Reported at the historical high point, not a measure of traffic, rankings or revenue.
CASE STUDY / INSURANCE
How We Removed Website Malware and Cleaned Up Google's Search Results for an Insurance Company
An insurance website infection, confirmed malware removal, and the multi-day work to clear Google's search listings.
- Malware removal
- Google search cleanup
Reported historical results
Malware cleanup completed at the application and server levels.
Japanese spam characters no longer appeared in branded Google search results.
The client’s Google listings were reported clear of the spammed pages.
Historical incident: December 2022 to January 2023. Reported cleanup milestones, not current security guarantees or promises of similar recovery times.
What Happened
Website Goes Down
Danielle Peffers received a notification that an insurance client's website was offline. Chrome displayed a critical error.
The hosting provider initially attributed the problem to the website's design. Our developers attempted to restore a backup and disabled plugins to investigate, but neither approach brought the site back online.
The client was notified. The hosting provider subsequently restored a backup, bringing the website online.
- Early January 2023
Security Concerns
Matt LaClear advised the client to hire a developer to investigate and clean the suspected infection.
Search Spam Discovered
At approximately 2:30 PM, the client reported Japanese characters appearing in Google's search listings.
At 2:54 PM, Matt informed the client that our team would handle the malware cleanup to protect the site's search visibility.
Sucuri detected malware at 4:37 PM.
Malware Removed
Our team completed malware cleanup at the application and server levels.
A subsequent Sucuri scan reported the website free of malware.
- January 5–17, 2023
Google Cleanup
On January 5, branded search results no longer displayed the Japanese characters.
By January 17, the client's Google listings were reported clear of the spammed pages.
What Our Team Did
Investigating the infection, removing malicious content and strengthening website security.
Cleaning up Google’s indexIdentified and Removed the Infection
Our developers investigated the website and server, removed malicious content and verified the cleanup using Sucuri.
Strengthened Website Security
Wordfence had been deactivated when the developer investigated. It was reactivated for internal scanning.
The WordPress administrator password was changed, and the developer hardened the application-side security.
The original account reports twice-daily malware scans, internal-link audits and an external penetration test that found nothing critical.
These activities were performed or reported during this historical incident. They are not a guarantee of ongoing protection or that malware cannot return.
Investigated the Attack
The investigation uncovered suspicious administrator activity, including a login associated with a Russian IP address, and evidence of malicious files.
The developers suspected administrator access was involved. A vulnerable plugin was also considered as a possible entry point.
Removed Malicious Website Content
The team discovered phishing pages, spam links inserted into existing content and thousands of injected spam pages.
The damage went beyond the website: malicious URLs appeared in Google's index, and Japanese characters appeared in branded search listings.
Cleaned Up Google's Index
The number of indexed pages rose dramatically, with the historical account reporting more than 51,000 malware pages at the high point.
Google Search Console was used to identify affected URLs. The team submitted URLs through Google's removal process and worked through the backlog over multiple days.
By January 17, 2023, the client's Google listings were reported clear of the spammed pages.
Need help with an infected website?
Talk with our team about the infection, your website and the cleanup work needed. Every incident requires its own investigation.