Ranking Recovery · Part 10
The cleanup returns you to zero, not to first
Everything in this series so far has been about undoing damage: getting spam out of the index, clearing warnings, getting real pages seen again. When that is done, the site is back to being an ordinary website with a difficult recent history.
That is the moment owners ask the real question. How do I improve my Google ranking from here? The answer has two parts. One is specific to a site that has been hacked. The other is the same answer any site would get, and for a recovering site it matters more, not less.
What was the ranking before?
Start with an uncomfortable check. Go back through Search Console’s Performance report to before the compromise began. What did the site rank for then? How many clicks did the real pages get?
For some sites, the answer is a healthy record, and recovery means getting it back. For many small sites, the honest answer is that the pages ranked for the business name and little else. In that case the hack did not take away rankings the site never had. It is still worth knowing, because it changes the job. You are not restoring a position. You are building one, on a domain that has just given Google a reason for caution.
Neither situation is hopeless. They call for different expectations.
The part that is specific to a hacked site
Four things matter more after a compromise than they would otherwise.
Consistency over time. A domain that recently served thousands of deceptive pages is being watched. What rebuilds confidence is an unbroken stretch of the site being exactly what it claims to be. Months of nothing surprising.
No second incident. A site that is flagged, cleared and flagged again is treated far more cautiously than one that was hit once. This is why hardening comes before ranking work. The hardening series is the prerequisite for this part.
Checking your backlinks. Spam campaigns often build links to the injected pages from other compromised sites. Search Console’s Links report shows who links to you. Links pointing at addresses that now answer 410 do nothing and can be ignored. Google’s guidance is that the disavow tool is for sites with a manual action over links, or a large number of links they built themselves and cannot remove. Most hacked sites need neither.
Structured data. If the attackers injected fake product and review markup, check that none of it survives on your real pages. Search Console lists what it finds under the enhancement reports.
The part that is the same for everyone
After that, improving a ranking is the same work it always was.
- Each page answers one real question completely. Thin pages get passed over on a clean domain too.
- The page that matters most is obvious. Your own links should point at it more than at anything else.
- The site is aimed at searches that happen. A page can rank first for a phrase nobody types.
- The business is consistent everywhere. Name, address, phone, services.
- Real evidence accumulates. Reviews, mentions, a track record.
The third item deserves a second look after a hack. Many owners discover during recovery, while reading Search Console closely for the first time, that their pages were built around phrases with no search demand at all. That is not hack damage. It is the most common reason a clean, well-built site brings in nobody, and recovery is a good time to find it.
How Google ranking works, in two sentences
Google tries to show the page most likely to satisfy the person searching, from a source it has reason to trust. Everything you do either makes your page a better answer or makes your site a more credible source.
A hack damages the second. It does nothing to the first. Your pages are as good or as weak as they were. So the fastest gains after a cleanup often come from the first half: making the real pages better answers, which is entirely within your control and does not depend on Google’s memory of the incident.
Use the attention you are already paying
There is one advantage in having been hacked. You now look at your site more closely than most owners ever do. You know what is in the index. You read Search Console. You may read your logs.
From the case file. The investigation behind these articles ran for months and involved reading the server logs, the indexed addresses and the rules on the account, line by line. A side effect was a far more exact understanding of how Google actually crawled the site than the owner had before: which pages it visited, how often, and which it ignored. That knowledge was a by-product of the cleanup, and it outlasts it.
Most sites are never examined that carefully. Yours has been. Use what you learned.
What a realistic timeline looks like
- First month after cleanup: real pages return to the index; the business name ranks again.
- Months two to four: indexed spam clears; crawl attention shifts back to real pages; rankings you held before begin to reappear.
- Months four to twelve: the tail of never-fetched spam addresses shrinks; trust rebuilds; improvements to your real pages start to show.
Those are typical, not promised. SEO takes months on a site with no history of trouble, and recovery adds to that.
What not to do while you wait
- Do not change the address structure of the site. Google is already reconciling one set of changes.
- Do not buy links to make up lost ground. A domain under extra scrutiny is the worst place to try it.
- Do not publish in bulk to bury the past. Fifty thin posts look like a second spam event.
- Do not judge week by week. Compare month with month.
The position is not the prize
A last point from someone who has been through it. After a hack, rankings feel like the thing that was taken, so getting them back feels like the goal. The owner in this case came to a different view: what a site really has is trust, with Google and with customers, and position is only one visible sign of it. A site can be put back in order, kept honest, and maintained in the open. Rankings follow that or they do not, on a schedule nobody controls. The work is the part you own.
When the cleanup is behind you, the place to begin is with what Google sees now. The Free Visibility Snapshot is a narrow analysis of how Google reads your site today, with the hack out of the picture. From there, the DIY SEO Audit lists what to fix on your real pages, in order, if you intend to do the rebuilding yourself.
See what Google seesFree · the Free Visibility Snapshot™ · a narrow look at four signals, not an audit
Back: Google Index After a Hack: How Long the Spam Pages Stay
Hub: Ranking Recovery Blog Series
ProVAE builds and recovers websites in Douglas, Georgia, serving South Georgia.