From Hacked to Ranked:
Best Lead Source in 56 Days
A malware injection quietly published 28,000 casino and gambling pages under a custom home builder's domain. Here's how we cleaned it, rebuilt it from scratch, and turned it into their strongest lead channel.
Before relaunch vs. first 56 days after
(101-day pre-launch window vs. 56-day post-launch window, normalized per day)
+178%
organic clicks per day (3.0 → 8.3)
+536%
impressions per day (149 → 951)
13.4
average positions gained (27.0 → 13.7)
~21K
spam URLs de-indexed in 3 weeks
Google Search Console · 12-month performance · timberdesignbuild.com
770 clicks · 68.3K impressions · avg. position 16.6 · 12-month window. Site relaunched May 26, 2026. Source: GSC, exported July 2026.
The situation
Two decades of craft. A website publishing casino content in six languages.
Timber Design + Build had the hard part figured out. Two decades of craft, a licensed GC on the founding team, an in-house millwork division, and a portfolio of Hudson Valley homes that sells itself in person. What they didn't have was a website that could survive on the internet.
Their WordPress site had been compromised by a malware injection. The attack didn't deface the homepage — that would have been obvious. Instead it quietly generated tens of thousands of spam pages on their domain: casino, sportsbook and gambling content in English, German, Polish, Spanish and Russian, all published under a family construction company's name.
By the time we pulled the Search Console data, Google had discovered more than 28,000 URLs on the domain. Fewer than 200 of them were real.
What that actually cost them: A $400,000 custom home is not an impulse buy. Every one of those searches was someone in a nine-month research cycle. In the three months before the site came down, it averaged 3 clicks a day and sat at an average position of 27 — page three of Google. They were losing every one of those buyers to competitors.
- Legitimate pages buried inside an index full of junk
- Hundreds of spam backlinks — including an injected cluster of German domains — pointing at the site
- Site still being served and indexed over plain HTTP
- Search visibility flatlined at position 27 — page three
The approach — four jobs running in parallel
There's a version of this job that's just "clean the malware and move on." That version fails, because a cleaned WordPress install is still a WordPress install with the same attack surface — and because cleaning the infection does nothing about the 28,000 spam URLs already sitting in Google's index.
Rebuild, don't disinfect
Rebuilt the entire site from scratch on Astro and Tailwind, deployed on Replit Autoscale. Nothing was migrated — no database, no plugin directory, no uploads folder. Malware injections live in exactly those places, so a migration usually carries the infection forward.
Building static-first also removed the attack surface permanently. No PHP layer, no plugin ecosystem, no admin login for a bot to brute-force. The rebuild shipped as a 195-page architecture: service pages, county and town service-area pages, a portfolio, and a resource library.
Remediate the index — the part most agencies skip
Getting 28,000 spam URLs out of Google took a deliberate technical sequence — not just a "remove URLs" click.
- Removed malware-planted sitemaps and submitted a clean one, so Google stopped re-discovering junk
- Made sure spam URLs returned true 404/410 responses instead of soft 404s — a page returning a 200 status with an error message sits in the index indefinitely
- Unblocked spam paths in robots.txt — counterintuitive, but blocking a URL prevents Google from crawling it, which prevents Google from confirming it's gone
- Used the Removals tool surgically, only on spam visible in live results, using prefix removals where shared paths existed
Result: ~21,000 spam URLs de-indexed within three weeks. From 28,258 down to 7,395.
Clean the backlink profile
Full backlink audit reconciling Semrush data against Google Search Console. That cross-check mattered: GSC surfaced a cluster of German hack-injection domains, with hundreds of linking pages, that Semrush had missed entirely. Neither tool had the complete picture on its own.
137 referring domains categorized. 126 disavowed — hack-injection clusters, casino comment spam, scraper farms, PBN networks, and link shorteners.
Honest note: a disavow file rarely moves rankings on its own. Google discounts most organic spam algorithmically. This was cheap defensive hygiene given the hack history. The 404/410 de-indexing did the actual heavy lifting.
Rebuild the search footprint — for Google and for AI
Local SEO: 61 service-area pages across four counties. The first version came back "Crawled — currently not indexed" — Google's way of saying "templated filler." Rebuilt around genuinely local, verifiable detail: real housing stock, real architecture, real geography. Hard rule: no invented statistics, testimonials, or project counts.
Resource content: 68 articles built around the questions people actually type before hiring a builder — cost, timeline, materials, process, contracts. Their single best-performing page is now a cost guide, not a sales page.
AI / answer-engine optimization: Answer-first openings, comparison tables, question-shaped headings, FAQPage schema, named licensed-GC byline. Structured to be the source ChatGPT and Perplexity cite — not just the link Google shows.
CRM automation: GoHighLevel as the backend — forms posting to structured custom fields, instant SMS notification to the team, missed-call text-back, review requests, UTM tracking. Rankings that don't turn into conversations are decoration.
The results
The site was offline for roughly seven months during the compromise and rebuild — which gives an unusually clean before-and-after. All figures normalized per day because the windows are different lengths.
| Metric | Before (101 days) | After (56 days) | Change |
|---|---|---|---|
| Clicks per day | 3.0 | 8.3 | +178% |
| Impressions per day | 149 | 951 | +536% |
| Average position | 27.0 | 13.7 | 13.4 positions |
| Best single day (impressions) | 523 | 1,409 | +169% |
| Best single day (clicks) | 8 | 20 | +150% |
Momentum has kept building rather than spiking and fading. Comparing the first 30 days after relaunch to the most recent 30:
| Metric | First 30 days | Most recent 30 days |
|---|---|---|
| Clicks | 231 | 269 |
| Impressions | 26,674 | 31,471 |
| Average position | 13.9 | 13.4 |
Where the visibility lives now
The site currently ranks for over 1,000 distinct search queries — 990 of them non-branded, meaning people finding Timber who had never heard of Timber. 297 of those queries rank on page one. 51 rank in the top three.
| Section | Pages | Impressions | Clicks |
|---|---|---|---|
| Resource library | 68 | 18,668 | 110 |
| Service-area pages | 61 | 14,621 | 73 |
| Service pages | 10 | 8,213 | 56 |
| Homepage | 1 | 21,303 | 297 |
Standout pages from the last twelve months:
One honest note on CTR: click-through rate reads lower after the rebuild (0.88% vs 2.01%). That's dilution, not decline. Before the rebuild the site appeared almost exclusively on narrow branded searches, which naturally convert high. It now appears on a search footprint more than six times larger, much of it broad top-of-funnel. Clicks per day still nearly tripled. We'd rather show the real number and explain it than quietly drop the metric.
What's next
The recovery phase is finished. The work now is growth:
- Continued topic-cluster content production targeting AI citation — millwork and kitchen clusters live, more in the pipeline
- Deepening service-area pages with local project and permitting detail
- Completing the CRM automation build — nurture sequences, review generation, social distribution
- Moving the resource library's strongest pages from page-one positions into top-three positions
Most agencies do one half of this. The SEO firm hands you a strategy deck and tells you to find a developer. The developer builds you something pretty and shrugs at the rankings question. This project needed both, at the same time, under pressure — emergency rebuild, forensic index cleanup, backlink remediation, local SEO architecture, AI-era content strategy, and CRM automation. One team, one accountable throat to choke.
Website hacked, penalized,
or just not producing leads?
A technical audit will find exactly what's costing you. Starts at $19.99.
Get Your Audit →