A client site running since 2019 with zero updates. Last week it started advertising an Irish online casino.
WordPress installed years ago, no backups, the person who built it long gone. Instead of the offer: a 500 € welcome bonus and free spins at Dublin Casino. A classic that happens to some Polish business every single week.
What happened
A site that had been running on WordPress since 2019 without a single update. One day clients started calling that „something is going on with the site". You type in the address, and instead of the offer you get an online casino ad with a welcome bonus in Irish.
This is not sabotage, not revenge, not someone „deliberately attacking this particular company". It is a plain bot scanning the internet for old plugins. It found one, walked in, swapped things out.
Why this works
WordPress powers roughly 43% of the internet, which means 43% of the targets for bots scanning known vulnerabilities around the clock. A plugin nobody has updated for a few years is not „an old plugin". It is an open door with a „come in" sign on it.
In this case the attacker barely bothered hiding: they injected redirects, but only for traffic coming from Google. Open the site directly, you see the real offer. Click in from search results, you land in a casino. This is called cloaking, and it is exactly as nasty as it sounds: it steals your SEO traffic and you never even see anything is wrong.
Why you cannot fix this on your own
The standard scenario for a neglected site:
- admin panel login, lost or outdated,
- password, nobody remembers it,
- the person who built the site, unreachable or inactive,
- hosting, bought „somewhere", at some company whose name has faded out of memory,
- backups, do not exist.
This is the moment when most businesses give up and say: „never mind, we will just build a new site from scratch". Losing in the process all of their Google history, years of content, and backlinks from across the web. From a marketing standpoint: back to square one.
Wayback Machine, or the internet forgets nothing
Before rebuilding anything from scratch, it is worth checking web.archive.org. Most sites are snapshotted there regularly. In this case the dots on the calendar reached all the way back to when the domain was first registered. Pick the last „clean" version and you have the whole set: descriptions, photos, structure, technical details.
The rest is ant work: pulling out text, images, layout by hand. Sometimes Archive saved the text but not the 1200 px version of a photo, and Google Cache covers the gap. Sometimes you have to rebuild a piece from zero. The rule is one: no byte is ever lost, as long as someone wants to find it.
What changed in the process
Since we are rebuilding anyway, we rebuild smarter. The result:
- Load time dropped from 6.8 s to 1.2 s (Lighthouse 98/100).
- The site finally looks like a site, not a broken table on a phone.
- Instead of WordPress: a static stack. No admin panel, no plugins, nothing to break into.
- Old URLs 301-redirected, Google rankings recovered within three weeks.
- A contact form that actually works. The previous one had been sending emails into the void for two years.
A 10-minute check you can run on your own site
- Open your site in an incognito window, ideally on a different network (mobile data is fine). Your browser cache can lie to you.
- Search Google for
site:yourdomain.com. If you see titles in Chinese, Korean, or „Best Online Casino 2025", you have a problem. - Check the last update date for WordPress and its plugins. Anything older than six months is a yellow light. Older than a year: red.
The takeaway
If your site runs on WordPress and the last update was a long time ago, the question is not whether but when the first client will call asking about a casino in Ireland. Good news: even then, it can be untangled. It is just cheaper and faster to act earlier.