Two paths through the same incident.
Without the Doppelgänger
- 1
Break-in
Through a vulnerability, attackers generate thousands of spam pages that only search engines see.
- 2
Weeks later
Rankings collapse, and Google shows a security warning. It was noticed because inquiries dropped.
- 3
Days to weeks
Cleanup, removing the pages from the index, a review request in Search Console.
With the Doppelgänger
- 1
First night
File comparison and content validation raise the alarm.
- 2
After that
The site is clean before Google finds the pages in large numbers.
An update alone is not enough: for almost half of all WordPress vulnerabilities there is no patch yet when they are published. That is why nightly monitoring is part of it.
What the incident costs.
More case studies
The test email to every customer
While the new newsletter was being tested, 4,000 real customers received an email saying “Test Test”.
The backup that came too late
The website had been infected for three weeks. The host’s backups went back seven days.
The big update without a rehearsal
The Shopware major update ran on Sunday. On Monday the store accepted no payments.
A typical course of events, assembled from real incidents. Figures are example calculations based on the stated assumptions.