Cleaning up and speeding up a hacked real estate website
Solitaire Crest Properties, a Dubai real estate agency, had a WordPress site quietly serving hidden casino spam to search engines, with broken images and slow pages. I removed the injected content, repaired the SEO damage, hardened the install and cut server response time from 1,600 ms to 110 ms.
A site that looked fine to visitors, but not to Google
To a normal visitor the site looked normal. Underneath, it had been injected with hidden gambling content: five hidden blocks on the homepage, stored inside Elementor widgets where ordinary file scanners do not look. Because the homepage meta description was generated from page text, search engines were being shown a casino description, and the social-sharing image and structured data pointed to a casino website.
On top of the spam, the site had accumulated problems that hurt both visitors and rankings:
- Conflicting SEO output: duplicate canonical tags, two different
og:titletags, duplicate JSON-LD blocks and two competing sitemap systems. - Missing meta descriptions on pages, posts and property listings.
- Broken images: hero, testimonial and gallery images pointed at a theme vendor's demo domain that no longer existed.
- Slow responses: the server took about 1,600 ms to start sending each page.
Verify everything as a real visitor sees it
Logged-in admins often see a different site from the public, because of caching and because spam injections often hide themselves from administrators. So every check and every fix was verified against the live site with cookie-free requests, exactly as Google and anonymous visitors receive it.
I worked through a full technical audit covering security, SEO, performance and site hygiene, and kept a running tracker of what was fixed, what was tested, and what was rolled back.
Cleanup, SEO repair, hardening and speed
Spam removal
- Stripped the five hidden gambling blocks out of the homepage's Elementor widgets and removed the empty containers they left behind.
- Removed the casino meta description, social-sharing image and structured-data image, and replaced the homepage social image (previously a theme placeholder) with a real property photo.
- Audited the custom code snippets on the site to confirm none of them were malicious.
SEO repair
- Reduced duplicate canonical,
og:titleand JSON-LD output to one of each, and retired the competing sitemap system. - Restored meta descriptions across all pages, posts and listings, and wrote a new 151-character homepage description.
- Set six demo and utility pages to
noindex, shrinking the sitemap from 17 URLs to the 11 that matter. - Trimmed the site-name suffix from all 112 listing titles, wrote real descriptions for the main listing pages, and added 301 redirects from mixed-case URLs to lowercase.
Hardening
- Deactivated the file-manager plugin and redundant SEO plugins, blocked user enumeration through the REST API, disabled XML-RPC, stopped the server advertising its PHP version, and added
Referrer-PolicyandPermissions-Policyheaders. - Corrected the site timezone to Asia/Dubai so scheduled content and logs line up with local time.
Performance and images
- Replaced a misconfigured caching plugin with LiteSpeed Cache, taking server response time from about 1,600 ms to 110 ms with server-level cache hits.
- Repointed 80 database rows from the dead demo domain so the hero, testimonial and gallery images display again.
- Enabled CSS/JS minification and
font-display: swap, and started converting the image library to WebP (more than 1,000 images converted).
Knowing when not to ship an optimisation
Not every speed-up survived testing. Combining CSS files, lazy-loading images and stripping unused CSS each improved a lab score but broke something real for logged-out visitors: a blank hero, a stuck property carousel, or images left on placeholders. Every one of those changes was rolled back the same day, and the safe path (tuning unused-CSS removal on a staging copy) was documented instead.
I handed over a prioritised plan for the remaining hardening, SEO and accessibility work, so the team knows exactly what to do next and in what order.
Results
Tech stack
- WordPress
- Elementor
- Directorist
- Yoast SEO
- LiteSpeed Cache
- WebP
- Security hardening
- Technical SEO