06:17 pm
We restored CPC Clinics' control of its hacked WordPress website. The team removed more than 10,000 spam posts and asked Google to review the site. An October 2026 review then added 2-factor login, forced HTTPS and fewer plugins.
| Project detail | Summary |
|---|---|
| Client | CPC Clinics (Canadian Psychological and Counselling Clinics), Calgary, Alberta |
| Industry | Psychology and counselling clinic |
| Platform | WordPress website |
| Scope | Incident recovery, malicious code cleanup, Google Search recovery and security maintenance |
| Main tools | Hosting and database tools, Wordfence, Google Search Console |
| Timeline | Incident response first; follow-up maintenance review in October 2026 |
AurixLab's web development and SEO teams worked on this project together. The web development and cybersecurity team recovered and hardened the site. The SEO team documented the work in this case study.
CPC Clinics, or Canadian Psychological and Counselling Clinics, is a Calgary psychology practice. Its team includes a Registered Psychologist, Registered Provisional Psychologists and a Registered Clinical Social Worker. The clinic offers mental health counselling in Calgary, psychological assessments, rTMS treatment and workshops.
Clients can book in person or online across Alberta. The clinic's website, cpcclinics.ca, and its Google results can be a client's first contact.
An attacker changed the WordPress admin password and locked CPC Clinics out of its site. The attacker then used the site to publish spam. The incident records describe more than 10,000 unwanted blog posts.
The damage reached Google as well. Search results showed Japanese-language spam linked to the clinic. Google's web.dev guide calls this pattern the Japanese keyword hack.
The attack hurt the clinic in 3 ways:
The attack hid in 4 places, so deleting spam posts alone would not stop it. A backdoor can survive a password change. A malicious database setting can keep redirecting visitors even after a file repair.
| Hiding place | What the team found |
|---|---|
| Administrator accounts | An administrator account that nobody at the clinic had authorized |
| Site files | A changed WordPress entry-point file, an unauthorized PHP file and malicious code in the theme |
| Database settings | Injected WordPress option records tied to spam redirects |
| Code snippets | Malicious code inside the site's managed code snippets |
We recovered the site in 5 steps, starting with control and ending with prevention.
The cleanup kept the clinic's legitimate code intact. The team kept the site's analytics and schema code in place. The compromised snippets also held a legitimate comment-disabling feature, so the team rebuilt it cleanly.
The website and its Google results need 2 separate cleanups. Google can keep showing old spam results after a site is clean. The team asked Google for a security review and a fresh crawl through Search Console.
Per Google's Security issues report page, a review can take days to weeks. The records confirm the requests went to Google. They do not record the date every spam result left Google's index.
Search recovery after a hack is part of our SEO services in Calgary. A clean site can still lose clients while spam results stay in Google.
An October 2026 maintenance review removed unused software, tightened logins and confirmed backups. Every plugin can carry a flaw, so fewer plugins means fewer ways in.
| Area | What changed |
|---|---|
| Plugins | 10 inactive plugins and 1 obsolete flagged extension deleted |
| Administrator login | Administrator accounts reviewed; authenticator-app 2-factor login turned on |
| Password-guessing defense | Wordfence login settings tightened and XML-RPC access restricted during the incident response |
| Firewall | Wordfence firewall rules refreshed by hand after an update issue |
| HTTPS | Every visit now redirects to the secure HTTPS version of the site |
| Server software | PHP environment reviewed |
| Backups | Hosting backups confirmed for files and database; latest backup observed October 23, 2026 |
XML-RPC is an older WordPress remote-access feature. Attackers often use it to test many passwords at once. The team also made a separate full local backup during the incident response.
The host's scanner reported no file malware in the 30 days before the October review. Other checks confirmed the backups, the 2-factor login and the firewall refresh. Each check proves one specific thing, and the table shows its limit.
| Check | What it confirmed | What it does not prove |
|---|---|---|
| Hosting malware scan | No malware in website files over 30 days | That the database is clean, or that no flaw exists |
| Backup dashboard | File and database backups exist | That a restore works; the records show no restore test |
| Login settings | Authenticator-based 2-factor login is on | That every administrator has enrolled |
| Wordfence firewall | Rules refreshed successfully | Protection against every future attack |
| Search Console | Review and recrawl requests went to Google | The date every spam result left Google |
What we do not claim: this was incident recovery and maintenance work. It was not a penetration test or a security certification. No website is immune to future attacks, so the protection continues as ongoing maintenance.
Security on the CPC Clinics site is now a maintained routine, not a one-time fix. Ongoing maintenance repeats the checks from the October review:
Four lessons from this recovery apply to any clinic or small business that runs WordPress.
We can recover a hacked WordPress site and set up ongoing security maintenance. This work is part of AurixLab's web design and development services in Calgary. Book a free 30-minute growth mapping call to start.
The Japanese keyword hack fills a hacked website with autogenerated Japanese spam pages. Google's web.dev guide says these pages often link to stores selling counterfeit goods. The pages often sit in randomly named folders. The spam can then appear in Google results under the real business's name.
The attacker changed the main WordPress administrator password, so the normal login stopped working. We regained control through the clinic's authorized hosting account and database tools. The team then reset the passwords. It also deleted an administrator account nobody at the clinic had authorized.
Spam posts are the visible result of an attack, not its source. Attackers often leave footholds in files, settings and code snippets. A backdoor can survive a password change. A malicious database setting can keep redirecting visitors after a file repair.
No. A clean scan covers only what that scanner checks, over a set period. At CPC Clinics, the hosting scanner checked website files for 30 days, not database content. We pair scans with account reviews, firewall rules, backups and regular updates.
Google's Security issues report page says a hacked-site review can take days to weeks. Old spam results may stay visible during that time. Request the review only after the site is fully clean. Then keep watching Search Console for new security issues.
