Dos & Don’ts of Filing a Reconsideration Request
There is an art to writing a successful reconsideration request. Make it too brief and you’re dismissed as not committed enough. Ramble on too long and Google’s manual action reviewers get bored or – worse – annoyed.
And because Google’s Manual Action Review Process is 100% opaque, it took a prolonged amount of time to arrive at a reliable ‘Hacked Website Penalty’ Remediation process flow. Few people – if any – will be able to lift a manual link action on their first-ever attempt, without third-party help and advice.
“Unlike other Google Manual Actions – like ‘Unnatural Links to your Website’ – the ‘Hacked Website’ penalty has a VERY DEFINED set of remedial actions. The trick here is to be meticulous in your efforts to clean the infection, and even more meticulous in detailing the steps you took in your reconsideration request.
The Devil’s in the Detail…
The single most important piece of advice I can give to ANYONE who’s about to file a reconsideration request for a ‘Hacked Website’ manual action, is: “Be 100% sure your site is clean, and DO NOT claim to have taken any action you did not actually take. Don’t say you’re using 2-Factor Authentication and/or enforcing strong passwords, if you ar not doing so.
That goes for LITERALLY EVERY recovery measure you claim to have taken. If you didn’t do it, don’t say you did it.
With that said: A ‘Hacked Site’ Reconsideration Request makes Three VERY Distinct Declarations:
- You understand completely why Google threw the Book at you
It helps if you’re able to quote from the notification you received from Google Search Console, about exactly what caused Google to level the Manual Action against your website in the first place. - You have done your Very Best to Remedy the Situation
See above! Go into detail about the lengths you went to in order to detect and remedy the malicious intrusion. If you’ve taken any measures to educate your inhouse personnel about enhanced security, you should also mention this fact. - You Assert that your online business has Turned a Corner and that you will not Reoffend
As corny as it sounds, your Reconsideration Request must make it loud and clear that you have learned your lesson about website security, and that you are doing your utmost to prevent anything remotely like this from ever happening again..
Choose Your Words Carefully
One thing which your reconsideration request should under no circumstances include is any part which could be construed as bribery or coercion by the reviewers dealing with your case. Statements like “I’m going to send you cookies/whisky/money/whatever.” or ”If you don’t reinstate my site I’m going to do something I won’t regret later.” are strictly frowned upon by the review team, which hates bribes and intimidation, and prizes nothing more than its privacy.
And because the folks in the team want to remain anonymous, they will also ignore any link to documentation that is not part of the Google ecosystem, because they can’t tell if they’re being traced. Again, such links are at best ignored and at worst frowned upon. So if you’re including documentation, make sure it’s shared in Google Docs.
YOU HAVE BEEN WARNED.
Here’s a Standard ‘Hacked Website’ Reconsideration Request Template
Dear Google Search ConsoleTeam
I am writing to you regarding the manual action imposed on my WordPress website under the classification of a “Hacked Website.” Our company’s website, [YourWebsiteURL], has undergone a thorough cleaning and security reinforcement, and I am eager to request a reconsideration for the manual action to be lifted.
Below you will find an overview of the actions taken by our company to rectify the issues flagged by Google Search Console for manual intervention.
REMEDIAL ACTIONS TAKEN:
Comprehensive Security Audit:
We conducted a detailed security audit to identify and rectify vulnerabilities within our website’s infrastructure. All plugins, themes, and the WordPress core were updated to their latest versions to address any potential security loopholes. Additionally, we have ensured that all redundant theme and plugin files have been removed, to further reduce our WordPress installation’s risk profile.
Malware Removal and Cleanup:
A thorough scan of the entire website was performed with [list security plugins/tools] to detect and remove any malicious code or files. Malicious code and files were subsequently removed and replaced with clean code/files.
The code and contents of the .htaccess, wp-config.php, functions.php, [add additional files] has been reviewed manually, to assure its integrity.
We have implemented security measures to prevent future malware infections, including continuous monitoring and regular scans with [insert service/plugin name.
Password and Access Management:
All user passwords were reset, and access permissions were reviewed to ensure that only authorized personnel have access to the website backend, with specific focus on redundant “Admin” roles being downgraded to “Editor.”
Two-factor authentication (2FA) and strong passwords have been enforced to add an additional layer of security.
Web Hosting and Server Security:
We have worked closely with our hosting provider, [insert name of web host] to enhance server-level security configurations. Server logs are now being regularly monitored for any unusual activities, and immediate action will be taken if and when any suspicious behavior is detected.
Google Search Console Security Checks:
We have thoroughly reviewed and addressed all security issues flagged in the Google Search Console. Regular checks will be conducted from now on, to ensure ongoing compliance with Google’s security standards.
Content Security Policy (CSP) Implementation:
We have implemented a Content Security Policy to mitigate the risk of cross-site scripting (XSS) attacks and other security vulnerabilities.
[I REPEAT FOR THOSE HARD OF THINKING! DO NOT CLAIM TO HAVE TAKEN ANY ACTIONS YOU DID NOT ACTUALLY TAKE!]
We understand the importance of maintaining a secure online environment and appreciate the efforts taken by Google to ensure the integrity of its search results, as well as the continued safety and security of its users. We therefore request your team to reconsider the manual action imposed on our company’s website, taking into account the security measures outlined above.
We are confident that the steps taken will prevent any recurrence of security issues, and I am committed to maintaining a secure and user-friendly online presence. Your prompt attention to this matter is highly appreciated.
If there are any additional steps or information required from our end, please do not hesitate to let us know.
As the [insert your role/position] in charge of this undertaking I am always willing to collaborate and provide any necessary details to expedite the reconsideration process.
Thank you for your understanding and consideration.
[Your Name]
[Your Email Address]
[Your Contact Number]
That’s it. Be Patient
YOU’RE DONE! Depending on how busy the reconsideration team is when you file your request, it can take up to a couple of weeks to get a response. And if you’ve done your job properly, that response will be an “All Clear”… eventually.
Good Luck.
But… Just in case you’re NOT the luckiest person alive
You will need to reexamine your site’s codebase for anything you may have missed, or any vulnerabilities you may have overlooked. De-Hacking a website is a tricky undertaking even if you are a coder, and detecting and purging all traces of both the malicious code, and of any backdoors which may be left in your WordPress installation takes both experience and time.
If you do need to prepare a second request, you must realize that your inhouse resources have been insufficient to fully deal with the problem. At that point it’s crucial that you seek the right outside help, if you want to save your online business.
Once again, Good Luck.
Contact us today for a free consultation, or to see how we can help you deal with your Manual Action.
