I’m dealing with a ranking issue and would really appreciate input from people who’ve seen similar cases.
I run a local service business in the kitchen and bathroom remodeling industry, serving multiple cities. In October, one of our subdomains was hijacked and started serving spam/porn content that we did not create. As soon as we noticed, we deleted the DNS record for that subdomain and submitted URL removal requests through Google Search Console. The subdomain was fully removed, but shortly after that our entire website temporarily disappeared from Google. A little while later it came back.
Around November 19, we saw a major drop in performance. Search impressions collapsed, and many pages that were previously ranking on the first page dropped to page 5 or beyond. New pages are being indexed normally according to Search Console, but they receive little to no impressions and do not appear in search results. There are no manual actions, no crawl issues, and no indexing errors reported.
What’s confusing is that branded searches seem to work fine now. The homepage shows, brand-related queries perform normally, and local brand visibility appears stable. However, city pages and service pages are essentially invisible in non-brand searches, even though they are indexed and crawlable. It feels like Google still trusts the brand entity, but not the broader content or site authority.
We do have an older domain for the same brand with a cleaner history and slightly stronger link profile, but it’s the same business, same locations, and same entity overall. I’m trying to understand whether this situation looks like a site-level trust or quality demotion caused by the subdomain hijack, and whether it’s common to see branded queries recover first while non-branded pages remain suppressed.
If anyone has experience with subdomain hijacks, spam incidents, or trust resets following core updates, I’d really appreciate hearing how long recovery took, what actually helped, and what turned out not to matter. Thanks in advance.
I run a local service business in the kitchen and bathroom remodeling industry, serving multiple cities. In October, one of our subdomains was hijacked and started serving spam/porn content that we did not create. As soon as we noticed, we deleted the DNS record for that subdomain and submitted URL removal requests through Google Search Console. The subdomain was fully removed, but shortly after that our entire website temporarily disappeared from Google. A little while later it came back.
Around November 19, we saw a major drop in performance. Search impressions collapsed, and many pages that were previously ranking on the first page dropped to page 5 or beyond. New pages are being indexed normally according to Search Console, but they receive little to no impressions and do not appear in search results. There are no manual actions, no crawl issues, and no indexing errors reported.
What’s confusing is that branded searches seem to work fine now. The homepage shows, brand-related queries perform normally, and local brand visibility appears stable. However, city pages and service pages are essentially invisible in non-brand searches, even though they are indexed and crawlable. It feels like Google still trusts the brand entity, but not the broader content or site authority.
We do have an older domain for the same brand with a cleaner history and slightly stronger link profile, but it’s the same business, same locations, and same entity overall. I’m trying to understand whether this situation looks like a site-level trust or quality demotion caused by the subdomain hijack, and whether it’s common to see branded queries recover first while non-branded pages remain suppressed.
If anyone has experience with subdomain hijacks, spam incidents, or trust resets following core updates, I’d really appreciate hearing how long recovery took, what actually helped, and what turned out not to matter. Thanks in advance.
