Amit Tiwari's amittiwari.net site hacked!, True Case Study

Hello friends!
Imagine if your website, Which your identity is linked, which is the result of years of hard work, suddenly gets hacked one day. Scary, isn't it?

But when this happens with a client, we SEO people say very calmly – "Don't worry, we'll handle it."

But when it comes to your website?

Mr. Amit Tiwari – whose name needs no recognition in the world of digital marketing and SEO Expert – has his website. amittiwari.net Got hacked intentionally!

What madness was this?

Now you might be thinking, “Why does anyone need to get their website hacked by themselves?”

So the answer is – a practical experiment।
Yes, you heard it right.

Mr. Amit Tiwari has always been accused of talking only about theory and not showing practicality.

So this time he decided to do something which no one has done till now.

"What will you do if SEO's website becomes at risk?"

So what, they infected their main website – amittiwari.net – with malware, that too as a live case study.

How was the website infected?

Now let's talk about the real issue – how did the website get infected?

So what happened was that he installed a cracked version of a very popular plugin – ACF Pro in WordPress.

Cracked plugin = invitation to risk 

This cracked version had an old vulnerability, which was fixed by an update in the original version, but not in the cracked one.

So that's it – installed the plugin and waited for a few days.

Close to 12 to 14 days. Their website got hacked.

• His password stopped working.
  
  
• New folders started being created on the website.
  
  
• Unknowingly created admin accounts.
  
  
• Strange URLs with Japanese keywords started appearing on the website.
  
  
• Even in the sitemap, random and fake URLs started appearing.
  
  

The pain was not only professional but also personal.

You will be surprised to know that amittiwari.net is not a test site.
This is their real website, which is live from 4th Feb 2011.

Not only is his SEO career linked to this website, but it is also his brand.

More than 75,000 fake URLs were visible on Google!

When he searched site:amittiwari.net, over 75,000 URLs were indexed – and many of these were only in the sitemap, not on the actual site.

Now you might be thinking – OMG! Such a big website, and that too got hacked!?

The login URL was also custom, still...

Here was another surprising thing –
The login URL of Amit's website was also custom, i.e.,/wp-admin instead of something else. Still, the hacker got in!

That is, if you are thinking that changing the login URL makes the website safe, then you are wrong.

If you even once nulled/cracked plugin or theme If you have used it, then just consider that you have opened the latch of your house.

The real way to clean your website – with free tools!

So now that the website was hacked, the most important thing was – Locking and cleaning the website।

Now Amit Tiwari did not use any expensive paid tools, but only free tools recovered the website with the help of.

Step 1: First, log in to the hosting's CPanel.

Since the admin password was not working, Amit entered the website through CPanel and from the WordPress Users section:

• One trusted admin except deleted all other users।
  
  

 If you have multiple authors or writers on your website, keep in mind – Don't delete their account, otherwise the content will be blown away.

 Step 2: The Wordfence Plugin uses to Malware Scan

Now in WordPress Wordfence Security Plugin (Free Version) is Installed.

• By installing the plugin "Scan" tab is clicked on.
  
  
• Within a short time, the entire website was scanned.
  
  

And after the scan, I saw a lot of suspicious URLs or directories:

• strange files
  
  
• unknown folders
  
  
• hidden JavaScript payloads
  
  

Some of these URLs were also in the sitemap, but were not present on the website.

Step 3: The magic of Delete and Repair

Now, Wordfence gives you two options:

 Delete –

This happens for those files that are not the original files of WordPress.

•  That is, if these are external malware files, then safe to delete them 

Amit said, "Delete all." Clicked on it and deleted all the unknown/malware files.

Repair –

Now it was the turn of those core files of WordPress, in which malware had added some lines.

As soon as you press the repair button –

•   Wordfence did infect core files in clean, original files by replacing them.

Now the website was completely malware-free! 🎉

75,000+ Fake URLs were now showing 404!

Now Amit again searched site:amittiwari.net.

URLs with all suspicious Japanese keywords now 404 Error.
That means these URLs were now removed from the website – the site was cleaned!

Final Confirmation via Chrome Dev Tools

Opened Dev Tools and also checked that the response code on all unwanted URLs, 404. Is he coming or not?

 If any URL gives a 200 or a redirect, then the malware was still there.

But wait! Google is still showing these URLs!

The website may have been cleaned, but all those Japanese URLs were still visible in Google Search.

Now the next work was – Removing these URLs from Google Search Console and regaining the SEO reputation of the website.

 What can to learn from this case study?

1.  Never use cracked plugins or themes, no matter how much it seems to save money.
   
   
2.  CPanel access is your last door - if the password does not work, save from there.
   
   
3. Wordfence Free Version can do a lot more, too – especially the delete and repair options.
   
   
4.  Just cleaning the website is not enough; removing fake URLs from Google is also important.
   
   
5.  Real-Time Cleanup = Real SEO Protection
   
   

Conclusion

This case study of Amit Tiwari teaches us that just learning SEO is not enough –
Website security is also a part of SEO.

And the biggest thing –
If you want, you can remove your website from risk even without paid tools.

Bonus Tip

If you also want to increase the security of your website, then:

• Take regular backups
  
  
• Use only verified plugins/themes
  
  
• Customizing the login URL is nice, but it has no permanent protection
  
  
• Make sure to scan once a month with tools like Wordfence or Sucuri.