Crisis SEO Case study

The store looked normal while its server attacked other websites and sent spam

The first clear warning came from the VPS provider, not from the storefront. A security audit showed that the compromised website had become part of a botnet, creating a gradual traffic decline and a reputation problem that required 12 months of recovery work.

Months spent restoring authority

Malicious uses: attacks and spam

STARTING POINT

The Situation

Customers and administrators could use the online store without seeing a broken page or visible malicious message. In the background, the server was participating in attacks and sending spam email.

Problem

The storefront looked normal

There was no obvious customer-facing sign that the website had been compromised.

Problem

The server was being abused

Attackers used the store as infrastructure inside a wider bot network.

Problem

Spam and attacks created exposure

The server targeted other websites and sent unwanted email from the compromised environment.

Problem

Traffic declined gradually

The organic impact developed over time, making it harder to connect with one visible incident.

WHAT MADE IT COMPLEX

The Challenge

The absence of visible symptoms delayed detection. By the time the VPS provider issued a warning, the store had already been associated with malicious activity for an unknown period.

Removing the compromise could stop current abuse, but restoring authority and trust would take longer. Reputation can decline much faster than it rebuilds.

The compromise did not alter the visible storefront

The server supported two forms of external abuse

Detection depended on an infrastructure-provider warning

Organic authority had deteriorated gradually over time

Our Approach

We used the security audit to expose the hidden incident, then treated authority recovery as a separate long-term stage.

Step

Investigate the VPS warning

We treated the provider’s notice as evidence of a wider compromise rather than an isolated server event.

Step

Complete the security audit

The audit confirmed that the website was being used as part of a bot network.

Step

Stop malicious server use

The immediate incident response focused on preventing further attacks and spam from the store’s infrastructure.

Step

Assess the organic damage

We connected the prolonged compromise with the slow decline in the website’s authority and traffic.

Step

Rebuild authority over time

The SEO recovery continued for 12 months after the active security problem was contained.

“

The store looked normal, so the warning from the VPS provider came as a complete surprise. Back2Rank's security audit helped us uncover the activity through the SEO performance decline. They were transparent that removing the infection was only the first step and that rebuilding authority would take much longer. During the following 12 months, the work was steady, clearly reported, and focused on restoring the trust the website had lost.

Emil Terziev, Owner & Senior Developer at Cobweb Software

The Results

The infection was removed. Restoring authority required 12 months.

The website stopped participating in the botnet, but the damage accumulated during the hidden compromise required a year of sustained recovery work.

Earlier detection could have prevented much of that cost. The store’s normal appearance delayed the response, proving that visible functionality is not evidence of a clean server or a protected organic reputation.

Months spent restoring authority

Malicious uses: attacks and spam

Your website looks normal. Is the server behaving normally?

We can investigate security warnings, hidden abuse, and the organic damage that may continue after the infection is removed.