Skip to content
Dalanovum Book a call
Menu

The backdoor only Google saw

The owners saw an ordinary website. Google saw spam links and redirects. The attacker had not hacked the sites, but bought the plugins they used.

By Fawzi Aiboud Nygren, Dalanovum · Published

Short answerYes, a website can lose visibility in Google without being hacked itself, if a plugin or script from a vendor is hijacked. Reduce code from other companies where you can, allow only approved scripts and watch the security warnings in Google Search Console.

In early 2025, someone bought a collection of WordPress plugins on the Flippa marketplace and added a backdoor. On 6 April 2026 it was switched on. From then on, the affected websites showed spam links and redirects, but only to Googlebot.12 The owners noticed nothing.

WordPress.org closed 31 plugins the next day.1 The update shut the backdoor but did not clean the websites that were already infected.

Why is this an attack on visibility?

The technique is called cloaking: Google sees one thing and visitors another. The aim was to borrow the sites' standing in Google, and Google judges a website by what Googlebot sees.3

State attackers do the same. In 2025, Amazon stopped a campaign linked to Russia's APT29, in which hacked websites sent roughly one visitor in ten elsewhere.4 When only some visitors are affected, it is hard to notice.

Why is code from other companies a risk?

Most of what a company website loads from other companies has a purpose: analytics, chat or newsletters. But every vendor is a way in. In Byråindex, 52% of 500 Swedish agency websites contact other companies before the visitor has answered the cookie banner.

Two identical browser windows, one behind the other. The front one is calm and ordinary; the hidden one behind is full of small arrows pointing away.
Illustration: Dalanovum.

How do you protect your website?

  1. Reduce code from other companies as far as you can, and check who supplies what you need.
  2. Allow only approved scripts with a security rule (Content Security Policy).
  3. Watch the security warnings in Google Search Console and see the page as Googlebot does, with URL inspection.3
  4. Be wary when a plugin changes owner.
  5. Have a plan for the first hours if the website is flagged.

More on how we work is on our cybersecurity page.

Frequently asked questions

Can my website lose rankings in Google without being hacked?

Yes. If a plugin or script from a vendor is hijacked, the attacker's code can show spam to Google on your website, and Google judges the site by that.

What is cloaking?

Showing one thing to the search engine and another to visitors. It breaks Google's rules, and the site it happens to can be penalised even if someone else was behind it.

How do I find out if Google sees something different from me?

Use URL inspection in Google Search Console, which shows the page as Googlebot sees it, and watch the security issues report.

Is updating the plugins enough?

No. In the April 2026 case, the update shut the backdoor but did not clean the websites that were already infected.

Sources 4

  1. Austin Ginder, Anchor Hosting: Someone bought 30 WordPress plugins and planted a backdoor in all of them, 9 April 2026. ↑
  2. The Next Web: Someone bought 30 WordPress plugins and planted backdoors in all of them, 15 April 2026. ↑
  3. Google, web.dev: Fix the Japanese keyword hack. ↑
  4. The Record: Amazon shuts down watering hole attack attributed to Russia's APT29, 2025. ↑