Clicks Up 8x, Impressions Flat: What a Hacked Site Looks Like in Search Console

The best month this site ever had in Search Console was the month it was being robbed. Clicks went from about 200 a day to 1,462. Click-through rate went from 1% to 8.56%. Average position improved. Every number on the overview screen got better at once, and every one of them was a symptom. Eight days later Google demoted the site and it lost three quarters of the traffic it had genuinely earned.

Why this is worth reading

Almost everything written about traffic drops assumes you are looking at a graph that went down. This one went up first, steeply, for eight days. Nobody audits a good month. That is exactly what makes this pattern expensive, and it is why the owner did not call anyone until the collapse had already happened.

The site is referred to here as SITE-01. It is a real client, the data is a real first-party Search Console export, and the client is not named. Its own search terms are redacted for the same reason. The attacker’s brand terms are printed in full, because they identify nobody and they are the evidence.

The eight days that looked like a win

This is daily click volume from 17 February to 14 April 2026, taken straight from the Search Console performance export. Green is the ordinary baseline, red is the period the injected pages were ranking, grey is after Google acted.

Read the impressions column, not the clicks column. On 6 March the site got 181 clicks from 17,970 impressions. On 15 March it got 1,462 clicks from 17,087 impressions. Fewer impressions, eight times the clicks. Position moved from 5.3 to 4.1, which is a real improvement but nowhere near enough to multiply clicks by eight.

There is no legitimate mechanism that does this. If more people are clicking, Google is normally showing you more, or showing you higher. Here it was doing neither. The only remaining explanation is that the thing being clicked was not the thing the owner published.

What was actually ranking

Comparing the 28 days before the collapse against the 28 days after it, query by query, settles it immediately.

besi123 is an Indonesian slot-gambling brand. It was the single largest query on a wellness training site, at position 1.5, converting at 48.6%. A click-through rate near 50% is what a brand term does when someone searches for a specific site by name and finds it. Those were real people looking for a casino, and they were being served pages injected into this domain.

Of the 9,326 clicks lost between the two windows, 5,883 were gambling queries. That is 63% of the entire drop, and it is traffic the business never had in any meaningful sense.

The last row of that table is the part that actually cost the client money. Its own main term fell from position 2.0 to 5.3. The injected pages did not just add fake traffic on top. They dragged the legitimate content down with them, which is what a sitewide algorithmic demotion looks like.

Search Console said nothing was wrong

This is the part that sends people down the wrong road for months. Both reports were, and still are, clean:

• Manual actions: No issues detected.
• Security issues: No issues detected.

So there was no penalty notice, no reconsideration request to file, and nothing to appeal. Google had not issued a manual action. Its ranking systems had simply stopped trusting the domain, which happens quietly and reverses slowly.

An owner who checks those two screens, sees green ticks, and concludes “it must be the algorithm” is half right in the worst possible way. It was algorithmic. It was also caused by something live on their server that no amount of content rewriting would fix.

The check you can run in two minutes

You do not need a tool for this. Open Search Console, go to Performance, and do the following.

1. Set the date range to the last 12 months and switch on both Total clicks and Total impressions.
2. Look for any stretch where the two lines separate. Clicks climbing while impressions stay flat or fall is the signature. Clicks and impressions rising together is just growth.
3. If you find one, set the range to that period and open the Queries tab. Sort by clicks. Read the top twenty terms and ask whether your business could plausibly rank for each one.
4. Check Pages in the same window. Injected content usually sits on URLs you do not recognise, or on one real page being abused by a parameter.
5. Search Google for site:yourdomain.com plus a word you would never publish. Casino, slot, betting, and the equivalents in Indonesian, Vietnamese and Thai are the common ones.

A high click-through rate on a term that is not your brand is the loudest single warning. Nothing you write earns 48% of the clicks unless people were already looking for it by name.

Where it stands now

The index was cleaned. Indexed URLs fell from 8,770 on 1 June to 391 on 21 August as the injected pages were dropped, and an export of what remains contains zero gambling matches. Roughly 20,000 URLs now return 404, which is correct. They are left to decay rather than redirected.

The trough was around 40 clicks a day in late April. June to August averages about 88 a day, so it has roughly doubled off the bottom. The honest pre-injection baseline was about 196 clicks a day, which means the site has recovered somewhere near 45% of what it genuinely used to earn. The top ten queries are now entirely legitimate and there is not a single gambling term among them.

It is not finished. Publishing it half-recovered is deliberate, because the alternative is waiting until the number flatters us and then calling it a case study.

What this does not show

One site is not a study

This is a single compromise, examined closely. We have seen the same pattern on three other sites, including one carrying roughly 2,000 injected pages and another with more than 20,000, but those owners have not been asked whether their data can be published, so they are a count here and nothing more.

The headline drop is not the real damage

Losing 9,326 clicks sounds catastrophic and mostly was not, because 63% of them were never customers. The real damage is the demotion of the legitimate pages, which is smaller in raw clicks and much harder to reverse.

Not every divergence is a hack

Clicks and impressions can separate for dull reasons. Seasonality, a brand campaign, a rich result gained or lost. The signature is worth investigating, not worth panicking about.

We cannot tell you how they got in

This is a Search Console analysis, not a forensic one. It tells you what Google saw. Finding the entry point is server work, and on this site one reflecting URL parameter is still being closed.

If your own graph looks like this

Clean first, then wait. A compromise that is still live cannot be outranked, and rewriting content while injected pages are serving is money spent on the wrong problem. Once the injection is gone and the spam is out of the index, an algorithmic demotion lifts on Google’s schedule rather than yours. Our data on how long that actually takes puts the median gap between core updates at 107 days, and that is the floor, not the estimate.

If the date your traffic turned lines up with a confirmed Google rollout instead, that is a different problem with a different fix. The rollout window matcher covers all 41 confirmed updates since November 2021 and will tell you in one click.