-
Can SEO Recovery Actually Work After a Severe Website Hack?
Posted by on May 26, 2026 at 11:49 amI have a project that got hijacked, and around 70k pages were indexed through code injection, which automatically created pages without publishing even a single page manually.
It has been around 6 months since the issue. Now all the spammy pages are de-indexed from Google, and a few more quality posts have been published, but those posts are not ranking even in the top 100.
Is it really worth leaving the project, or are there still some practices that can help the website regain its ranking potential?
At a quick glance, it is getting some impressions, nearly 1.5k in the last 3 months, with very few clicks, which I think are accidental clicks. As per Semrush, its authority is 4, with 42 referring domains, including a link from highly moderated Wikipedia page. As per Ahrefs, its authority is 39.
Yes, I understand its authority is low, but I have 3 more similar projects that have around 80k impressions in the last 3 months and good conversions.
Also, I have targeted very, very low-difficulty keywords on which hardly anyone has written content, and still, highly optimized articles are not ranking for those keywords. These are some reasons confusing me about whether it is really practical to recover a site or if it is just another theoretical checklist given by SEO guys?
-
1 Reply
-
Automod has automatically removed this content. Your comment karma from this subreddit is low. Please engage with other threads before posting or improve your Contributor Quality Score on Reddit (CQS). To improve your CQS, focus on commenting over posting and avoid low-quality, reproduced posts across multiple subreddits.
*I am a bot, and this action was performed automatically. Please [contact the moderators of this subreddit](/message/compose/?to=/r/SEO) if you have any questions or concerns.*
-
A hacked site can recover, but in my experience the timeline is usually way longer than people expect once Google has seen tens of thousands of injected pages. Six months honestly is not that long for a domain that got flooded with 70k spam URLs.
The fact that impressions are still coming in is actually the more interesting signal to me. Dead domains usually flatline completely. If Google is still testing pages, the site probably isn’t fully written off yet.
What I’d check first is whether the site still has any trust issues beyond indexing:
* Are old hacked URLs still returning 200s anywhere?
* Did the injected pages attract toxic backlinks that are still indexed?
* Is crawl budget getting wasted on junk parameter URLs or archives?
* Did the hack affect templates/sitewide internal linking?
* Are important pages actually getting crawled regularly in GSC?One thing I’ve seen a lot is people clean the hack itself, but they leave behind thousands of soft-404 or weird low-value URLs. Google keeps associating the domain with spam quality signals even after the visible issue is gone.
Also, low KD keywords don’t always matter after a hack. A healthy domain can rank with weak links. A damaged one often struggles even on easy terms because Google stops trusting the site-level quality signals.
Personally, if the project still has:
* clean indexing now
* some impressions growing slowly
* decent historical backlinks
* content that matches search intent well…I probably wouldn’t kill it yet. I’d give it another few months while aggressively tightening technical SEO and publishing consistently. But if after a sustained cleanup period pages still cannot break into top 50 for genuinely easy queries, that’s usually when I start considering whether the domain itself is burned.
-
[removed]
-
I’ve seen hacked sites recover, but usually way slower than people expect. If Google saw 70k junk pages, trust probably got wrecked at the crawl/index level, not just rankings. The fact you’re still getting impressions is at least a decent sign though.
Personally I’d look hard at crawl stats, indexing patterns, and whether Google is actually revisiting the new content properly. Sometimes the site is “clean” but still treated like low-quality/generated spam for months after.
Log in to reply.