27.xml, which your SEO plugin never created, mean someone added them.
3. Open yourdomain.com/wp-json/wp/v2/users. Every administrator account is listed there. On the sites I examined, names like wpfeed, blogfeed and notesfeed were created by the attacker.

If any of the three comes back positive, the important part is what comes next, and the order matters more than the tools.

Cleaning the pages first is how sites get reinfected

Most cleanup services delete the injected content and stop there. Within a day the same pages are back, because whoever put them there still has the password. Access comes first, content second. That means every administrator password, the hosting panel password, new session keys so existing logins are invalidated, and only then the pages, the sitemaps and the Google removal requests.

If your site shares a hosting account with other domains, and many small business sites do without their owner knowing, the account itself has to be treated as compromised, not just your folder in it.

Fixed prices, no hourly billing

Three working days on any of the three. You hold the hosting account and the domain afterwards, not me. Ongoing monitoring, a daily scan with an alert within the hour, is 39 GBP per month and entirely optional.

And if you would rather hand this to your own developer, say so and I will send the full technical findings for your domain free of charge. That offer stands whether or not you buy anything.

Who is writing this

My name is Marek Porycki. I run WP Page, a small web studio in Poland that builds and maintains websites for clinics, law firms and service businesses, under Broker Business sp. z o.o. in Bialystok. The security research behind this page is my own: the campaign, the 73 affected sites, the reconstruction of how the attackers got in.

Two things you should know before hiring anyone from abroad. My main website is in Polish, because my clients are Polish, and this English page is new. And I work remotely, so everything happens over email, phone and screen sharing. If that is a problem, I would rather you found someone local than discovered it halfway through.

What you get instead of a local handshake: fixed prices agreed in writing before I start, the hosting account in your own name so you are never locked in, and a written report of what was found and what was changed.