Case study · security, SEO, e-commerce
A CBD shop that was at risk of disappear from the web.
The story of how an SEO cloaking attack turned a WordPress redesign into a full Shopify migration.
It was supposed to be a makeover.
Initial contact began in December. The request was to modernise and simplify the use of a WordPress and WooCommerce e-commerce site in Berlin.
In January, I started working on the existing site. It seemed to work, although it was very slow. Products, pages, and orders were still accessible. The actual problem wasn't evident during normal browsing.
The discovery
The first sign was on Google.
A simple search.
The first anomaly emerged while looking for site:hempvizer.com. Instead of just the catalogue, there were about 1.5 million URLs: numeric parameters, random paths and pages .phtml never created by the shop.
The real domain was used to make content that did not belong to Hempvizer appear on Google.
Numeric parameter never created by the store and stored in the Google index.
A pattern foreign to WordPress, WooCommerce, and the actual catalog structure.
Reconstruction based on the URLs documented during the analysis. The original results were subsequently removed.
Search Console measures the extension.
After the initial detection, Google Search Console allowed us to verify the abnormal growth of the index and distinguish real pages from URLs generated by cloaking.
The site displayed the store to people, while crawlers could receive different content. This is what makes cloaking difficult to detect: the site can appear normal even to those who manage it every day.
In simple words
What is SEO cloaking?
Cloaking occurs when the same address returns different content depending on who visits it. A person sees the real site; a search engine crawler may receive a page specifically crafted to enter the index. In the case of Hempvizer, it wasn't a function of the store, but the behavior produced by malicious code.
He sees the shop.
The homepage, products, and checkout appear to be working. For the site manager, the problem may therefore remain hidden.
He gets more.
Spam pages, texts, or extraneous links become associated with the domain and can multiply in the index.
Google discovers thousands or millions of URLs that are not part of the actual site.
Legitimate pages compete with spammy content hosted on the same domain.
By opening the site normally, the owner and visitors may not notice anything.
The diagnosis
The code was still inside WordPress.
A component that did not appear among the normal plugins.
Analysis of the installation revealed a suspicious MU-plugin, with obfuscated code and communications to external resources.
Must-use plugins are automatically loaded by WordPress and can be left out of the normal plugin list. This behavior was consistent with generating different content based on the received request.
The project changes direction.
Rebuilding the theme would have meant building a new look over a compromised installation. The suspicious code was removed, but the risk of other unseen access or persistence mechanisms remained.
Shopify was chosen to separate the new store from the previous environment: not as a shortcut, but as a structural reduction of the attack surface on the hosting, PHP, and plugin sides.
The migration
Keep the business going. Change what was underneath.
Clean catalog
Products, variants, images and necessary content, without transferring plugins or PHP files.
WooCommerce → Shopify
Collections, navigation, two languages, and purchasing flows rebuilt on the new platform.
Go-live in mid-February
Domain and store maintained, with a more streamlined shopping experience.
Technical SEO
The 301s only where needed.
Save real pages, not spam.
WooCommerce and Shopify use different URLs. To preserve the value of legitimate pages, 301 redirects were created between old products, categories, pages, and new destinations.
The URLs generated by the malware were not redirected to the homepage. Parameters such as ?he=... and routes .phtml they had to leave the index, not transfer their history to the new platform.
Work continues after publication.
Google needs to revisit the addresses, recognize the ones that no longer exist, follow valid redirects, and replace the old structure with the Shopify one.
We then continued monitoring in Search Console, checking 404s, requesting removals, and checking the indexing of new pages.
The result
A new e-commerce, without carrying the old problem with it.
Hempvizer retained the domain, catalog, business logic, and store continuity, but not the compromised WordPress code.
The new structure improved navigation and day-to-day management. After the migration, online sales and digital presence also improved, without attributing it to a single change or inventing percentages.
The project began as a redesign. The initial analysis prevented it from remaining just that.
Other stories
