Site's disappearnce in web rankings

[Gavo]

I'm currently doing some work on a website: http://www.abetterdriveway.com.au.

Upon starting, I detected a lot of spammy links going to this website and sort to remove them before submitting a disavow report.

A few months later, this site completely disappeared in the rankings, with all keywords suddenly not ranked. I realised that the test website (which was put up to view before the new site went live) was still up on another URL and Google was suddenly ranking that site instead. Hence, I ensured that test site was completely removed. 3 weeks later however, the site (www.abetterdriveway.com.au) still remains unranked for its keywords.

Upon checking Web Master Tools, I cannot see anything that stands out. There is no manual action or crawling issues that I can detect.

Would anyone know the reason for this persistent disappearance? Is it something I will just have to wait out until ranking results come back, or is there something I am missing? Help here would be much appreciated.

[Travis_Bailey]

Thanks. Let us bask in the warm glow of Motorhead.

[Gavo]

Thanks Travis.

You're ace!

[Travis_Bailey]

Great to see that you got it cleaned up. Though I think blocking /images via robots.txt is going a little too far. But that's just me.

But you've pretty well taken care of some of the common issues that will give you problems from any script kiddy.

[Travis_Bailey]

Not a problem. Exit through the gift shop.

I can give it another glance once you think it's cleaned up. Seriously though, make sure to check your MySQL file for any suspicious users. This may have been 'low and slow', as in the attacker may have got in much earlier.

[Gavo]

Thank Travis. You're a star. Best Moz Q&A Moz response ever! I'll look to implement a site restore from a clean backup and then take it from there.

[Travis_Bailey]

Not a problem. I'm just a sucker for constantly saying; "Scan.... enhance... scan... enhance..." Don't judge me.

[KeriMorgret]

Thank you Travis, for all of this help!

[Travis_Bailey]

Alright. Good for my word like Colt 45. Here goes:

The site is definitely hacked. Viagra, Propecia, Cialis and Levitra  pointing to other hacked sites in the footer.  Pretty much every language in Western Europe was targeted. Nice, huh?

My scan yielded that the Advanced Custom Field plugin is outdated and vulnerable. ACF may not show up in your list of plugins. Some devs prefer to put ACF somewhere else and call it via functions.php. (All other plugins scanned appear to be up to date.) That will take a bit of detective work on your part. Also, they may have previously used a theme called Expose. It is vulnerable as well. If you aren't using it, get rid of it.

I would hazard a guess that they got in through the ACF plugin, however.

My scan, oddly enough, wouldn't render a list of users and administrators. It usually does. So I would double check and make sure everyone is there that needs to be there. They can hide themselves from the WordPress GUI, but I doubt they can hide themselves at the MySQL level. So be careful when checking that out. MySQL is unforgiving.

This is definitely going to be messy business. I hope you have backups, that are free from the XSS attack.

In the future, I like what this guy says about Wordpress Security. It will be your friend. But the cleanup will likely be difficult if you don't have any clean backups.

Further, since nothing exists in a vacuum, the site's link profile is less than enviable. Though I would start with the hack cleanup.

Hopefully this is helpful. I have a bleeding heart for small businesses.

PM me and and we can work out a way to send files your way. But I think everything should be apparent at this point.

[Travis_Bailey]

The site has been hacked. Let me put some more stuff together, but you will notice; "This site may be hacked" on search results under the URL when you do a site: operator search. See here: https://www.google.com.au/?gws_rd=ssl#q=site:abetterdriveway.com.au.

You should have received a message via GWT informing you of this. It's kind of odd that you didn't.

All I know is that I'm not going there on my Windows machine. Let me check it out with my 'down and dirty' rig. I'll get you some specifics a little later in the day.