-
A hacked site can recover, but in my experience the timeline is usually way longer than people expect once Google has seen tens of thousands of injected pages. Six months honestly is not that long for a domain that got flooded with 70k spam URLs.
The fact that impressions are still coming in is actually the more interesting signal to me. Dead domains usually flatline completely. If Google is still testing pages, the site probably isn’t fully written off yet.
What I’d check first is whether the site still has any trust issues beyond indexing:
* Are old hacked URLs still returning 200s anywhere?
* Did the injected pages attract toxic backlinks that are still indexed?
* Is crawl budget getting wasted on junk parameter URLs or archives?
* Did the hack affect templates/sitewide internal linking?
* Are important pages actually getting crawled regularly in GSC?One thing I’ve seen a lot is people clean the hack itself, but they leave behind thousands of soft-404 or weird low-value URLs. Google keeps associating the domain with spam quality signals even after the visible issue is gone.
Also, low KD keywords don’t always matter after a hack. A healthy domain can rank with weak links. A damaged one often struggles even on easy terms because Google stops trusting the site-level quality signals.
Personally, if the project still has:
* clean indexing now
* some impressions growing slowly
* decent historical backlinks
* content that matches search intent well…I probably wouldn’t kill it yet. I’d give it another few months while aggressively tightening technical SEO and publishing consistently. But if after a sustained cleanup period pages still cannot break into top 50 for genuinely easy queries, that’s usually when I start considering whether the domain itself is burned.
