Hacked WordPress site replaced with a catalog of 334 machines

UAB Medienos staklės in Jonava has sold new and used woodworking machinery, spare parts and tools since 2000, and builds machines under its own brand, Woodland Machinery. Its site ran on WordPress with a WooCommerce catalog that nobody was looking after: a 2016 release of WordPress with updates deliberately switched off, on a version of PHP that lost support in 2018. On August 24, 2026 the company called to say the site wouldn't open. A check from outside showed two things at once: the site returned a server error instead of a page, and the internet provider's protection flagged the domain as possibly infected. Once we had server access, the worse explanation was confirmed. Since June the site had been turned into a farm for someone else's links, with hidden admin accounts, plugins of its own and a kit that rebuilds itself when you delete its files.

Cleaning it wasn't worth it. A cleanup would have left a ten-year-old WordPress that would get infected again, and updating it along with its multilingual setup and abandoned theme would have meant rebuilding the site anyway. There was no clean point to restore: the only backup was from 2020. The most valuable part, the catalog itself, sat in the database and could be taken out. The client asked for two things: the whole catalog in three languages, and the company's registered trademark, Woodland Machinery, shown everywhere. A third came up after the first version. The buyer here is a workshop owner or a production manager, and the site had to be easy for him to read, not dense.

• The catalog, first from the old database, then from the client's own files. We first took it straight out of the old database without touching the infected files. Later the client sent his full set: 930 files, with folders as product groups and sheets holding photos and specifications. That set became the catalog: 334 machines with photos and spec tables.
• A static site. Pages are generated in advance and served as finished files: no WordPress, no database on the server, no plugins to update and no login page to break into. The inquiry form sends an email and stores nothing. The old site had kept every inquiry in a database that outsiders could get into, and we didn't want to repeat that.
• Three languages at real addresses: /stakles/, /en/machines/ and /ru/stanki/. The language is part of the address, not a setting, and every page is linked to its translations with hreflang tags. Each of the 1,110 pages in the sitemap has its own title and description. In the old catalog eleven different machines had the same name, so each one now carries its stock number.
• Woodland Machinery everywhere: its own page in three languages, a tag on each of its products, a banner on the home page, a link in the footer and a switch in the admin panel. The company had no vector original of its logo, so we redrew it from measured pixels and delivered it as a set of SVG and PNG files it can use outside the website too.
• An admin panel where the client publishes himself. At /valdymas they edit products and prices, upload photos, add, hide and delete machines, and a Publish button rebuilds the site without us. Specifications are typed as plain text: a line like “Key: value” becomes a row in the table, with a preview right under the box.
• Easy to read for the people who buy. The buyer is often over 45, so after the client's first note we raised font sizes, brought contrast up to the WCAG AA level and enlarged tap targets to 44 pixels. Phone and email are on the first screen.
• Prices only where the client wants them: on used machines and on his own brand, shown before VAT. Other makers' machines say “price on request”.
• Old addresses and reputation. A map of the old WordPress addresses redirects to the new pages, and the spam addresses the attackers created return a 410 code, so search engines forget them. The internet provider lifted its block two days after launch, and Search Console shows no security warnings.

• August 24, 2026: the call. A server error instead of a page, and the provider's block. At that point nobody had access to the server.
• August 27: the client reset the server password. Within one day we had a full diagnosis, a copy of the catalog from the old database, and an agreement on a new site instead of a cleanup.
• August 28: the first version at a preview address, with the catalog from the old database, three languages and the admin panel. The client's first note the next day was about readability, not features, and it changed the font sizes across the whole site.
• September 15: the client uploaded his set of 930 files, 1.57 GB, with folders as product groups. Within a day they were products with photos and specifications. From then on the catalog was his, not the old database's.
• September 22: the client changed one DNS record in his registrar account himself, and medienosstakles.lt started showing the new site. We checked the redirects from old addresses live that evening.
• September 24: at our request, the internet provider took the domain off its list of infected sites. The day before, Search Console ownership was verified and the sitemap submitted, with no security warnings.
• September 30: handed over with instructions for the admin panel. The same day the client sent his first review.

The site is live at medienosstakles.lt/en/ in English, with Lithuanian and Russian versions. On October 20, 2026 it had 334 machines in 27 product groups and 1,110 pages in the sitemap. Since September the client fills the catalog himself: his manager changes prices, hides machines that sold, adds new ones and publishes, all in the admin panel. We don't step in anymore, and that was the goal. What isn't done yet: some machines have no price, because other makers' prices change and the client doesn't want to show them. The old site's reputation also follows the domain longer than the site itself. The provider's block is gone, but some antivirus lists may remember the domain for a while, and we ask each one separately to remove it.

• Open medienosstakles.lt/sitemap.xml and count the addresses. On October 20, 2026 there were 1,110, with equal numbers under the /en/machines/ and /ru/stanki/ prefixes. The client adds to the catalog himself, so the number grows.
• On the home page, the buttons for new and used machines show counts taken from the live catalog. They change when the client publishes.
• Type “Woodland” into the search at the top. You'll find the company's own machines with their brand tag and prices before VAT.
• Enter medienosstakles.lt into Google's Safe Browsing site status check. There should be no warnings.
• Open any machine: stock number, condition, a spec table, and an inquiry form that sends an email instead of storing your details on the site.

• A WordPress site that never gets updated isn't a risk, it's a countdown. Ten years without updates doesn't mean it works fine. It means it is waiting. If your site runs on WordPress, check its version and its PHP version now. If that PHP version is no longer supported, the question is when, not if.
• Don't fix a hacked site, copy it first. The first step is a copy of the evidence and the data, not a cleanup. Here the site was down because the attackers themselves had broken it, and that breakage was the only thing holding back the spam links. “Just fix that one file” would have put the spam back online.
• The catalog is worth more than the website. A site can be rebuilt in days. A three-language catalog with specifications and photos can't be put together again in a month. Keep it somewhere you can take it without a developer: folders, spreadsheets, an export, anywhere but only inside a WordPress database. Here the client's own folders became the catalog.
• Reputation travels with the domain. Internet providers and antivirus tools block the domain, not the server. A clean new site on the same domain still inherits the old one's reputation, and removal has to be requested from each list separately. Plan that as part of the launch, not as a surprise.

We don't publish traffic or rankings. Search Console is connected, but the new site went live on September 22, 2026 and the old domain was blocked before that, so any before and after would compare a working site with a broken one.